LESSON 2.1: The Threat Taxonomy – Understanding the Cyber Threat Landscape for Financial Institutions

Introduction: The Adversarial Ecosystem

In Module 1, we established the foundational concepts of cybersecurity for financial institutions. We explored the regulatory landscape, cyber threat intelligence, risk assessment, security frameworks, governance, and metrics. We also completed a capstone project on building a comprehensive cybersecurity program.

In Module 2, we shift our focus to the threats themselves. Understanding the adversaries, their motivations, capabilities, and attack vectors is essential for building effective defenses. As Sun Tzu wrote in The Art of War: “If you know the enemy and know yourself, you need not fear the result of a hundred battles.”

The cyber threat landscape for financial institutions is diverse and constantly evolving. Threat actors range from lone hackers to sophisticated nation-state groups. Attack vectors include phishing, ransomware, DDoS, supply chain attacks, and insider threats. The financial sector is a prime target because it holds the most valuable asset in the digital age: money and data.

This lesson provides a complete taxonomy of cyber threats facing financial institutions. We categorize threat actors by their motivations and capabilities, formalize the attack vectors they use, and quantify the risks they pose. We derive the Threat Actor Capability Model: $C = α \cdot R + β \cdot T + γ \cdot K$ , where $R$ is resources, $T$ is technical skill, and $K$ is knowledge of the target. We formalize the Attack Vector Taxonomy: $A = {Social Engineering, Malware, Network Attacks, Application Attacks, Physical Attacks, Insider Threats}$ .

We also introduce the Threat Prioritization Matrix: $T_{p r i or i t y} = L_{ik e l ih oo d} \times I_{m p a c t} \times V_{e l oc i t y}$ , which helps financial institutions prioritize threats. We derive the Threat Actor Risk Score: $R_{a c t or} = C_{a p abi l i t y} \times M_{o t i v a t i o n} \times O_{pp or t u ni t y}$ , which quantifies the risk posed by each threat actor type.

By the end, you will have a complete understanding of the threat landscape facing financial institutions and be able to prioritize threats based on their risk to the organization.

Learning Objectives

Upon completion of this lesson, you will be able to:

Categorize threat actors by their motivations and capabilities: Nation-state, organized crime, hacktivists, insiders, and script kiddies.
Classify attack vectors by their mechanisms: Social engineering, malware, network attacks, application attacks, physical attacks, and insider threats.
Derive the Threat Actor Capability Model: $C = α \cdot R + β \cdot T + γ \cdot K$ .
Derive the Threat Prioritization Matrix: $T_{p r i or i t y} = L_{ik e l ih oo d} \times I_{m p a c t} \times V_{e l oc i t y}$ .
Derive the Threat Actor Risk Score: $R_{a c t or} = C_{a p abi l i t y} \times M_{o t i v a t i o n} \times O_{pp or t u ni t y}$ .
Apply threat intelligence to financial institutions and design a Threat Monitoring Program.

Part 1: Threat Actor Categorization

1.1 The Threat Actor Taxonomy

Threat actors can be categorized by their motivations and capabilities:

$Threat Actors = {Nation-State, Organized Crime, Hacktivists, Insiders, Script Kiddies}$

1.2 Nation-State Actors

Motivation: Espionage, geopolitical advantage, economic warfare, destabilization.

Capabilities: Very High (state-funded, extensive resources, advanced techniques).

Key Characteristics:

Sophisticated tactics, techniques, and procedures (TTPs)
Access to zero-day vulnerabilities
Long-term persistence (Advanced Persistent Threats)
State-sponsored and state-funded
Highly organized and well-resourced

Financial Sector Examples:

APT38 (North Korea): Targeting financial institutions for theft
Lazarus Group (North Korea): Responsible for the $1.5 billion ByBit hack
APT29 (Russia): Targeting financial and energy sectors
APT10 (China): Espionage targeting financial institutions
Turla (Russia): Long-term espionage against financial targets

Common Attack Vectors:

Spear phishing with custom malware
Zero-day exploits
Supply chain attacks
Watering hole attacks

1.3 Organized Crime

Motivation: Financial gain (theft, fraud, ransomware, extortion).

