Week 06 Quiz

Test your understanding of the weekly concepts.

Format: 10 multiple-choice questions. Passing score: 70%. Time: Untimed.

Take Quiz
CSY101 Week 06 Beginner

Explore attacker behavior, reconnaissance, and defensive analysis. Complete these labs before moving to reading resources.

Cybersecurity Essentials

Track your progress through this week's content

Week Introduction

💡 Mental Model

Security is adversarial — there are people actively trying to break what you build. Understanding attacker psychology, capabilities, and constraints is as important as understanding technology.

This week explores the human dimension of cybersecurity: who attacks systems, why they do it, what defenders are up against, and why defense is fundamentally asymmetric (attackers only need to succeed once; defenders must succeed continuously).

Learning Outcomes (Week 6 Focus)

By the end of this week, you should be able to:

  • LO3 - Threat Landscape: Categorize threat actors by capability, motivation, and typical attack patterns
  • LO4 - Risk Reasoning: Explain why attacker motivation determines attack style and target selection
  • LO8 - Integration: Connect technical vulnerabilities to attacker incentives (why certain flaws get exploited)

Lesson 6.1 · Threat Actor Taxonomy: Who Attacks and Why

Core insight: "The attacker" is not one person or group. Threat actors range from opportunistic script kiddies to sophisticated nation-states. Understanding who you're defending against shapes what controls you implement.

Threat actor categories (by motivation and capability):

  • 1. Script Kiddies / Opportunistic Attackers
    Motivation: Fame, curiosity, boredom
    Capability: Low — use pre-built tools, exploit known vulnerabilities
    Target selection: Indiscriminate scanning for low-hanging fruit
    Attack style: Automated, noisy, easily detected
    Example: Running Shodan searches for exposed databases, using Metasploit against unpatched systems
  • 2. Cybercriminals (Organized Crime)
    Motivation: Financial gain (primary driver)
    Capability: Medium to High — sophisticated tooling, division of labor (ransomware-as-a-service)
    Target selection: ROI-driven — profitable targets (payment systems, customer databases)
    Attack style: Efficient, scalable, business-like operations
    Example: Ransomware gangs (Conti, LockBit), credit card fraud rings, business email compromise (BEC)
  • 3. Hacktivists
    Motivation: Political/social ideology, protest, awareness
    Capability: Low to Medium — varies widely (Anonymous vs sophisticated groups)
    Target selection: Symbolic — organizations representing opposed values
    Attack style: Public, disruptive (DDoS, defacement, data leaks for exposure)
    Example: Anonymous attacks on government sites, environmental activist breaches of energy companies
  • 4. Insiders (Malicious or Negligent)
    Motivation: Financial (sell data), revenge (disgruntled employee), negligence (accidental)
    Capability: High — authorized access, knows systems intimately
    Target selection: Opportunity-based — access determines targets
    Attack style: Quiet, leverages legitimate credentials, hardest to detect
    Example: Edward Snowden (ideological), Tesla employee sabotage, accidental S3 bucket exposure
  • 5. Nation-State / APT (Advanced Persistent Threat)
    Motivation: Espionage, strategic advantage, critical infrastructure disruption
    Capability: Very High — zero-days, custom malware, unlimited resources
    Target selection: Strategic — government, defense, critical infrastructure, intellectual property
    Attack style: Stealthy, patient (persistent for months/years), sophisticated evasion
    Example: APT28 (Russia), APT29 (Cozy Bear), Lazarus Group (North Korea), Chinese APTs (IP theft)

Reality check on frequency:

Despite media focus on sophisticated attacks, most breaches involve:

  • Financially-motivated cybercriminals (70%+)
  • Exploiting known, unpatched vulnerabilities (not zero-days)
  • Phishing / credential theft (easiest path in)
  • Opportunistic targeting (automated scanning finds you)

Defender implication: Design defenses for the threats you'll actually face (opportunistic criminals), not just the ones that make headlines (nation-states).

Lesson 6.2 · Why Attackers Win: The Path of Least Resistance

Core principle: Attackers don't need to be brilliant — they need to be more patient and thorough than defenders. They look for the weakest link, not the strongest challenge.

