6.2 Threat Landscape Analysis, Threat Actors & Attack Vectors
Key Takeaways
- Threat actors are categorized by intent, capability, resource level, and motivation, ranging from highly funded nation-states (APTs) to opportunistic script kiddies.
- Insiders represent one of the most severe risk categories, encompassing both malicious actors (sabotage, espionage) and inadvertent human error (misconfigurations, phishing susceptibility).
- Attack vectors represent the pathways and mechanisms utilized by adversaries to gain unauthorized access, exploit vulnerabilities, or execute payloads.
- The Lockheed Martin Cyber Kill Chain models the linear 7-stage progression of an intrusion, enabling proactive defense-in-depth disruption at each sequential phase.
- The MITRE ATT&CK framework provides an empirical knowledge base of real-world adversary Tactics, Techniques, and Procedures (TTPs), mapping threat behavior directly to detection and mitigation controls.
6.2 Threat Landscape Analysis, Threat Actors & Attack Vectors
In enterprise IT risk management, a threat is any natural, human, or environmental circumstance or event with the potential to adversely impact organizational operations, assets, or individuals via unauthorized access, destruction, disclosure, modification of information, or denial of service.
A foundational axiom of the ISACA CRISC framework is the mathematical and operational relationship governing risk:
Risk = Threat x Vulnerability x Impact (Asset Value)
Without a viable threat actor exploiting a vulnerability, there is no active exposure. Therefore, conducting systematic threat landscape analysis is essential for anticipating adversary behaviors, identifying attack pathways, and deploying defensible safeguards.
1. Comprehensive Threat Actor Taxonomy
Threat actors vary dramatically in their resources, technical sophistication, persistence, and underlying motivations. Understanding the profile of the threat actor allows risk practitioners to construct realistic risk scenarios and allocate defensive resources proportionally.
+-----------------------------------------------------------------------------+
| THREAT ACTOR SPECTRUM MATRIX |
| |
| CAPABILITY / SOPHISTICATION |
| ^ |
| | |
| HIGH| [NATION-STATES / APTs] |
| | (Geopolitical, Extreme Funding, Zero-Day)|
| | |
| | [CYBERCRIMINAL SYNDICATES] |
| | (Financial Gain, Ransomware, Extortion) |
| | |
| | [MALICIOUS INSIDERS] [COMPETITORS] |
| | (Sabotage, Data Theft) (Corporate Espionage) |
| | |
| LOW| [SCRIPT KIDDIES / OPPORTUNISTIC] [HACKTIVISTS] |
| | (Automated Tools, Low Skill) (Ideology, Defacement, DoS) |
| +--------------------------------------------------------------------> |
| OPPORTUNISTIC / CHAOTIC TARGETED / STRATEGIC |
| MOTIVATION INTENT |
+-----------------------------------------------------------------------------+
Detailed Threat Actor Profiles:
| Threat Actor Category | Primary Motivation | Resources & Funding | Technical Sophistication | Typical Tactics & Objectives |
|---|---|---|---|---|
| Nation-State / APTs (Advanced Persistent Threats) | Geopolitical influence, espionage, intellectual property theft, critical infrastructure disruption. | Virtually unlimited (state-backed military/intelligence budgets). | Extreme: Custom zero-day exploits, multi-year stealth dwell time, kernel-level rootkits, supply chain poisoning. | |
| Cybercriminal Syndicates (Organized Crime) | Financial extortion, illicit monetizable data theft, business disruption. | Substantial (funded by ransom revenues and dark web monetization). | High: Ransomware-as-a-Service (RaaS), double/triple extortion, banking Trojans, Business Email Compromise (BEC). | |
| Malicious Insiders | Revenge, financial payoff, corporate espionage, ideological grievance. | Varies (limited external funding, but possesses authorized internal access). | Moderate to High: Abuse of legitimate administrative credentials, logic bombs, bulk exfiltration via removable media/cloud storage. | |
| Inadvertent Insiders (Human Error) | None (unintentional, negligence, fatigue, lack of training). | Internal employee / contractor. | N/A: Accidental cloud bucket misconfiguration, falling for phishing scams, losing unencrypted laptops. | |
| Hacktivists | Political, social, religious, or environmental activism and protest. | Low to Moderate (crowdfunded or volunteer communities). | Low to Moderate: Distributed Denial of Service (DDoS), website defacement, public doxxing, dumping leaked internal emails. | |
| Competitors (Industrial Espionage) | Commercial advantage, market share acquisition, intellectual property theft. | Moderate to High (corporate operational budgets). | Moderate to High: Soliciting disgruntled employees, proprietary blueprint theft, bidding strategy exfiltration. | |
| Script Kiddies / Opportunistic Attackers | Ego, notoriety, thrill-seeking, unstructured financial opportunism. | Minimal (individual actors). | Low: Running automated, off-the-shelf vulnerability scanners and public exploit scripts against random IP ranges. |
[!CAUTION] The Dual Threat of the Insider: ISACA heavily emphasizes that insiders represent an existential risk because they bypass external perimeter defenses. However, CRISC candidates must distinguish between the Malicious Insider (who acts with hostile intent requiring detective auditing, least privilege, and background checks) and the Inadvertent Insider (who creates catastrophic exposure through operational mistakes, requiring automated guardrails, DLP, and continuous security awareness training).