Capabilities: High (well-funded, professional, sophisticated).

Key Characteristics:

Financially motivated
Operate like businesses (Ransomware-as-a-Service)
Use sophisticated malware and social engineering
Often collaborate with other criminal groups
Highly organized and profit-driven

Financial Sector Examples:

FIN7: Targeting financial institutions with phishing and malware
Carbanak Group: Stealing $1 billion from banks worldwide
REvil/Sodinokibi: Ransomware targeting financial institutions
CL0P: Ransomware and data extortion
TrickBot: Banking trojan targeting financial institutions

Common Attack Vectors:

Phishing and spear phishing
Malware (banking trojans, ransomware)
Social engineering
Credential theft

1.4 Hacktivists

Motivation: Political, ideological, or social causes.

Capabilities: Medium (technically skilled, but limited resources).

Key Characteristics:

Politically or ideologically motivated
Often use DDoS, website defacement, and data leaks
May target financial institutions for symbolic reasons
Often operate in loose, decentralized groups
Motivated by publicity and attention

Financial Sector Examples:

Anonymous: DDoS attacks on financial institutions
WikiLeaks: Leaking financial data
LulzSec: Targeting financial institutions for notoriety
Occupy Wall Street Hackers: Targeting financial institutions

Common Attack Vectors:

Distributed Denial of Service (DDoS)
Website defacement
Data leaks and whistleblowing
Social media campaigns

1.5 Insider Threats

Motivation: Financial gain, revenge, ideological reasons, negligence.

Capabilities: Varies (from low to high, depending on access).

Key Characteristics:

Have legitimate access to systems and data
Can be malicious, negligent, or compromised
Hard to detect because they appear legitimate
Account for a significant percentage of data breaches
Often motivated by personal grievances or financial pressure

Financial Sector Examples:

Malicious Insiders: Selling customer data, committing fraud
Negligent Insiders: Falling for phishing, misconfiguring systems
Compromised Insiders: Credentials stolen by external attackers
Disgruntled Employees: Sabotage or data theft

Common Attack Vectors:

Data theft
Privilege abuse
Social engineering
System sabotage

1.6 Script Kiddies

Motivation: Notoriety, learning, curiosity.

Capabilities: Low (use existing tools and exploits).

Key Characteristics:

Low technical skill
Use existing tools and exploits
Often target financial institutions for notoriety
Rarely cause significant damage, but can be a nuisance
Motivated by ego and attention

Common Attack Vectors:

Automated vulnerability scanning
Pre-written malware
Simple phishing attacks
Website defacement

Threat Actor Taxonomy (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Nation-State Actors                                              ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Motivation: Espionage, geopolitical advantage                   ║  |
|  ║  Capability: Very High (state-funded, advanced)                  ║  |
|  ║  Examples: APT38, Lazarus Group, APT29, APT10, Turla            ║  |
|  ║  Vectors: Spear phishing, zero-days, supply chain attacks       ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Organized Crime                                                 ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Motivation: Financial gain (theft, ransomware, fraud)           ║  |
|  ║  Capability: High (well-funded, professional)                   ║  |
|  ║  Examples: FIN7, Carbanak Group, REvil, CL0P, TrickBot          ║  |
|  ║  Vectors: Phishing, malware, social engineering                 ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Hacktivists                                                     ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Motivation: Political, ideological, social causes               ║  |
|  ║  Capability: Medium (technically skilled, limited resources)     ║  |
|  ║  Examples: Anonymous, WikiLeaks, LulzSec                        ║  |
|  ║  Vectors: DDoS, defacement, data leaks                          ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Insider Threats                                                 ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Motivation: Financial gain, revenge, ideology, negligence       ║  |
|  ║  Capability: Varies (low to high)                               ║  |
|  ║  Examples: Malicious insiders, negligent insiders,              ║  |
|  ║            compromised insiders                                  ║  |
|  ║  Vectors: Data theft, privilege abuse, sabotage                 ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Script Kiddies                                                  ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Motivation: Notoriety, learning, curiosity                     ║  |
|  ║  Capability: Low (use existing tools)                           ║  |
|  ║  Examples: Individual hackers using automated tools             ║  |
|  ║  Vectors: Automated scanning, pre-written malware, defacement   ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 2: The Threat Actor Capability Model

