Threat actors, threat intelligence and ATT&CK

Motivation categories are clues, not attribution

The selected Canadian source describes categories such as states, criminals, ideologically motivated actors, thrill seekers and malicious insiders. Financial, geopolitical, ideological or personal aims can overlap. Not every insider is malicious, and not every harmful event is an intentional attack. A motive label alone cannot identify who caused an incident.

Intelligence adds relevant context

Threat information can concern events, indicators, techniques and vulnerabilities. Intelligence makes information useful to a consumer’s decision through context and analysis. The selected government example uses a five-part lifecycle: direction sets needs, collection gathers data, processing prepares it, analysis develops meaning, and dissemination delivers it. Variants exist; this is not a universal mandated sequence.

Tailor the product and share carefully

Strategic reporting can support management decisions; operational and tactical products support more detailed defensive activity. The source’s placement of technical material within tactical is one taxonomy. Sharing can help others, but assess sensitivity, privacy, recipients and permitted handling. The older TLP:WHITE marking is not taught as current sharing-protocol guidance.

ATT&CK organizes observed adversary behaviour

MITRE ATT&CK is a knowledge base of tactics and techniques based on observations. Tactics describe an adversary’s purpose at a point in its activity; techniques describe ways of achieving it. It can structure discussion, detection work and gap analysis. A mapped technique is neither proof of an actor’s identity nor proof that a defensive control will detect every occurrence.

Connect the terminology.