4

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as:

  • Passive attackers - Those who aren't interested in you specifically but might intercept your data (like the NSA if it doesn't have an interest in you)
  • Uninterested attackers - Those that aren't interested in you in particular, but are actively testing your defenses. I would classify automated SSH attacks and port scans in this category (looking for easy targets, etc).
  • Active, interested attackers - People actively trying to break your security to get inside the network. Pentesters or someone you pissed off in IRC.

That's all I have. Is it enough, or is there a level of finnese I've missed? Is there any group of attackers I've completely forgot about?

2
  • This might be of interest, although a bit too "academic" to fit into corporate policy somehow
    – rath
    Sep 12, 2013 at 1:43
  • the NSA doesn't have an interest in you, they did try, but its just not working out
    – this.josh
    Sep 12, 2013 at 6:36

3 Answers 3

1

Plenty of taxonomies already exist. If you're writing and implementing a security policy, following an ISO 27000 nomenclature may prove convenient.

In any case, Wikipedia got a pretty exhaustive list of various standard listing threats to IT infrastructure, of which attackers are only a subset.

http://en.wikipedia.org/wiki/Threat_%28computer%29

7

Check out Intel's Threat Agent Chart:

enter image description here

Page 8 -> https://communities.intel.com/servlet/JiveServlet/downloadBody/1151-102-1-1111/Threat%20Agent%20Library_07-2202w.pdf

0

MISP has a lot of great stuff assembled here: https://github.com/MISP/misp-galaxy/tree/master/clusters

They have items for botnets, banker malware, exploit kits, ransomware, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .