Which of the following threat actors is the most likely to use large financial resources to attack critical systems located in other countries?

Nation-state actors are entities sponsored by governments and possess significant

financial, technological, and human resources. Their objectives often include

espionage, disrupting critical infrastructure, or projecting power against other countries.

This aligns directly with the scenario of attacking critical systems in other countries

using substantial financial backing.

A. Insider: An insider acts from within an organization, motivated by various factors like

revenge or personal gain. While dangerous due to their access, they typically lack the

"large financial resources" and primary motivation to launch large-scale attacks against

other countries' critical systems as a primary characteristic (NIST CSRC - Insider Threat).

B. Unskilled attacker: Often referred to as "script kiddies," these individuals lack

advanced skills and significant resources. They use readily available tools for

opportunistic attacks and do not have the capability or backing for sophisticated,

financially intensive campaigns against foreign critical infrastructure (TechTarget,

referencing NIST context).

D. Hacktivist: Hacktivists are motivated by political or social ideologies and use

hacking techniques to raise awareness or disrupt targets. While they can be disruptive,

they generally don't command the "large financial resources" comparable to a nation-

state for sustained international critical system attacks (Security Scientist; Infosec

Institute).

Nation-State Actors:

Cybersecurity and Infrastructure Security Agency (CISA). "Nation-State Cyber Actors."

CISA.gov. "Nation-state adversaries pose an elevated threat... These adversaries are

known for their advanced persistent threat (APT) activity... [and] have the resources and

capabilities to conduct a sustained cyber campaign..." (No specific page number,

webpage content).

URL: https://www.cisa.gov/topics/cyber-threats-and-advisories/nation-state-cyberactors

BAE Systems. "The Unusual Suspects: The Nation State Actor - cyber threats, methods

and motivations." "The Nation State Actor will have the resources and capabilities of

their government behind them... The significant resources at the disposal of the Nation

State Actor can be directed toward complex attacks against specific hardware, such as

the Stuxnet malware directed at Iran's nuclear manufacturing facilities..." (No specific

page number, article content). (While BAE Systems is a commercial entity, the article

provides a descriptive overview consistent with academic and governmental definitions;

I'll prioritize other sources if a direct definitional conflict arises, but this supports the

resource aspect).

URL: https://www.baesystems.com/en/story/the-nation-state-actor (Note: This is a

high-quality industry analysis that reflects common understanding, though I ideally

prefer a direct .gov or .edu primary source for definition of resources. CISA above

covers this well).

MIT Cybersecurity Clinic. "Cyberattacks by Nation-States – Social Cyberdefense of

Critical Urban Infrastructure." "Hallmarks of nation-state attacks include targeting

specific Industrial Control Systems (ICS) that manage critical urban infrastructure... The

mutation rate – 88 variants – and the number of Command and Control Servers –

approximately 146 found – point clearly to a state-sponsored threat." (Blog post

content).

URL: https://urbancyberdefense.mit.edu/blog/cyberattacks-nation-states/

Communications of the ACM. "Reasons to Raise the Cyber-Shields." Fortra.

(Referencing a Communications of the ACM article) "In Communications of the ACM,

Fortra's Bob Erdman discusses how nation-state actors, such as China's Volt Typhoon,

target U.S. critical infrastructure..." (News summary).

URL: https://www.fortra.com/resources/articles/communications-acm-reasons-raisecyber-shields (Secondary reference to an ACM publication)

Insider Threat:

National Institute of Standards and Technology (NIST). "insider threat - Glossary." NIST

Computer Security Resource Center (CSRC). "The threat that an insider will use her/his

authorized access, wittingly or unwittingly, to do harm..." (No specific mention of large

financial resources for external state-level attacks).

URL: https://csrc.nist.gov/glossary/term/insider_threat

Cybersecurity and Infrastructure Security Agency (CISA). "Defining Insider Threats."

CISA.gov. "Insider threat is the potential for an insider to use their authorized access or

understanding of an organization to harm that organization." (Focus is internal to the

organization).

URL: https://www.cisa.gov/topics/physical-security/insider-threatmitigation/defining-insider-threats

Unskilled Attacker:

TechTarget. "What is a Script Kiddie?" TechTarget SearchSecurity. "Script kiddies are

unskilled... They are often less skilled, experienced and knowledgeable than true

hackers." (Definition implies lack of resources for sophisticated attacks).

URL: https://www.techtarget.com/searchsecurity/definition/script-kiddy-or-script- kiddie

Wikipedia. "Script kiddie." (Referencing a Carnegie Mellon report for the US DoD

from 2000) "The typical script kiddy uses existing and frequently well known and

easy-to-find techniques and programs or scripts... often randomly and with little

regard or perhaps even understanding of the potentially harmful consequences."

(Lacks sophistication and resources for targeted state-level attacks).

URL: https://en.wikipedia.org/wiki/Script_kiddie (Note: Wikipedia is used here for a

common definition which cites a .mil relevant source, aligning with the 'unskilled' aspect.)

Hacktivist:

Security Scientist. "Is Hacktivism Good or Bad? - 9

Questions on Hacktivists." "Hacktivism is a form of civil disobedience that involves

hacking techniques to promote political or social causes... Their methods can include

website defacement and denial-of-service (DoS) attacks..." (Generally not associated

with large state-level financial backing for attacking foreign critical systems).

URL: https://www.securityscientist.net/blog/9-qustions-on-hacktivists/

Infosec Institute. "Hacktivism: Means and motivations … what else?" "Hacktivism is

mainly interpreted by society as the transposition of the protest and the civil

disobedience into cyberspace." (Implies resource levels are typically lower than

nation-states).

URL: https://www.infosecinstitute.com/resources/general-security/hacktivism-meansand-motivations-what-else/