2. Attack Vectors & Threat Channels
An attack vector is the specific path, method, or mechanism by which a threat actor gains unauthorized access to a network, server, endpoint, or application to deliver a malicious payload or execute an unauthorized action.
+-----------------------------------------------------------------------------+
| COMMON ENTERPRISE ATTACK VECTORS |
| |
| +---------------------------------------------------------------------+ |
| | 1. SOCIAL ENGINEERING & HUMAN VECTORS | |
| | Spear-phishing, smishing, vishing, Business Email Compromise | |
| +---------------------------------------------------------------------+ |
| | 2. VULNERABILITY EXPLOITATION | |
| | Unpatched edge devices, zero-day CVEs, legacy protocols (RDP) | |
| +---------------------------------------------------------------------+ |
| | 3. IDENTITY & CREDENTIAL THEFT | |
| | Credential stuffing, password spraying, session token hijacking | |
| +---------------------------------------------------------------------+ |
| | 4. DIGITAL SUPPLY CHAIN & THIRD PARTIES | |
| | Compromised vendor software updates, vulnerable open-source libs | |
| +---------------------------------------------------------------------+ |
| | 5. CLOUD & ARCHITECTURAL MISCONFIGURATIONS | |
| | Exposed S3 buckets, overly permissive IAM roles, default secrets | |
| +---------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------+
Key Attack Vector Breakdown:
- Phishing and Social Engineering: Weaponized emails, deceptive landing pages, and voice impersonation designed to trick employees into revealing credentials or executing malware.
- Compromised Credentials & Identity Attacks: Leveraging credentials stolen in third-party data breaches or harvested via infostealers to execute credential stuffing or password spraying against single-factor corporate portals.
- Unpatched Software & Zero-Day Exploits: Targeting known vulnerabilities (CVEs) on internet-facing perimeter devices (VPN gateways, firewalls, web applications) where patches have not been applied.
- Supply Chain & Third-Party Vector: Infiltrating an enterprise indirectly by compromising a trusted third-party vendor, software supply chain dependency, or managed service provider (MSP).
- Cloud Infrastructure Misconfiguration: Inadequate access control policies that inadvertently expose database storage buckets, Kubernetes control planes, or API keys to the public internet.
3. The Lockheed Martin Cyber Kill Chain
Developed by Lockheed Martin in 2011 as part of the Intelligence-Driven Defense model, the Cyber Kill Chain breaks down a targeted cyberattack into a linear sequence of seven distinct operational phases. Interrupting the attacker at any single phase halts the entire progression of the intrusion.
+-----------------------------------------------------------------------------+
| LOCKHEED MARTIN CYBER KILL CHAIN (7 PHASES) |
| |
| [1. RECONNAISSANCE] ---> Harvesting email addresses, scanning open ports |
| | |
| v |
| [2. WEAPONIZATION] ---> Pairing backdoor malware with exploit payload |
| | |
| v |
| [3. DELIVERY] ---> Transmitting payload via spear-phishing / web |
| | |
| v |
| [4. EXPLOITATION] ---> Triggering exploit code on target vulnerability |
| | |
| v |
| [5. INSTALLATION] ---> Establishing persistent backdoor / web shell |
| | |
| v |
| [6. COMMAND & CTRL] ---> Opening encrypted beaconing channel to C2 server |
| | |
| v |
| [7. ACTIONS ON OBJ] ---> Exfiltrating customer data, detonating ransomware|
+-----------------------------------------------------------------------------+
Kill Chain Stages and Defensive Countermeasures:
| Phase | Attacker Action | Defensive Risk Mitigation Control |
|---|---|---|
| 1. Reconnaissance | Gathering open-source intelligence (OSINT), analyzing DNS records, discovering network ranges. | Web analytics monitoring, threat intelligence subscription, minimizing public perimeter metadata. |
| 2. Weaponization | Embedding malicious exploit code into innocent-looking file formats (e.g., PDF, DOCX). | Threat intelligence analysis, sandboxing, endpoint detection signature engineering. |
| 3. Delivery | Sending weaponized emails, hosting drive-by download sites, plugging in rogue USBs. | Email security gateways, DMARC/DKIM/SPF enforcement, user phishing awareness training. |
| 4. Exploitation | Exploiting a buffer overflow or software flaw to execute arbitrary code on the target. | Host-based Intrusion Prevention (HIPS), endpoint memory protection, rapid patch management baselines. |
| 5. Installation | Installing rootkits, scheduled tasks, or registry run keys to maintain persistence across reboots. | Endpoint Detection and Response (EDR), application whitelisting, Privileged Access Management (PAM). |
| 6. Command & Control (C2) | Establishing a bidirectional covert communications channel back to the attacker's server. | DNS sinkholing, outbound egress proxy filtering, network traffic behavioral anomaly detection. |
| 7. Actions on Objectives | Stealing sensitive database records, modifying financial logs, encrypting systems for ransom. | Data Loss Prevention (DLP), database activity monitoring, immutable air-gapped backups, disaster recovery. |
4. The MITRE ATT&CK Framework
While the Cyber Kill Chain models attacks as a high-level linear sequence, the MITRE ATT&CK (Adversary Tactics, Techniques, and Common Knowledge) framework provides a non-linear, granular, and empirical matrix of adversary behaviors observed in real-world attacks.