2.1 The Model Definition

The Threat Actor Capability Model quantifies the capabilities of different threat actors. This model helps financial institutions understand the relative threat posed by different actor types and allocate defenses accordingly.

$C = α \cdot R + β \cdot T + γ \cdot K$

Where:

$C$ is the overall capability (0-1)
$R$ is Resources (0-1): Funding, infrastructure, personnel
$T$ is Technical Skill (0-1): Expertise, tools, techniques
$K$ is Knowledge of the target (0-1): Intelligence, reconnaissance
$α, β, γ$ are weights (typically $α = 0.4, β = 0.3, γ = 0.3$ )

2.2 Derivation of the Model

The model is derived from three fundamental components of threat actor capability:

1. Resources (R): The financial and material resources available to the actor. This includes:

Funding for operations
Access to infrastructure (servers, botnets)
Personnel and expertise
Research and development capabilities

2. Technical Skill (T): The technical expertise and capabilities of the actor. This includes:

Knowledge of vulnerabilities and exploits
Ability to develop custom malware
Understanding of defensive measures
Reverse engineering capabilities

3. Knowledge (K): The actor’s understanding of the target. This includes:

Intelligence gathering capabilities
Understanding of the target’s architecture
Knowledge of personnel and processes
Reconnaissance capabilities

2.3 Capability Scores by Threat Actor Type

Threat Actor Type	Resources (R)	Technical Skill (T)	Knowledge (K)	Capability (C)
Nation-State	1.00	1.00	0.90	0.98
Organized Crime	0.85	0.85	0.75	0.82
Hacktivists	0.40	0.60	0.50	0.48
Insider Threats	0.30	0.40	0.95	0.53
Script Kiddies	0.10	0.20	0.10	0.13

2.4 Interpretation of Capability Scores

Capability Score	Threat Level	Description
$C \geq 0.80$	Very High	Nation-state actors, top-tier organized crime
$0.50 \leq C < 0.80$	High	Insider threats, sophisticated criminal groups
$0.20 \leq C < 0.50$	Medium	Hacktivists, less sophisticated criminal groups
$C < 0.20$	Low	Script kiddies, individual hackers

2.5 Example Calculation

For a nation-state actor:

$R = 1.00$
$T = 1.00$
$K = 0.90$
$C = 0.4 (1.00) + 0.3 (1.00) + 0.3 (0.90) = 0.40 + 0.30 + 0.27 = 0.97$

For an insider threat:

$R = 0.30$
$T = 0.40$
$K = 0.95$
$C = 0.4 (0.30) + 0.3 (0.40) + 0.3 (0.95) = 0.12 + 0.12 + 0.285 = 0.525$

Threat Actor Capability Model (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  Threat Actor Type    │  R  │  T  │  K  │  C  │  Threat Level       │
|───────────────────────┼─────┼─────┼─────┼─────┼─────────────────────│
|  Nation-State         │ 1.00│ 1.00│ 0.90│ 0.98│  Very High          │
|  Organized Crime      │ 0.85│ 0.85│ 0.75│ 0.82│  Very High          │
|  Hacktivists          │ 0.40│ 0.60│ 0.50│ 0.48│  Medium             │
|  Insider Threats      │ 0.30│ 0.40│ 0.95│ 0.53│  High               │
|  Script Kiddies       │ 0.10│ 0.20│ 0.10│ 0.13│  Low                │
|───────────────────────┴─────┴─────┴─────┴─────┴─────────────────────│
|                                                                         |
|  Formula: C = 0.4 * R + 0.3 * T + 0.3 * K                            │
|                                                                         |
|  Capability Distribution:                                              │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  Capability  │  Interpretation                                │  │
|  │──────────────┼─────────────────────────────────────────────────│  │
|  │  0.98        │  Nation-state actors pose the highest threat.  │  │
|  │  0.82        │  Organized crime is nearly as capable.         │  │
|  │  0.53        │  Insider threats are dangerous due to K.       │  │
|  │  0.48        │  Hacktivists have medium capability.           │  │
|  │  0.13        │  Script kiddies pose the lowest threat.        │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 3: The Threat Actor Risk Score

