Understanding Threat Actors: MA Threat Modeling
Many entities could act as potential threats when you execute your online missions. Depending on the threat actor’s attitudes and capabilities, the severity of these threats can vary. By understanding the nature of the threat you might face, you will be better equipped to perform preventative measures or intervene in the case of an attack on your organization.
Watch the full video here.
What is a threat actor?
Threat actors include anyone with the ability to observe your activity as you operate online. Once observed, your activity could potentially reveal identifying information or expose your organization’s aliases.
There are three key dimensions concerning threat actors that you need to consider:
- Interest level
- Skill level
- Relationship
The actual impact of a threat actor depends greatly on how they correspond to each of these different dimensions.
Interest: Inquisitive vs. Indifferent
Interest captures the extent to which the threat actor cares about your operational activities. For instance, does your online activity matter to the actor’s business or personal interests? Or is your activity irrelevant to their goals?
A threat actor could be inquisitive or indifferent: they may be curious about some activities and maintain a superficial curiosity about others. One threat actor might be intrigued by your numerous IP addresses, but fail to notice whether or not you sound like a Netherlands native when speaking Dutch in an online forum.
Levels of interest can also exist on an institutional or individual basis. While an entire organization might feel indifferent towards your online operations, an employee within that organization may attempt to block your operational efforts.
Skill: Rudimentary vs. Wizard
Under the skill dimension, we can examine what a threat actor could accomplish based on the degree of their technical expertise. Technical acumen includes the tools and techniques available to the actors, as well as their ability to obtain certain kinds of information.
Those with rudimentary skillsets might simply know how to capture log files or examine firewall information. On the other hand, wizard-level skills entail techniques like deep packet inspection, SSL decryption, and comprehensive linguistic analysis.
Certain organizations may have the skills necessary to accomplish high-level analysis but remain uninterested in this kind of activity. However, threat actors, such as terrorists, might want to severely damage your operations, yet lack the required technical expertise.
Relationship: Friendly vs. Hostile
To analyze threat actors, we must also examine the relationship between you and the potentially threatening entity. Threat actors could be annoyed enterprises, friendly vendors, indifferent carriers, or determined enemies.
A threat actor’s attitude towards your organization can affect how thoroughly they search for your online activities and any actions they choose to take in response to those findings. An entity that considers you a hostile enemy may launch counterattacks against your team. Friendly entities might simply block access to their information or ignore you entirely.
Using this framework, we can look at a few different kinds of entities as examples of potential threat actors:
| Entity | Interest | Skill | Relationship |
| Social media company | Inquisitive: actively looking to eliminate fake accounts | Wizard: employ huge teams of developers and tools to investigate suspicious activity | Friendly: feel frustrated by fake accounts, but are unlikely to seek retribution |
| Hosting company for CONUS Geosite | Indifferent: won’t analyze your activity as long as the traffic is not criminal | Wizard: use extensive resources and skilled teams to uphold integrity of networks | Friendly: benevolent to customers as long as there is no illegal activity |
| Terrorist recruiter | Paranoid: desperate to know if they’re being watched or thwarted | Rudimentary: lack access to raw data and extensive tech expertise | Hostile: overtly your enemy |
| Opposition Nation State Security Service | Inquisitive: will constantly search for activity to analyze or shut down | Wizard: utilize a variety of resources to examine activity | Hostile: driven to eliminate perceived threats, including you |
Understanding the disposition and capabilities of possible threat actors is an essential part of threat modeling for managed attribution. As you consider this threat model, think about where a potentially dangerous entity might appear along the three profile dimensions. You can then use that information to prioritize and optimize threat mitigation efforts, focusing on the aspects presenting the greatest risk to your mission.
