Threat actor

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes a threat actor?

A A person or group that carries out an attack

B A weakness in a system that could be attacked

2. A group breaks into a retailer's database to steal card numbers and sell them. Which threat actor is this?

A Hacktivists

B Cybercriminals

3. A group defaces a mining company's website to protest its environmental record. Which threat actor is this?

A Hacktivists

B Nation-state group

4. A threat actor's main motive is described as 'a cause or belief'. Which actor fits?

A Hacktivist

B Cybercriminal

5. An employee angry about being overlooked for promotion copies customer files before resigning. Which threat actor is this?

A Nation-state group

B Insider

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1threat actor		AA hacktivist is driven by a political or social cause, not by profit. Money is the typical motive of a cybercriminal.
2hacktivist		Bactor = "cybercriminal" motive = "money"
3A cybercriminal is a threat actor whose motive is financial gain, such as selling stolen data or demanding a ransom		CA person or group that carries out a cyber attack, described by their motive and skill level
4An insider is a threat actor who already has legitimate access, and may act from a grievance against their employer		DA threat actor who attacks systems to support a political or social cause, for example by defacing a website
5actor = "nation-state" motive = "school prank" skill = "low"		ENation-state groups are well funded and highly skilled, and they usually attack for spying or political advantage, not for pranks and not with low skill.
6actor = "hacktivist" motive = "money"		Factor = "insider" motive = "grievance"

Definitions

threat actor

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF actor = _______ THEN motive ← GRIEVANCE END IF

actor ← CYBERCRIMINAL motive ← _____

actor ← NATIONSTATE skill ← ____

actor ← __________ motive ← CAUSE

actors ← [CYBERCRIMINAL, INSIDER] FOR EACH a __ actors OUTPUT a

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A actor = "cybercriminal"

B skill = "high"

C motive = "cause"

D print(actor, motive, skill)

Question 2

A motive = "money"

B actor = "hacktivist"

C print(actor, motive)

Question 3

A actor = "insider"

B access = False

C motive = "grievance"

D print(actor, motive)

Question 4

A actor = "nation-state

B motive = "spying"

C skill = "high"

D print(actor, skill)

Question 5

A actors = []

B actors.append("insider")

C actors.append("hacktivist")

D actors.add("nation-state")

Answer Key

Threat actor

Section A: Quick Questions

A — A person or group that carries out an attack

B — Cybercriminals

A — Hacktivists

A — Hacktivist

B — Insider

Section B: Match the Pairs

threat actor → A person or group that carries out a cyber attack, described by their motive and skill level

hacktivist → A threat actor who attacks systems to support a political or social cause, for example by defacing a website

A cybercriminal is a threat actor whose motive is financial gain, such as selling stolen data or demanding a ransom → actor = "cybercriminal" motive = "money"

An insider is a threat actor who already has legitimate access, and may act from a grievance against their employer → actor = "insider" motive = "grievance"

actor = "nation-state" motive = "school prank" skill = "low" → Nation-state groups are well funded and highly skilled, and they usually attack for spying or political advantage, not for pranks and not with low skill.

actor = "hacktivist" motive = "money" → A hacktivist is driven by a political or social cause, not by profit. Money is the typical motive of a cybercriminal.

Section C: Definitions

threat actor — A person or group that carries out a cyber attack, described by their motive (money, cause, grievance, spying) and skill, such as cybercriminals, hacktivists, insiders and nation-state groups.

Section D: Fill in the Blanks

IF actor = INSIDER THEN
    motive ← GRIEVANCE
END IF

actor ← CYBERCRIMINAL
motive ← MONEY

actor ← NATIONSTATE
skill ← HIGH

actor ← HACKTIVIST
motive ← CAUSE

actors ← [CYBERCRIMINAL, INSIDER]
FOR EACH a IN actors
    OUTPUT a

Section E: Spot the Error

C — Cybercriminals are motivated by money, not a cause. A cause is the motive of hacktivists. The line should be motive = "money".

A — Hacktivists attack to support a political or social cause. Money is the cybercriminal motive. The line should be motive = "cause".

B — An insider already has legitimate access to the organisation's systems, which is why insiders are dangerous. It should be access = True.

A — The string is missing its closing quote, which is a syntax error. It should be actor = "nation-state".

D — Python lists have no add() method. Items are added to a list with append(), so it should be actors.append("nation-state").