3.1 The Model Definition

The Threat Actor Risk Score quantifies the overall risk posed by each threat actor type. This score combines capability with motivation and opportunity to create a comprehensive risk assessment.

$R^{a c t or} = C^{a p abi l i t y} \times M^{o t i v a t i o n} \times O^{pp or t u ni t y}$

Where:

$C_{a p abi l i t y}$ is the Capability Score (0-1) from the previous model
$M_{o t i v a t i o n}$ is the Motivation Score (0-1)
$O_{pp or t u ni t y}$ is the Opportunity Score (0-1)

3.2 Motivation and Opportunity Scores

Threat Actor Type	Capability (C)	Motivation (M)	Opportunity (O)	Risk Score (R)
Nation-State	0.98	0.90	0.85	0.75
Organized Crime	0.82	0.95	0.80	0.62
Hacktivists	0.48	0.70	0.40	0.13
Insider Threats	0.53	0.60	0.90	0.29
Script Kiddies	0.13	0.40	0.30	0.02

3.3 Interpretation of Risk Scores

Risk Score	Priority	Action
$R \geq 0.50$	Critical	Immediate action required
$0.25 \leq R < 0.50$	High	Action required soon
$0.10 \leq R < 0.25$	Medium	Action required
$R < 0.10$	Low	Acceptable risk

3.4 Example Calculation

For a nation-state actor:

$C = 0.98$
$M = 0.90$
$O = 0.85$
$R = 0.98 \times 0.90 \times 0.85 = 0.75$

For an insider threat:

$C = 0.53$
$M = 0.60$
$O = 0.90$
$R = 0.53 \times 0.60 \times 0.90 = 0.29$

Threat Actor Risk Score (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  Threat Actor Type    │  C  │  M  │  O  │  R  │  Priority           │
|───────────────────────┼─────┼─────┼─────┼─────┼─────────────────────│
|  Nation-State         │ 0.98│ 0.90│ 0.85│ 0.75│  Critical           │
|  Organized Crime      │ 0.82│ 0.95│ 0.80│ 0.62│  Critical           │
|  Hacktivists          │ 0.48│ 0.70│ 0.40│ 0.13│  Medium             │
|  Insider Threats      │ 0.53│ 0.60│ 0.90│ 0.29│  High               │
|  Script Kiddies       │ 0.13│ 0.40│ 0.30│ 0.02│  Low                │
|───────────────────────┴─────┴─────┴─────┴─────┴─────────────────────│
|                                                                         |
|  Formula: R = C * M * O                                               │
|                                                                         |
|  Priority Distribution:                                               │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  Priority  │  Actor Type(s)                                   │  │
|  │────────────┼──────────────────────────────────────────────────│  │
|  │  Critical  │  Nation-State, Organized Crime                   │  │
|  │  High      │  Insider Threats                                 │  │
|  │  Medium    │  Hacktivists                                     │  │
|  │  Low       │  Script Kiddies                                  │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 4: Attack Vector Taxonomy

4.1 The Attack Vector Taxonomy Definition

Attack vectors are the paths or methods that threat actors use to gain unauthorized access. Understanding attack vectors is essential for building effective defenses.

