Actor types

Following mind-map shows actor types

Script Kiddie

Unskilled individuals who use programs developed by others to attack computer systems Attributes :

Attributes

• Internal/External: External to their target
• Level of Sophistication: Typically have limited resources. 
• Resources/Funding: The amount, sophistication, and extent of their attacks is constrained. Intent/Motivation: Motivated by prestige.

Hacktivist

Individuals or members of (typically small) groups The term hacktivist is often applied to a range of different activities:

• Hacking for social change
• Hacking to promote political agendas.
• Cyberterrorism

Attributes

• Internal/External: Hacktivists could be internal or external to their target, but are typically external.
• Level of Sophistication: Hacktivists widely vary in their skills.
• Resources/Funding: Hacktivists vary in resources and funding.
• Intent/Motivation: Motivated by anger, justice, or sometimes a political or social cause and Seek to embarrass or deface their target

Organized Crime Groups

Actors that send spam and phishing emails, ransomware, and spyware, and generally do not have targets; instead seek as many targets as possible.

Attributes

• Internal/External: External to their target. May target channels internal to an organization, such as company email.
• Level of Sophistication: Can be highly sophisticated
• Resources/Funding: Often well-funded
• Intent/Motivation: Motivated by money

Advanced Persistent Threat (APT)

Nation-state operations that slowly gather information, use covert methods, and are rarely discovered. 

Attributes

• Internal/External: May be both internal and external to their attack target.
• Level of Sophistication: Rarely use flashy tactics. Attack surfaces used by APTs are well-tested and rarely discovered.
• Resources/Funding: An APT entity has the highest resources, including open-source intelligence (OSINT) and covert intelligence sources.
• Intent/Motivation: Motivated by knowledge (information) and how can it be used

Insiders

• Uneducated Trusted Insiders – This individual is likely to be taken advantage of by social engineering techniques, or unwittingly initiate a backdoor or privilege escalation attack. The success of such an attack depends on your security policy and employee training.
• Educated Trusted Insiders
  • System Administrators
  • CEOs
  • Other IT Personnel
  • HR (Access to Personnel Information)
• Educated Untrusted Insiders
  • Disgruntled Employees
  • An employee with a history of mental illness or disciplinary problems
  • Personal issues
    • Triggered by a stressful event:
    • Passed over for promotion
    • Unfavorable performance review

Risk Mitigation

These controls can protect from insider attacks:

• Implement Job Rotations
• Separation of Duties
• Mandatory Vacations for Critical Staff
• Perform Background Checks Onboarding and Offboarding
• Use the Principle of Least Privilege
• Behavioral Indicators (Source: FBI) of a Potential Insider Attack:
  • Taking work materials home Odd interest in issues outside his/her responsibility
  • Duplication of office material without explanation
  • Strange patterns of network activity
  • Using personal hardware and software in the office
  • Working odd hours
  • Unexplained foreign contacts/trips
  • Unexplained affluence
• In all cases, these two strategies are key:
  • Proper employee education (training)
  • Identifying key assets and points of interest to an attacker