The question “Who is attacking us?” explains cyber threat actors and their motivations for attacking organizations. The chapter begins with a Colonial Pipeline case study that describes the ransomware attack against the U.S. fuel pipeline, a cyberattack on critical U.S. infrastructure. The chapter explains different types of cyberattacks, including social engineering, denial of service, advance persistent threats, brute force attacks, and artificial intelligence attacks. Further, the chapter details the suite of threat actors who launch cyberattacks, including lone hackers, hacktivists, petty criminals, organized criminals, professional criminals, and nation-states. Finally, the chapter describes the importance of sectoral threat intelligence, including Information Sharing and Analysis Centers (ISACs), and types of threats to specific sectors, including finance, healthcare, manufacturing, education, power and utilities, and retail. The chapter concludes with Embedded Endurance strategy lessons from Falco’s experience addressing these issues at NASA’s Jet Propulsion Laboratory.
Mining Threat Intelligence from Billion-scale SSH Brute-Force Attacks