$A = {Social Engineering, Malware, Network Attacks, Application Attacks, Physical Attacks, Insider Threats}$

4.2 Social Engineering

Attack Type	Description	Examples	Financial Sector Impact
Phishing	Deceptive emails to steal credentials	Spear phishing, whaling, vishing	Credential theft, data breaches
Pretexting	Creating a false scenario to obtain information	Impersonating IT support	Unauthorized access
Baiting	Offering something enticing to deliver malware	USB drops, infected downloads	Malware installation
Tailgating	Following authorized individuals into restricted areas	Building access, data centers	Physical security breach
Vishing	Voice phishing via phone calls	Impersonating bank officials	Credential theft
SMiShing	Phishing via SMS text messages	Fake bank alerts	Credential theft

4.3 Malware

Attack Type	Description	Examples	Financial Sector Impact
Ransomware	Encrypts data and demands payment	REvil, LockBit, BlackCat	Operational disruption, financial loss
Trojan	Disguises itself as legitimate software	Banking trojans (Emotet, TrickBot)	Credential theft, fraud
Spyware	Steals information from victims	Keyloggers, screen capture	Data theft, espionage
Botnets	Networks of compromised devices	DDoS attacks, spam, credential stuffing	Denial of service, fraud
Wiper	Destroys data	NotPetya, Shamoon	Operational disruption
Rootkit	Hides malware presence	Kernel-level malware	Persistent access

4.4 Network Attacks

Attack Type	Description	Examples	Financial Sector Impact
DDoS	Overwhelming systems with traffic	Volumetric, application-layer	Denial of service
Man-in-the-Middle	Intercepting communications	SSL stripping, session hijacking	Data theft, fraud
DNS Spoofing	Redirecting traffic to malicious sites	Cache poisoning, domain hijacking	Phishing, malware
Network Sniffing	Capturing network traffic	Unencrypted traffic, ARP spoofing	Data theft
DNS Tunneling	Exfiltrating data via DNS	DNS queries to malicious servers	Data exfiltration
Port Scanning	Identifying open ports and services	Reconnaissance	Vulnerability identification

4.5 Application Attacks

Attack Type	Description	Examples	Financial Sector Impact
SQL Injection	Exploiting database queries	Data theft, database manipulation	Data breach
Cross-Site Scripting	Injecting malicious scripts	Session hijacking, data theft	Data theft, fraud
Cross-Site Request Forgery	Forging requests	Unauthorized transactions	Financial fraud
API Abuse	Exploiting APIs	Unauthorized access, data exfiltration	Data breach
Command Injection	Executing arbitrary commands	System compromise	Full system compromise
Path Traversal	Accessing files outside the web root	File read/write	Data theft

4.6 Physical Attacks

Attack Type	Description	Examples	Financial Sector Impact
Hardware Attacks	Tampering with hardware	ATM skimming, server access	Financial theft, data theft
Environmental	Disrupting physical environments	Fire, flood, power outages	Operational disruption
Physical Social Engineering	Physical social engineering	Tailgating, impersonation	Unauthorized access
Theft	Stealing physical assets	Laptops, servers, documents	Data theft
Vandalism	Damaging physical assets	Graffiti, destruction	Operational disruption

4.7 Insider Threats (Expanded)

Attack Type	Description	Examples	Financial Sector Impact
Malicious Insiders	Intentional harm	Data theft, sabotage, fraud	Financial loss, reputation damage
Negligent Insiders	Unintentional harm	Falling for phishing, misconfiguration	Data breach, operational disruption
Compromised Insiders	Credentials stolen	Credential theft, insider MFA bypass	Data breach, fraud
Third-Party Insiders	Contractors, vendors	Supply chain attacks	Data breach, operational disruption