+-----------------------------------------------------------------------------+
| MITRE ATT&CK ENTERPRISE MATRIX |
| |
| TACTICS (The "Why" - Adversary's Tactical Goal) |
| +----+----+----+----+----+----+----+----+----+----+----+----+----+----+ |
| | TA | TA | TA | TA | TA | TA | TA | TA | TA | TA | TA | TA | TA | TA | |
| | 01 | 02 | 03 | 04 | 05 | 06 | 07 | 08 | 09 | 10 | 11 | 12 | 13 | 14 | |
| +----+----+----+----+----+----+----+----+----+----+----+----+----+----+ |
| | | | | | | | | | | | | | | |
| v v v v v v v v v v v v v v |
| TECHNIQUES & SUB-TECHNIQUES (The "How" - Specific Actions & Mechanisms) |
| - e.g., T1566 (Phishing), T1059 (Command & Scripting Interpreter), |
| T1078 (Valid Accounts), T1486 (Data Encrypted for Impact) |
+-----------------------------------------------------------------------------+
The 14 Enterprise Tactics:
- Reconnaissance: Gathering information to plan future adversary operations.
- Resource Development: Establishing infrastructure (domains, botnets, server accounts) to support operations.
- Initial Access: Vectors used to gain an initial foothold (phishing, public exploit, supply chain).
- Execution: Running adversary-controlled malicious code on target systems (PowerShell, scripts).
- Persistence: Maintaining access across restarts, credential changes, and interruptions.
- Privilege Escalation: Gaining higher-level permissions (e.g., SYSTEM, root, domain admin).
- Defense Evasion: Avoiding detection by disabling antivirus, clearing logs, or obfuscating code.
- Credential Access: Stealing user account credentials, hashes, and session tokens (Mimikatz, Kerberoasting).
- Discovery: Observing the internal network environment and locating high-value targets.
- Lateral Movement: Moving through the network environment from system to system.
- Collection: Gathering sensitive data (documents, emails, databases) targeted for theft.
- Command and Control: Communicating with compromised systems from external infrastructure.
- Exfiltration: Packaging and transmitting stolen data out of the enterprise network.
- Impact: Disrupting business availability, manipulating data integrity, or destroying infrastructure (ransomware).
[!NOTE] How CRISC Practitioners Leverage MITRE ATT&CK: Risk practitioners use MITRE ATT&CK to conduct Threat-Informed Defense Gap Analyses. By mapping an organization's existing controls against ATT&CK techniques, risk teams identify blind spots (e.g., discovering that while the firm has strong Initial Access controls, it has zero detection capability for Lateral Movement or Credential Access).
An IT risk assessor is analyzing threat actor profiles to determine the most critical risk exposures facing a global financial technology enterprise. Which threat actor category is characterized by extreme funding, custom zero-day exploits, long-term stealth dwell times, and geopolitical objectives rather than immediate financial extortion?
A healthcare system discovers that an employee accidentally emailed an unencrypted spreadsheet containing 50,000 patient records to an external marketing distribution list. How should this threat event be categorized during the subsequent IT risk assessment?
An enterprise security operations center (SOC) deploys automated network egress filtering and DNS sinkholing that detects and blocks unauthorized outbound beaconing from internal endpoints to malicious external servers. In the context of the Lockheed Martin Cyber Kill Chain, which phase of the adversary's attack progression has the organization successfully disrupted?
What is the PRIMARY value of utilizing the MITRE ATT&CK framework during enterprise threat modeling and risk assessment?