2.1 Threat actors and motivations explained

Objective 2.1 asks you to recognise an attacker from a description of their behaviour. Questions rarely name the actor; they describe resources, skill, persistence and goals, and you pick the label that fits best.

The exam's actor types are worth learning as a set. A nation-state actor is backed by a government, has large budgets and patient, skilled teams, and is the usual source of advanced persistent threats: long, quiet intrusions with custom tools and goals such as espionage or disruption of another country. An unskilled attacker uses tools and scripts written by others without understanding them deeply; the damage can still be real, but the methods are noisy and generic. A hacktivist attacks to make a political or social point, often through defacement, leaks or denial of service, and wants publicity more than money. Organized crime is run like a business and wants money: ransomware, fraud and data theft for sale. An insider threat already has legitimate access, which makes them hard to spot; they may act out of revenge, financial pressure or carelessness. Shadow IT is staff using unapproved systems or services, usually with no malicious intent, which still creates risk because security can't protect what it doesn't know about.

Each actor can be compared on a few attributes. Is the actor internal or external? What level of resources and funding does it have? How sophisticated is it? The exam expects you to place, for example, a nation-state at the top of resources and sophistication, and an unskilled attacker near the bottom.

Motivation is the other half of the objective. The listed motivations include data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical or political beliefs, ethical reasons, revenge, disruption or chaos, and war. A good answer matches the motive to what the attacker actually did. Stealing data and threatening to publish it without encrypting anything is blackmail. Deleting files after being passed over for promotion is revenge. Leaking documents to embarrass a government is political.

Knowing the actor helps choose defences. Insider risk calls for least privilege, monitoring and good offboarding. Shadow IT calls for discovery tools and an easy approved alternative. Nation-state risk calls for strong detection, because prevention alone rarely stops a patient, well-funded team.