Attack Vector Taxonomy (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Social Engineering                                              ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Phishing (email)                                             ║  |
|  ║  • Spear Phishing (targeted email)                              ║  |
|  ║  • Whaling (targeting executives)                               ║  |
|  ║  • Vishing (voice)                                              ║  |
|  ║  • SMiShing (SMS)                                               ║  |
|  ║  • Pretexting (false scenarios)                                 ║  |
|  ║  • Baiting (enticing offers)                                    ║  |
|  ║  • Tailgating (physical access)                                 ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Malware                                                       ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Ransomware                                                  ║  |
|  ║  • Trojan                                                      ║  |
|  ║  • Spyware                                                     ║  |
|  ║  • Botnets                                                     ║  |
|  ║  • Wiper                                                       ║  |
|  ║  • Rootkit                                                     ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Network Attacks                                                ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • DDoS                                                        ║  |
|  ║  • Man-in-the-Middle                                           ║  |
|  ║  • DNS Spoofing                                                ║  |
|  ║  • Network Sniffing                                            ║  |
|  ║  • DNS Tunneling                                               ║  |
|  ║  • Port Scanning                                               ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Application Attacks                                            ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • SQL Injection                                                ║  |
|  ║  • Cross-Site Scripting                                         ║  |
|  ║  • Cross-Site Request Forgery                                   ║  |
|  ║  • API Abuse                                                    ║  |
|  ║  • Command Injection                                            ║  |
|  ║  • Path Traversal                                               ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Physical Attacks                                               ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Hardware Attacks                                             ║  |
|  ║  • Environmental Attacks                                        ║  |
|  ║  • Physical Social Engineering                                  ║  |
|  ║  • Theft                                                        ║  |
|  ║  • Vandalism                                                    ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Insider Threats                                                ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Malicious Insiders                                           ║  |
|  ║  • Negligent Insiders                                           ║  |
|  ║  • Compromised Insiders                                         ║  |
|  ║  • Third-Party Insiders                                         ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 5: The Threat Prioritization Matrix

5.1 The Model Definition

The Threat Prioritization Matrix helps financial institutions prioritize threats based on their likelihood, impact, and velocity. This matrix enables organizations to allocate resources to the most critical threats.

$T^{p r i or i t y} = L^{ik e l ih oo d} \times I^{m p a c t} \times V^{e l oc i t y}$

Where:

$L_{ik e l ih oo d}$ is the Likelihood of the threat materializing (0-1)
$I_{m p a c t}$ is the Impact of the threat (0-1)
$V_{e l oc i t y}$ is the Velocity of the threat (0-1)

5.2 Components

Component	Description	Key Indicators	Measurement
Likelihood (L)	Probability of the threat materializing	Threat intelligence, historical data, attack frequency	0-1
Impact (I)	Consequences if the threat materializes	Financial loss, reputational damage, regulatory fines	0-1
Velocity (V)	Speed at which the threat materializes	Time to exploit, speed of propagation, detection difficulty	0-1

5.3 Likelihood Scoring Guide

Score	Probability	Description
0.80-1.00	Very High	Occurs multiple times per year
0.60-0.79	High	Occurs once per year
0.40-0.59	Medium	Occurs once every 2-3 years
0.20-0.39	Low	Occurs once every 5 years
0.00-0.19	Very Low	Occurs less than once every 5 years

5.4 Impact Scoring Guide

Score	Severity	Description
0.80-1.00	Critical	> $50M loss, regulatory action, reputation collapse
0.60-0.79	High	$10M-$50M loss, significant regulatory fines
0.40-0.59	Medium	$1M-$10M loss, moderate regulatory fines
0.20-0.39	Low	$100K-$1M loss, minor regulatory fines
0.00-0.19	Very Low	< $100K loss, no regulatory action

5.5 Velocity Scoring Guide

Score	Speed	Description
0.80-1.00	Instant	Exploited in seconds, automated propagation
0.60-0.79	Fast	Exploited in minutes-hours
0.40-0.59	Moderate	Exploited in hours-days
0.20-0.39	Slow	Exploited in days-weeks
0.00-0.19	Very Slow	Exploited in weeks-months

