Threat Actors, Motivations & the Attack Surface¶

To defend effectively, you must understand who is attacking and why.

Categories of Threat Actors¶

Advanced Persistent Threats (APTs)¶

APTs are well-funded, patient, and stealthy. They establish long-term footholds, move laterally, and exfiltrate data slowly to avoid detection. Defending against them requires detection and response, not just prevention.

Understanding Attack Surface¶

Your attack surface is the sum of all points where an attacker could try to enter or extract data:

• Digital: open ports, web apps, APIs, cloud buckets, exposed credentials.
• Physical: unlocked server rooms, USB ports, lost laptops.
• Human: employees susceptible to phishing or pretexting (social engineering).

Reducing Attack Surface¶

1. 1.Disable unused services and close unused ports.
2. 2.Patch known vulnerabilities promptly.
3. 3.Segment networks so a breach in one zone doesn't reach another.
4. 4.Remove default accounts and credentials.
5. 5.Train people — the human layer is often the easiest target.

The Attacker's Playbook (Cyber Kill Chain)¶

A classic model of how intrusions unfold:

1. 1.Reconnaissance — gather info on the target.
2. 2.Weaponization — build the malicious payload.
3. 3.Delivery — email, USB, watering-hole site.
4. 4.Exploitation — trigger the vulnerability.
5. 5.Installation — establish persistence.
6. 6.Command & Control (C2) — remote control channel.
7. 7.Actions on Objectives — steal, encrypt, destroy.

Breaking any link in the chain stops the attack. As defenders, our job is to create detection and prevention opportunities at every stage.