When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as:

  • Passive attackers - Those who aren't interested in you specifically but might intercept your data (like the NSA if it doesn't have an interest in you)
  • Uninterested attackers - Those that aren't interested in you in particular, but are actively testing your defenses. I would classify automated SSH attacks and port scans in this category (looking for easy targets, etc).
  • Active, interested attackers - People actively trying to break your security to get inside the network. Pentesters or someone you pissed off in IRC.

That's all I have. Is it enough, or is there a level of finnese I've missed? Is there any group of attackers I've completely forgot about?

  • This might be of interest, although a bit too "academic" to fit into corporate policy somehow – rath Sep 12 '13 at 1:43
  • the NSA doesn't have an interest in you, they did try, but its just not working out – this.josh Sep 12 '13 at 6:36

Plenty of taxonomies already exist. If you're writing and implementing a security policy, following an ISO 27000 nomenclature may prove convenient.

In any case, Wikipedia got a pretty exhaustive list of various standard listing threats to IT infrastructure, of which attackers are only a subset.



Check out Intel's Threat Agent Chart:

enter image description here

Page 8 -> https://communities.intel.com/servlet/JiveServlet/downloadBody/1151-102-1-1111/Threat%20Agent%20Library_07-2202w.pdf


MISP has a lot of great stuff assembled here: https://github.com/MISP/misp-galaxy/tree/master/clusters

They have items for botnets, banker malware, exploit kits, ransomware, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.