5.6 Interpretation

Priority Score	Priority	Action
$T_{p r i or i t y} \geq 0.50$	Critical	Immediate action required
$0.25 \leq T_{p r i or i t y} < 0.50$	High	Action required soon
$0.10 \leq T_{p r i or i t y} < 0.25$	Medium	Action required
$T_{p r i or i t y} < 0.10$	Low	Acceptable risk

5.7 Example Calculation

Threat: Ransomware

Likelihood: 0.40 (Medium – occurs every 2-3 years)
Impact: 0.90 (Critical – >$50M potential loss)
Velocity: 0.40 (Moderate – exploited in hours-days)
$T_{p r i or i t y} = 0.40 \times 0.90 \times 0.40 = 0.144$
Classification: Medium

Threat: Phishing

Likelihood: 0.70 (High – occurs once per year)
Impact: 0.40 (Medium – $1M-$10M potential loss)
Velocity: 0.70 (Fast – exploited in minutes-hours)
$T_{p r i or i t y} = 0.70 \times 0.40 \times 0.70 = 0.196$
Classification: High

Threat: Data Breach

Likelihood: 0.30 (Low – occurs once every 5 years)
Impact: 0.95 (Critical – >$50M potential loss, regulatory action)
Velocity: 0.20 (Slow – exploited in days-weeks)
$T_{p r i or i t y} = 0.30 \times 0.95 \times 0.20 = 0.057$
Classification: Low

Threat Prioritization Matrix (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  Threat               │  L  │  I  │  V  │  Score  │  Priority        │
|───────────────────────┼─────┼─────┼─────┼─────────┼──────────────────│
|  Ransomware           │ 0.40│ 0.90│ 0.40│  0.144  │  Medium          │
|  Phishing             │ 0.70│ 0.40│ 0.70│  0.196  │  High            │
|  Data Breach          │ 0.30│ 0.95│ 0.20│  0.057  │  Low             │
|  DDoS Attack          │ 0.60│ 0.30│ 0.80│  0.144  │  Medium          │
|  Insider Threat       │ 0.25│ 0.70│ 0.50│  0.088  │  Low-Medium      │
|  Credential Theft     │ 0.55│ 0.85│ 0.60│  0.281  │  High            │
|  Supply Chain Attack  │ 0.20│ 0.80│ 0.30│  0.048  │  Low             │
|───────────────────────┴─────┴─────┴─────┴─────────┴──────────────────│
|                                                                         |
|  Formula: T_priority = L * I * V                                      │
|                                                                         |
|  Prioritization Order:                                                │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  1. Credential Theft (0.281) - High priority                  │  │
|  │  2. Phishing (0.196) - High priority                          │  │
|  │  3. Ransomware (0.144) - Medium priority                      │  │
|  │  4. DDoS Attack (0.144) - Medium priority                     │  │
|  │  5. Insider Threat (0.088) - Low-Medium priority              │  │
|  │  6. Data Breach (0.057) - Low priority                        │  │
|  │  7. Supply Chain Attack (0.048) - Low priority               │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 6: Threat Monitoring Program

6.1 The Threat Monitoring Framework

A comprehensive threat monitoring program helps financial institutions detect and respond to threats in real-time.

$Threat Monitoring = {Collection, Analysis, Response, Feedback}$

6.2 The Four Stages

Stage	Description	Key Activities
Collection	Gather threat intelligence data	Threat feeds, SIEM logs, OSINT
Analysis	Analyze the data	Threat correlation, pattern recognition
Response	Act on the intelligence	Blocking, alerts, incident response
Feedback	Improve the program	Metrics, lessons learned

6.3 Threat Monitoring Sources

Source	Description	Use Case
Threat Intelligence Feeds	Commercial and open-source feeds	Real-time threat detection
SIEM	Security Information and Event Management	Log analysis and correlation
OSINT	Open Source Intelligence	Public threat information
Dark Web Monitoring	Monitoring underground forums	Early warning of attacks
Industry Sharing	ISACs, FS-ISAC	Peer intelligence sharing
Vendor Intelligence	Security vendor threat reports	Vulnerability intelligence

