Key Takeaways: The Threat Landscape

A one-page reference. Reread before an exam or before moving on. Dense by design.

Threat-actor taxonomy (memorize cold)

• Two axes: motivation (why) × capability (how good). Dangerous quadrant = high × high.
• APT = Advanced Persistent Threat: advanced technique, persistent long-term access, often nation-state.
• Naming the actor is a defensive act — it right-sizes the defense ("hackers" is not a threat).

Motivations → behavior → defense

Rule: Read the goal → anticipate the next move. "What would an attacker with this goal do next?"

The cyber kill chain (in order)

🚪 Core idea: the attacker must pass every stage; the defender only has to break one link. This is the engine of defense in depth (Theme 4). Meridian's Ch.1 attack broke at Exploitation (MFA); SolarWinds broke at Command & Control (behavioral anomaly). Limit: the model is perimeter/malware-centric; real attacks skip stages or start inside.

MITRE ATT&CK — the shared language

• Together = TTPs (tactics, techniques, procedures) — an adversary's characteristic way of operating.
• ATT&CK is a common language, a coverage map, and threat-informed defense made operational.
• Detect behavior, not just indicators: an IP/hash is cheap to change; a technique is costly to abandon → behavioral detections age slowly. (Pyramid of pain — climbed in Ch.22.)
• Pitfall: ATT&CK is not a checklist to turn fully green; cover the techniques of your likely actors.

Intrusion vocabulary

STRIDE-lite threat model

• A threat model = structured answer to what are we protecting, who attacks it, how, where do we stop them? Tie each threat to an actor + kill-chain stage + defense → it becomes your roadmap.
• STRIDE = a checklist against forgetting; populate every letter, especially the ones you struggle with (those are blind spots).

Anchor cases (this chapter)

• Double extortion: steal data then encrypt — backups alone don't remove the leak threat (Ch.35).
• Living off the land: use built-in legit tools to evade signatures — defeat with behavioral detection.

Certification crosswalk

Project additions this chapter

• Meridian program: threat-actor profile (criminals HIGH; insiders ever-present; hacktivists situational; APT low-likelihood/high-impact) + STRIDE-lite threat models for crown-jewel assets + re-prioritized risk register (adds supply-chain risk).
• bluekit toolkit: threatmodel.py — kill_chain_stage(event) and attack_surface(assets).

Common pitfalls

• Writing "hackers" instead of a specific actor + motivation + vector.
• Equating low skill (script kiddie) or low likelihood (APT) with low risk — impact still counts ($\text{Risk} = \text{L} \times \text{I}$).
• Treating ATT&CK as a checklist to fully "green," producing brittle detections that never fire.
• Detecting only indicators (IPs/hashes) and neglecting durable behavioral detection.
• Concluding "we can't stop a nation-state, so why invest?" — defense isn't binary; controls limit blast radius and dwell time even when prevention fails.
• Modeling only the probable threat and forgetting the high-impact one (the supply-chain blind spot).