Why most attacks succeed (ranked by frequency):

  1. Unpatched known vulnerabilities (35-40% of breaches)
    Attackers scan for CVEs with public exploits, find unpatched systems
    Example: Equifax (Apache Struts), WannaCry (EternalBlue)
    Defender failure: Patch management breakdown
  2. Stolen or weak credentials (30-35% of breaches)
    Phishing, password reuse, credential stuffing, default passwords
    Example: Target breach (HVAC vendor credentials), Colonial Pipeline (compromised VPN password)
    Defender failure: Weak authentication, no MFA
  3. Misconfigured systems (15-20% of breaches)
    Open S3 buckets, exposed databases, overly permissive firewall rules
    Example: Capital One (misconfigured AWS WAF), MongoDB instances exposed on internet
    Defender failure: Configuration management, default-deny policies
  4. Social engineering (10-15% of initial access)
    Manipulating humans to bypass technical controls
    Example: Twitter Bitcoin scam (phone spear-phishing of employees), Uber breach (contractor compromise)
    Defender failure: Security awareness, verification procedures

Key insight: Sophistication is rare

Zero-day exploits and custom malware make headlines, but represent less than 5% of attacks. Most attackers use:

The attack kill chain (simplified):

  1. Reconnaissance: Scan for vulnerable systems (automated, low-effort)
  2. Initial access: Exploit vulnerability or stolen credential (easiest weakness)
  3. Establish foothold: Install backdoor, create persistence
  4. Lateral movement: Move from initial system to valuable targets
  5. Achieve objective: Steal data, deploy ransomware, disrupt operations

Defender reality check:

Attackers succeed not because defenders lack sophisticated tools, but because:

Lesson 6.3 · The Defender's Dilemma: Asymmetric Warfare

Fundamental asymmetry: Attackers only need to find one weakness. Defenders must protect against all possible attacks, all the time, while keeping systems functional for legitimate users.

Constraints defenders face (that attackers don't):

Attacker advantages:

Why defense is still possible:

Despite asymmetry, defenders can succeed by:

Mindset shift: From "prevent all attacks" to "make attacks not worth the effort and recover quickly when they succeed."

Lesson 6.4 · Motivation Determines Attack Pattern

Core insight: If you understand why an attacker wants something, you can predict how they'll try to get it. Motivation drives tactics, which informs defensive priorities.

Motivation → Attack pattern mapping:

Why this matters for threat modeling:

When assessing risk, ask:

Example: Healthcare organization threat model

Lesson 6.5 · Defense as Resilience, Not Perfection

Mindset shift: The goal is not to prevent every attack (impossible). The goal is to make attacks costly enough that most attackers choose easier targets, and to recover quickly when attacks succeed.

Resilience framework (NIST Cybersecurity Framework):

  1. Identify: Know what you're protecting (assets, threats, vulnerabilities)
    Why it matters: Can't defend what you don't know exists
  2. Protect: Implement safeguards (access control, encryption, patching)
    Why it matters: Raise attacker cost, reduce likelihood
  3. Detect: Monitor for security events (SIEM, IDS, logging)
    Why it matters: Assume breach, find attackers before damage escalates
  4. Respond: Contain and eradicate threats (incident response plan)
    Why it matters: Minimize dwell time, limit blast radius
  5. Recover: Restore capabilities (backups, business continuity)
    Why it matters: Return to operations quickly, learn from incidents

Mature security programs focus on:

Why "assume breach" is realistic:

Therefore: Design systems expecting compromise. Segment networks. Log everything. Test recovery. Build organizational muscle memory through drills.

Self-Check Questions (Test Your Understanding)

Answer these in your own words (2-3 sentences each):

  1. What is the difference between a script kiddie and a nation-state APT? How do their attack styles differ?
  2. Explain the defender's dilemma. Why do attackers have inherent advantages?
  3. How does attacker motivation (financial vs espionage vs ideology) shape their tactics? Give one example.
  4. Why is "assume breach" a more realistic security posture than "prevent all attacks"?
  5. What does it mean to build security resilience? Connect to the NIST framework (Identify, Protect, Detect, Respond, Recover).

Lab 6 · Threat Actor Analysis and Defensive Prioritization

Time estimate: 40-50 minutes

Objective: Analyze a system from multiple threat actor perspectives. You will identify what different attackers want, how they'd attack, and how to prioritize defenses based on realistic threat assessment.

Step 1: Choose Your System (5 minutes)

Select one system (you may reuse from previous labs or choose new):

Why it matters: Different threat actors target the same system for different reasons.

Step 2: Identify High-Value Assets (10 minutes)

List at least 3 assets attackers might want:

Example for e-commerce platform:

Step 3: Map Threat Actors to Assets (15 minutes)

For each asset, identify which threat actor type would target it and how:

Asset Threat Actor Motivation Likely Attack Method
Payment card data Cybercriminals Financial (sell data) SQL injection, web app exploit, phishing admins
Customer credentials Opportunistic attackers Credential stuffing other sites Database breach, password reuse exploitation
Proprietary algorithms Competitors / APTs Competitive advantage Insider recruitment, spear-phishing engineers

Create your own table matching assets to realistic threat actors.

