Threat actors and motivations in Cybersecurity - Mini Project: Build & Apply

Understanding Threat Actors and Their Motivations

📖 Scenario: You are part of a cybersecurity awareness team at a company. Your task is to create a simple reference guide that lists common types of threat actors and their motivations. This guide will help your colleagues understand who might attack computer systems and why.

🎯 Goal: Build a clear list of threat actors with their motivations using a dictionary data structure. This will serve as a quick reference for your team.

📋 What You'll Learn

Create a dictionary named threat_actors with exact entries for actor types and their motivations

Add a variable named focus_motivation to specify a motivation to filter by

Use a dictionary comprehension to create a new dictionary filtered_actors containing only actors with the specified motivation

Add a final statement that assigns the count of filtered actors to a variable named count_filtered

💡 Why This Matters

🌍 Real World

Understanding different types of threat actors and their motivations helps cybersecurity teams prepare defenses and educate employees about potential risks.

💼 Career

Cybersecurity analysts and awareness trainers use this knowledge to identify threats and explain them clearly to non-technical staff.

1

Create the threat actors dictionary

Create a dictionary called threat_actors with these exact entries: 'Hackers': 'Financial gain', 'Insiders': 'Sabotage', 'Nation States': 'Espionage', 'Hacktivists': 'Political motives', 'Cybercriminals': 'Financial gain'

Cybersecurity

# Create the threat_actors dictionary with specified entries
# Your code here

Hint

Use curly braces {} to create a dictionary with keys and values separated by colons.

2

Add a motivation filter variable

Add a variable called focus_motivation and set it to the string 'Financial gain' to specify which motivation to filter by.

Cybersecurity

threat_actors = {
    'Hackers': 'Financial gain',
    'Insiders': 'Sabotage',
    'Nation States': 'Espionage',
    'Hacktivists': 'Political motives',
    'Cybercriminals': 'Financial gain'
}
# Define focus_motivation variable
# Your code here

Hint

Assign the string 'Financial gain' to the variable focus_motivation.

3

Filter threat actors by motivation

Use a dictionary comprehension to create a new dictionary called filtered_actors that includes only the entries from threat_actors where the motivation matches focus_motivation.

Cybersecurity

threat_actors = {
    'Hackers': 'Financial gain',
    'Insiders': 'Sabotage',
    'Nation States': 'Espionage',
    'Hacktivists': 'Political motives',
    'Cybercriminals': 'Financial gain'
}

focus_motivation = 'Financial gain'

# Create filtered_actors dictionary using comprehension
# Your code here

Hint

Use {key: value for key, value in dict.items() if condition} to filter dictionary entries.

4

Count the filtered threat actors

Add a variable called count_filtered and set it to the number of entries in filtered_actors using the len() function.

Cybersecurity

threat_actors = {
    'Hackers': 'Financial gain',
    'Insiders': 'Sabotage',
    'Nation States': 'Espionage',
    'Hacktivists': 'Political motives',
    'Cybercriminals': 'Financial gain'
}

focus_motivation = 'Financial gain'

filtered_actors = {actor: motive for actor, motive in threat_actors.items() if motive == focus_motivation}

# Count the filtered actors
# Your code here

Hint

Use len() to find how many items are in the dictionary filtered_actors.

Practice

1. What is a threat actor in cybersecurity?

easy

A. A device that stores data securely

B. A software program that protects computers

C. A person or group that causes harm using computers

D. A law that regulates internet use

Solution

1. Step 1: Understand the term 'threat actor'

   A threat actor is someone who causes harm or attacks in the cyber world.

2. Step 2: Match the definition to options

   A person or group that causes harm using computers correctly describes a person or group causing harm using computers.

3. Final Answer:

   A person or group that causes harm using computers -> Option C

4. Quick Check:

   Threat actor = person/group causing harm [OK]

Hint: Threat actors cause harm; defenders protect [OK]

Common Mistakes:

• Confusing threat actor with security software
• Thinking threat actor is a device
• Mixing threat actor with laws or rules

2. Which of the following is a common motivation for cyber attackers?

easy

A. To improve computer speed

B. To update operating systems

C. To install antivirus software

D. To steal sensitive information

Solution

1. Step 1: Identify common attacker motivations

   Attackers often want to steal sensitive data like passwords or credit card info.

2. Step 2: Compare options to motivation

   Only To steal sensitive information matches a common motivation: stealing sensitive information.

3. Final Answer:

   To steal sensitive information -> Option D

4. Quick Check:

   Motivation = steal info [OK]

Hint: Attackers want data, not system improvements [OK]

Common Mistakes:

• Choosing options about improving or updating systems
• Confusing attacker goals with defender tasks
• Ignoring the goal of stealing or damaging

3. A hacker group targets a company to demand money in exchange for not leaking stolen data. What is their motivation?

medium

A. Financial gain

B. Political influence

C. Hacktivism

D. Security testing

Solution

1. Step 1: Understand the scenario

   The group demands money to avoid leaking data, which means they want financial benefit.

2. Step 2: Match motivation to options

   Financial gain fits best because they want money, not political or social change.

3. Final Answer:

   Financial gain -> Option A

4. Quick Check:

   Demanding money = financial gain [OK]

Hint: Money demand means financial motivation [OK]

Common Mistakes:

• Confusing financial gain with political motives
• Thinking it's security testing
• Assuming hacktivism without social cause

4. Identify the error in this statement: "Hacktivists attack systems mainly to steal money."

medium

A. Hacktivists focus on political or social causes, not money

B. Hacktivists only protect systems, not attack

C. Hacktivists are government employees

D. Hacktivists use viruses to improve security

Solution

1. Step 1: Understand hacktivist motivation

   Hacktivists attack to promote political or social causes, not for money.

2. Step 2: Check options for correct error

   Hacktivists focus on political or social causes, not money correctly states the error: hacktivists do not mainly steal money.

3. Final Answer:

   Hacktivists focus on political or social causes, not money -> Option A

4. Quick Check:

   Hacktivists ≠ money theft [OK]

Hint: Hacktivists want change, not cash [OK]

Common Mistakes:

• Thinking hacktivists are defenders
• Assuming hacktivists work for governments
• Believing hacktivists improve security

5. A company wants to protect itself from attackers motivated by political reasons and those seeking financial gain. Which two threat actor types should it focus on?

hard

A. Cybercriminals and Insiders

B. Hacktivists and Cybercriminals

C. Nation-states and Hacktivists

D. Script Kiddies and Insiders

Solution

1. Step 1: Identify political motivation actors

   Hacktivists attack for political or social causes.

2. Step 2: Identify financial motivation actors

   Cybercriminals attack for money or financial gain.

3. Step 3: Match both types to options

   Hacktivists and Cybercriminals correctly pairs hacktivists (political) and cybercriminals (financial).

4. Final Answer:

   Hacktivists and Cybercriminals -> Option B

5. Quick Check:

   Political + Financial = Hacktivists + Cybercriminals [OK]

Hint: Political = hacktivists, financial = cybercriminals [OK]

Common Mistakes:

• Mixing insiders with political motives
• Confusing nation-states with financial criminals
• Ignoring hacktivists' political goals