Sort seven actors by what they can afford

short · 30 min · Objective 2.2

Task

Build a small decision table that classifies a threat actor and a motive from the evidence in a scenario, then test it against five incident summaries you write from public reporting. The aim is a rule you can apply in ninety seconds under exam conditions, not a memorised list.

Steps

  1. Write /tmp/actors.csv with the columns actor,resources,sophistication,internal,typical_goal,tell and one row for each of the seven actors SY0-801 names: state-sponsored, crime syndicate, terrorist, hacktivist, competitor, insider, and unskilled attacker.
  2. In the tell column put the single strongest discriminator for each -- the thing that, if present in a scenario, most raises that actor's probability. Watch the two traps from the lesson: a competitor and a state can both want intellectual property, and a terrorist and a hacktivist can both be ideological.
  3. Write five short incident summaries into /tmp/incidents.md from publicly reported breaches you already know of, each under its own ## heading. Each must be three sentences and must NOT name the actor.
  4. Beside each, record your classification, the motive (financial, extortion, espionage, intellectual property, influence, ideological, fear and chaos, revenge, notoriety, curiosity or ethical) and the one fact that decided it.
  5. Check your reasoning against the table: any classification you cannot tie to a tell column is a guess, and you should either find the fact or record that the scenario is genuinely ambiguous.

Verify

awk -F, 'NR>1 && NF>=6 {n++} END {print n" actor row(s) with all columns"}' /tmp/actors.csv
grep -c '^##' /tmp/incidents.md
python3 -c "
import csv
rows=list(csv.DictReader(open('/tmp/actors.csv')))
names=[r['actor'].strip().lower() for r in rows]
assert len(rows)>=7, 'fewer than the seven named actors'
assert any('state' in n for n in names), 'state-sponsored is the current term - use it'
tells=[r['tell'].strip().lower() for r in rows]
assert len(set(tells))==len(tells), 'two actors share a tell - it does not discriminate'
print(len(rows),'actors, every tell distinct')"

The first must report at least seven rows and the second at least five incidents. The assertion is the point of the lab: if two rows carry the same discriminator, that discriminator cannot separate them, and a table that cannot separate them will not help you in the exam. Rewrite until every tell is genuinely distinct.

Notes

The most reliable single discriminator is the use of a previously unknown vulnerability, because zero-days cost money. If your table did not end up with that in the state-sponsored row, reconsider it. The second most useful is announcement: hacktivists and notoriety-seekers announce themselves, spies do not.

This is an independent study companion for CompTIA Security+ SY0-801 and is not produced by or endorsed by CompTIA.