Step 4: Assess Likelihood by Threat Actor (10 minutes)

For each threat actor, rate the likelihood they would target your system:

Example likelihood assessment for e-commerce:

Step 5: Prioritize Defenses Based on Threat Assessment (10 minutes)

Based on your threat actor analysis, prioritize defensive investments:

Example prioritization:

Step 6: Synthesis (5 minutes)

Write a short paragraph (3-5 sentences) answering:

"How does understanding attacker motivation change your defensive strategy? Why would defending against 'all threats equally' be wasteful?"

Example answer:

Understanding attacker motivation allows prioritization based on realistic threats rather than theoretical possibilities. For our e-commerce system, cybercriminals are the primary threat (high likelihood, financial motivation, proven attack patterns), so investments in web application security and fraud detection deliver the most risk reduction per dollar. Defending equally against all threats would mean spending heavily on APT defenses we'll never face, while under-investing in the credential theft and payment fraud that actually targets e-commerce. Effective security matches defenses to adversaries you'll realistically encounter.

Success Criteria (What "Good" Looks Like)

Your lab is successful if you:

Extension (For Advanced Students)

If you finish early, explore these questions:

🎯 Hands-On Labs (Free & Essential)

Explore attacker behavior, reconnaissance, and defensive analysis. Complete these labs before moving to reading resources.

🎮 TryHackMe: OSINT Fundamentals

What you'll do: Use open-source intelligence techniques to gather information about targets, assets, and exposure.
Why it matters: Most attacks start with reconnaissance. Understanding OSINT helps you think like attackers and reduce exposure.
Time estimate: 1-1.5 hours

Start TryHackMe OSINT Fundamentals →

🎮 TryHackMe: Phishing Fundamentals

What you'll do: Analyze phishing techniques, pretexts, and social engineering tactics used by real attackers.
Why it matters: Human-focused attacks remain the most common entry point. Knowing how they work improves defense.
Time estimate: 1-1.5 hours

Start TryHackMe Phishing →

🏁 PicoCTF Practice: Forensics (Beginner)

What you'll do: Investigate basic digital artifacts to understand how defenders detect and analyze attacks.
Why it matters: Defender perspective balances attacker mindset and shows how attacks are traced.
Time estimate: 1-2 hours

Start PicoCTF Forensics →

💡 Lab Tip: For each attacker type, write one likely target and one likely technique. This makes threat actor analysis practical.

Resources (Free + Authoritative)

Work through these in order. Focus on attacker behavior and defensive mindset.

📘 MITRE ATT&CK Framework

What to explore: Browse the "Tactics" view (Reconnaissance → Impact). Pick 2-3 tactics and read their techniques.
Why it matters: Real-world attacker playbook based on observed behaviors. Used globally for threat modeling and detection.
Time estimate: 25 minutes (don't try to memorize — understand the structure)

Open Resource

🎥 Computerphile - The Psychology of Hacking (Video)

What to watch: Full video on attacker mindset and social engineering.
Why it matters: Technical controls fail when humans are manipulated. Understanding psychology is essential.
Time estimate: 15 minutes

Open Resource

📘 Verizon Data Breach Investigations Report (DBIR) - Executive Summary

What to read: Latest year's Executive Summary (first 10 pages).
Why it matters: Annual analysis of real breaches — shows what actually happens (not theoretical attacks). Data-driven threat landscape.
Time estimate: 20 minutes

Open Resource

📘 NIST Cybersecurity Framework - Overview

What to read: Review the five functions (Identify, Protect, Detect, Respond, Recover) with defender mindset.
Why it matters: Framework for resilience — assumes breach will occur, focuses on minimizing damage and recovery.
Time estimate: 15 minutes

Open Resource

Tip: Completion and XP persist via localStorage. If progress doesn't update immediately, refresh once.

Weekly Reflection Prompt

Aligned to LO3 (Threat Landscape) and LO4 (Risk Reasoning)

Write 200-300 words answering this prompt:

Explain why understanding attacker motivation is essential for effective defense. Use your Lab 6 threat actor analysis as an example.

In your answer, include:

What good looks like: You demonstrate understanding that security is adversarial — real people with specific motivations make strategic choices about what to attack and how. You show that effective defense requires matching controls to realistic threats, not defending against everything equally. You explain why resilience (detect + respond + recover) complements prevention.