Sort five real incidents by what the actor could afford

short · 30 min · Objective 2.1

Task

Build a small decision table that classifies a threat actor from the evidence in a scenario, then test it against five incident summaries you write from public reporting. The aim is a rule you can apply in ninety seconds under exam conditions, not a memorised list.

Steps

  1. Write /tmp/actors.csv with the columns actor,resources,sophistication,internal,typical_goal,tell and one row for each of: nation-state, organised crime, hacktivist, insider, unskilled attacker.
  2. In the tell column put the single strongest discriminator for each — the thing that, if present in a scenario, most raises that actor's probability.
  3. Write five short incident summaries into /tmp/incidents.md from publicly reported breaches you already know of. Each must be three sentences and must NOT name the actor.
  4. Beside each, record your classification and the one fact that decided it.
  5. Check your reasoning against the table: any classification you cannot tie to a tell column is a guess, and you should either find the fact or record that the scenario is genuinely ambiguous.

Verify

awk -F, 'NR>1 && NF>=6 {n++} END {print n" actor row(s) with all columns"}' /tmp/actors.csv
grep -c '^##' /tmp/incidents.md
python3 -c "
import csv
rows=list(csv.DictReader(open('/tmp/actors.csv')))
tells=[r['tell'].strip().lower() for r in rows]
assert len(set(tells))==len(tells), 'two actors share a tell - it does not discriminate'
print(len(rows),'actors, every tell distinct')"

The assertion is the verification and it is the point of the lab: if two rows carry the same discriminator, that discriminator cannot separate them, and a table that cannot separate them will not help you in the exam. Rewrite until every tell is genuinely distinct.

Notes

The most reliable single discriminator is the use of a previously unknown vulnerability, because zero-days cost money. If your table did not end up with that in the nation-state row, reconsider it.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.