Adversaries and Their Motivations
An adversary is a person or group that sets out to attack a system. Adversaries differ in skill, motive, and method. This lesson names five types of adversary and tells them apart by those three facts.
The table below is the threat register of a state highway toll operator. Its security team wrote one row for each adversary it expects.
| Row | Who | What they want | What they would do |
|---|---|---|---|
| 1 | A buyer of a ready-made phishing kit that copies the toll-account sign-in page. The buyer couldn't explain how the kit works. | Drivers' passwords, to resell | Send drivers to the copied page and keep what they type |
| 2 | A group opposed to the new toll increase on the commuter bridge | The increase withdrawn | Break into the directors' email and post their internal cost memo on the public-notice board |
| 3 | A toll-plaza maintenance technician passed over for promotion | To get back at the operator | Use his own maintenance account to switch off one plaza's plate-reading cameras |
| 4 | A group acting for a foreign government | The region's roads jammed on a holiday weekend | Stop every toll gate at once, backing traffic onto the highways around them |
| 5 | An overseas ransomware group | Payment | Encrypt the billing database and demand payment |
Script kiddies
The buyer in the first row didn't write the kit and couldn't explain how it works, so the buyer's skill is low. The motive is greed, since the passwords are worth money once resold.
Hacktivists
The second group wants a decision reversed. The toll increase is a decision about a public road, so the group's cause is political, and the group sees the increase as a harm to commuters. Breaking into the directors' email is illegal, and the group plans it anyway, because it holds that stopping the increase justifies the break-in. Posting the memo serves the cause by putting the operator's own cost figures in front of commuters.
Insider adversaries
The technician is the only adversary on the register who needs no way in. The maintenance account is his own, and it already reaches the cameras.
Revenge for the promotion he didn't get is his motive, and the operator itself handed him the means. Every step he'd take is one his account is allowed to take.
Cyberterrorists
The group acting for a foreign government is political, like the bridge group, but its target is far larger. It would stop every toll gate at once on a holiday weekend and back traffic up across the region's highways. Toll roads are civil infrastructure that the whole region depends on, so the harm would reach every driver in it. The bridge group aims at one organization's decision; this group aims at a region.
Transnational criminal organizations
The last row is an organized group working from another country, and it wants money. Its method is ransomware: encrypt the billing database, then demand payment to unlock it.
The kit buyer and the ransomware group both want money, and greed can drive an insider too, so the motive alone doesn't pick the type, but skill, access, and organization do. The kit buyer can't explain the tool they run, the insider already holds an account, and the ransomware group is an organized business working across borders.