For your organisation to implement the optimal information security infrastructure, controls, and policies, it not only has to account for the various cyberattacks it faces but the types of threat actors who could carry them out too, to avoid costly breaches.
Let’s get a closer look into different threat actors types and discover how dangerous each of them is.
Threat Actors Definition
Threat actors, or cyber threat actors can be described as an internal or external attacker that could cause harm to an individual or organisation by infiltrating their IT infrastructure or compromising their data security. This could be via perpetuating financial fraud, stealing or leaking data, exploiting vulnerabilities, or deploying malware.
Types Of Threat Actors
Hackers
A hacker is someone with the technical skills to gain unauthorised access, or “hack”, into an organisation’s IT systems. While the term “hacker” is one of the most commonly used to describe threat actors, it’s really a broad term that describes several types of actors with malicious intent. Consequently, many of the other types of threat actors featured in this post are also hackers. However, not all hackers have malicious intent: some are known as ethical or “white hat” hackers and use their skills to combat those with malicious intent.
Because hacker is a catch-all term, the danger they pose to your organisation depends on their skill level and intent. A hobbyist, for instance, could be mildly dangerous, while a cybercriminal or terrorist could be very dangerous.
Cybercriminals
A cybercriminal utilises digital tools and technical skills to engage in criminal activity. Their primary motivation is financial gain: whether directly (i.e., the theft of cash or cryptocurrency), by stealing and selling sensitive data, or by hijacking and ransoming data and computing resources (through ransomware). Cybercriminals can target businesses or individuals in their pursuit of profit and work individually or collectively as a cybercriminal organisation.
Like “hacker”, the term cybercriminal is used frequently to describe a variety of threat actors. Because of how common they are, compared to other types of threat actors, and their monetary motive, they’re a persistent danger to organisations of all sizes.
State-Sponsored Actors
State-sponsored actors, also known as nation-state actors, are enlisted by their government to attack an opposing country’s critical infrastructure, institutions, and businesses. This could be in an effort to destabilise the target country or to steal confidential and potentially lucrative information, such as that related to technology, finances, nuclear programmes, etc. A state-sponsored actor could be a government agency, e.g., the National Security Agency (NSA), in the US, or an external group – including cyber terrorists.
Because state-sponsored actors have the resources of a government behind them and are typically highly skilled, they can be extremely dangerous. That said, they tend to target specific, government-related institutions that have the highest cybersecurity defences.
Cyber Terrorists
Cyber terrorists leverage technology and technical skills to cause economic and physical harm in pursuing a particular agenda. Like conventional terrorists, they aim to spread fear and intimidation amongst a population. In many cases, cyber terrorists’ actions will be politically motivated, and they’ll have their government’s backing, whether implicitly or explicitly,. Consequently, they’ll target state-owned infrastructure and operations, key businesses, and other critical services for maximum effect.
Like state-sponsored actors, cyber terrorists are extremely dangerous types of threat actors – especially as their actions can have far-reaching consequences.
Hacktivists
Like cyber terrorists, hacktivists are politically-motivated types of threat actors – which often sees them grouped together as ideologues. However, hacktivists don’t set out to cause damage to an economy or population and aren’t backed by any government. Instead, their purpose is to raise awareness about their cause and spread information about it. This could include leaking sensitive information from the organisation they infiltrate. Commonly, their targets are organisations and institutions that are the antithesis of what they stand for or are the reason their cause exists in the first place. “Anonymous” is a prime example of a hacktivist group though a hacktivist could also operate alone.
As hacktivists aren’t usually financially motivated and don’t seek to do as much damage as possible, they’re less dangerous than cybercriminals and cyber terrorists but still pose a danger.
Hobbyists
Also sometimes referred to as “script kiddies”, this type of threat actor typically possesses rudimentary amounts of technical skill. Hobbyists are often motivated by learning more about how IT infrastructure and networks operate and are looking to experiment with the knowledge they acquire. Consequently, they typically use the various scripts, code repositories, and malware that are freely available online.
Now, although many hobbyists aren’t especially dangerous, some of them can be. On the one hand, even if they manage to breach your organisation’s cyber defences, they might not have the desire to cause any significant harm. It’s possible they just wanted to see if they could and, more importantly, don’t want to get into trouble. Conversely, because they’re not completely aware of what they’re doing, they can unintentionally damage your IT systems and compromise your data.
Another thing to bear in mind is that today’s hobbyist could be tomorrow’s cybercriminal or terrorist – they all had to start somewhere. If motivated, they can improve their skills and proceed to cause significant damage down the line – especially if they fall in with like-minded individuals who help nurture their abilities.
Insiders
An insider is a threat from within an organisation instead of externally. This could be in the form of a disgruntled employee looking to damage an organisation before they depart. Similarly, a rival company could enlist an insider to steal valuable information or intellectual property as a form of corporate espionage.
Alternatively, an insider can be categorised as an employee who unwittingly helps external threat actors with their aim of successfully infiltrating an organisation. This commonly occurs through phishing, where an employee opens a malicious link or attachment. This results in them revealing their login details and allows the malicious actor to breach the organisation’s defences.
Insider threats have become more common in recent years and can be especially dangerous. This is because they’re difficult to detect as the employee has legitimate access to the company’s infrastructure and data and has knowledge of the organisation’s security policies and protocols.
If you’d like to know more about how to protect your organisation from the different types of threat actors, contact RiskXchange for a free attack surface assessment.