Threat Actor
What is Threat Actor?
An individual or group that conducts cyber attacks or exploits vulnerabilities. Threat actors include nation-states, organised crime groups, hacktivists, insider threats, and opportunistic attackers.
Terms that appear alongside threat actor
Each of these is named in at least one of the same controls as threat actor. The number is how many controls name both.
- malware 3 shared controls
- profiling 2 shared controls
- mitre 2 shared controls
- threat intelligence 2 shared controls
Frameworks that govern threat actor
What the standards actually require on threat actor
Requirements naming threat actor across 6 standards, quoted from the control text.
Wherever feasible, logging also covers assets within the function that a threat actor could use to reach an objective.
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-1b · SITUATION-1b: Logging on assets a threat actor could leverage →When identifying threats, consider each potential actor's capability, opportunity and intent, then weigh threats against vulnerabilities to judge likelihood, which with impact gives risk.
BIMCO-2.1 · Threat actors →CSF 2.0 outcome: potentially adverse events are analyzed to better understand associated activities. Priority High. R1: use tools such as SIEM and SOAR to monitor log events continuously for known malicious and suspicious activity and report findings.
nist-sp-800-61-rev-3::DE.AE-02 · DE.AE-02 Log events analyzed with SIEM or SOAR tools, current CTI and manual review →FIRST CSIRT Services Framework v2.1 Service Area 4 - Situational Awareness. SCOPE: maintaining + sharing operational + tactical + strategic awareness of the cyber threat landscape relevant to the constituency.
FIRST-CSIRTF-SA4-SituationalAwareness · Service Area 4 - Situational Awareness and Threat Intelligence →A cyber threat is significant for DORA Article 18(2) where all of the following hold: if it materialised it could affect critical or important functions of the entity, or other financial entities, third-party providers, clients or counterparts;
dora-rts-on-classification-of-ict-related-incidents-commission-delegated-regulation-eu-2024-1772::10 · Article 10: High materiality thresholds for significant cyber threats →The entity must set roles to detect and respond to incidents and anomalies. Its detection mechanism must collect, monitor and analyse internal and external factors (at least the Article 12 logs, information from business and ICT functions and user-reported pro...
dora-rts-on-ict-risk-management-framework-commission-delegated-regulation-eu-2024-1774::23 · Article 23: Anomalous activities detection and incident detection and response criteria →Questions people ask about threat actor
What is Threat Actor?
Why is Threat Actor important for compliance?
Which compliance frameworks address Threat Actor?
Where can I learn more about Threat Actor?
See how Threat Actor applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.