Some quick example text to build on the card title and make up the bulk of the card's content.
Card link Another linkThis dream dictionary gives suggested meanings of dream symbols. A dream symbol often means something different in different dreams and is subjective.
Dream symbol meanings are different for each person. It's IMPORTANT to consider:
| Actors | Motivation | Tactics |
|---|---|---|
| Malicious Insiders | Revenge, financial gain, ideological reasons. | Data exfiltration, sabotage, privilege abuse. |
| Negligent Employees | Unintentional. | Misconfigurations, weak passwords, accidental sharing. |
| Privileged Users | May be malicious or negligent. | Abuse of elevated access, bypassing controls. |
| Third-Party Contractors/Vendors | Varies—can be negligent or compromised. | Indirect access to systems, weak security practices. |
| System Misconfigurations | Human error or oversight. | Exposed databases, open ports, insecure defaults. |
| Untrained Users | None (accidental). | Clicking phishing links, misusing systems, sharing sensitive data. |
| Actors | Motivation | Tactics |
|---|---|---|
| Cybercriminals | Financial gain through data theft, ransomware, fraud. | Phishing, malware, credential stuffing, exploiting vulnerabilities. |
| Hacktivists | Political or ideological causes. | Website defacement, data leaks, DDoS attacks. |
| Nation-State Actors | Espionage, disruption, intellectual property theft. | Advanced persistent threats (APTs), zero-day exploits, supply chain attacks. |
| Script Kiddies | Thrill, reputation, experimentation. | Use of pre-made tools and exploits with limited understanding. |
| Competitors | Industrial espionage, market advantage. | Insider recruitment, data theft, surveillance. |
| Cyber Terrorists | Cause widespread disruption or fear. | Infrastructure sabotage, data destruction, misinformation campaigns. |
| Actors | Motivation | Tactics |
|---|---|---|
| Supply Chain Vulnerabilities | Exploited by other actors. | Compromised software updates, insecure third-party services. |
| Actors | Motivation | Tactics |
|---|---|---|
| Automated Bots | Data scraping, brute-force attacks, spam. | Credential stuffing, vulnerability scanning. |
| AI-Powered Attack Systems | Sophisticated automation of attacks. | Adaptive phishing, deepfake generation, anomaly detection evasion. |
| Actors | Motivation | Tactics |
|---|---|---|
| Natural Disasters | Not applicable. | Data center damage, power outages, hardware loss. |
| OVERALL RISK: to the target system, organization, considering the likelihood of exploitation, business impact and ease of exploitation, among other factors. | ||||
|---|---|---|---|---|
| Critical: An immediate risk that is easily exploitable and may result in the total compromise of the target system. | High: May allow malicious actors with little technical skill to exploit publicly disclosed vulnerabilities or attack system misconfiguration to negatively impact the organization. | Medium: Presents some risk to the target system, may allow a malicious actor with high level technical skills to chain multiple vulnerabilities to infiltrate the affected system to gain an initial foothold into the organization. | Low: Presents a relatively low threat to the target system and may be utilized by an attacker to obtain insight into application architecture with a view to forming further attacks. | Informational: No immediate threat, however, provides information that may be unknown to the organization or to assist in improving the overall security posture. |
| IMPACT: also known as severity or consequence aims to determine the effect that results from exploitation of a vulnerability or flaw. | ||||
|---|---|---|---|---|
| Severe: Present an immediate risk to the organisation which may have financial, technical, legal or regulatory implications due to system compromise or exposure of company sensitive information. Attackers may read or modify data, execute arbitrary code or escalate privileges. | Major: Present a material security risk to the organisation which may have financial, technical or Legal implications to the organisation. | Moderate: Present a moderate security risk to the organisation which may lead to financial, technical or legal implications to the organisation. May not lead to direct system compromise or company information disclosure though may allow a malicious actor with high level technical skills to chain multiple vulnerabilities to infiltrate the affected system to gain an initial foothold into the organisation. | Minor: Present a low security risk to the organisation and will not have significant financial, technical or legal implications to the organisation. May have the potential to disclose application or system information through misconfiguration which may be utilised by an attacker to obtain insight into application architecture with a view to forming further attacks. | Insignificant: No financial, technical or legal implications to the organisation. |
| LIKELIHOOD: reflects how likely it is for a risk to occur. | ||||
|---|---|---|---|---|
| Certain: Exploitation is certain. | Likely: Exploitation is almost certain. | Possible: Exploitation is likely to occur. | Unlikely: Exploitation is possible but unlikely. | Rare: Exploitation is unlikely. |