6. Understanding the Attacker

By understanding who attacks, why they attack, how they attack, and what they do, the IT security professionals conducting the risk and vulnerability assessment can focus on combating threats and vulnerabilities commonly exploited by an attacker. This type of intelligence data can assist in the risk and vulnerability assessment by providing the IT security professional with knowledge about how attacks are conducted. This knowledge can be applied to defense-in-depth security controls and security countermeasures distributed throughout the IT infrastructure and seven areas of information security responsibility. Without this knowledge, the IT security professional cannot conduct the risk and vulnerability assessment from an attacker’s point of view.

This chapter will present an overview of the following characteristics about attackers:

• Who are the attackers?— Internal employees, contractors, third-party users, external attackers, hackers, and perpetrators.

• What do the attackers do?— Bypass security controls, commit unauthorized access, and exploit software vulnerabilities. Depending on the motivational reasons for the attack, attackers do different things.

• Why do attackers do it?— The goals and motivational factors explaining why attackers, hackers, and perpetrators attack an IT infrastructure and its assets will be defined.

• How do attackers do it?— The tools, approaches, and methods that attackers, hackers, and perpetrators use to conduct an attack on an IT infrastructure will be described.

With knowledge in these four areas about attackers, conducting a risk and vulnerability assessment can be done with a specific strategy in mind as well as with knowledge of how attackers attack. This approach to conducting a risk and vulnerability assessment equips the IT security professional with knowledge about how to monitor, prevent, and eliminate various attacks on the IT infrastructure. This knowledge will assist the IT security professional in developing an appropriate information security strategy for its IT infrastructure that encompasses the seven areas of information security responsibility.