Threat Monitoring Program (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  Stage 1: Collection                                                 │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Threat Intelligence Feeds                                   │  │
|  │  • SIEM Logs                                                   │  │
|  │  • OSINT                                                       │  │
|  │  • Dark Web Monitoring                                         │  │
|  │  • Industry Sharing (FS-ISAC)                                  │  │
|  │  • Vendor Intelligence                                         │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Stage 2: Analysis                                                   │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Threat Correlation                                          │  │
|  │  • Pattern Recognition                                         │  │
|  │  • Anomaly Detection                                           │  │
|  │  • Risk Scoring                                                │  │
|  │  • TTP Mapping (MITRE ATT&CK)                                  │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Stage 3: Response                                                   │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Alerting                                                    │  │
|  │  • Blocking                                                    │  │
|  │  • Incident Response                                           │  │
|  │  • Threat Hunting                                              │  │
|  │  • Mitigation                                                  │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Stage 4: Feedback                                                   │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Metrics                                                    │  │
|  │  • Lessons Learned                                            │  │
|  │  • Program Improvement                                        │  │
|  │  • Tuning                                                     │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Summary and Bridge to Lesson 2.2

We have now completed the Threat Taxonomy framework. You have learned:

Threat Actor Taxonomy: Nation-state, organized crime, hacktivists, insiders, and script kiddies.
Threat Actor Capability Model: $C = α \cdot R + β \cdot T + γ \cdot K$ .
Threat Actor Risk Score: $R_{a c t or} = C_{a p abi l i t y} \times M_{o t i v a t i o n} \times O_{pp or t u ni t y}$ .
Attack Vector Taxonomy: Social engineering, malware, network attacks, application attacks, physical attacks, and insider threats.
Threat Prioritization Matrix: $T_{p r i or i t y} = L_{ik e l ih oo d} \times I_{m p a c t} \times V_{e l oc i t y}$ .
Threat Monitoring Program: Collection → Analysis → Response → Feedback.

Key Mathematical Results:

$C = 0.4 \cdot R + 0.3 \cdot T + 0.3 \cdot K$ $R^{a c t or} = C^{a p abi l i t y} \times M^{o t i v a t i o n} \times O^{pp or t u ni t y}$ $T^{p r i or i t y} = L^{ik e l ih oo d} \times I^{m p a c t} \times V^{e l oc i t y}$

In Lesson 2.2, we will explore Tactics, Techniques, and Procedures (TTPs) for Financial Sector Attacks, including the MITRE ATT&CK framework, common attack patterns, and defensive measures.

Certificate in Cybersecurity for Financial Institutions LESSON 2.1: The Threat Taxonomy – Understanding the Cyber Threat Landscape for Financial Institutions

Certificate in Cybersecurity for Financial Institutions

Introduction: The Adversarial Ecosystem

Learning Objectives

Part 1: Threat Actor Categorization

1.1 The Threat Actor Taxonomy

1.2 Nation-State Actors

1.3 Organized Crime

1.4 Hacktivists

1.5 Insider Threats

1.6 Script Kiddies

Part 2: The Threat Actor Capability Model

2.1 The Model Definition

2.2 Derivation of the Model

2.3 Capability Scores by Threat Actor Type

2.4 Interpretation of Capability Scores

2.5 Example Calculation

Part 3: The Threat Actor Risk Score

3.1 The Model Definition

3.2 Motivation and Opportunity Scores

3.3 Interpretation of Risk Scores

3.4 Example Calculation

Part 4: Attack Vector Taxonomy

4.1 The Attack Vector Taxonomy Definition

4.2 Social Engineering

4.3 Malware

4.4 Network Attacks

4.5 Application Attacks

4.6 Physical Attacks

4.7 Insider Threats (Expanded)

Part 5: The Threat Prioritization Matrix

5.1 The Model Definition

5.2 Components

5.3 Likelihood Scoring Guide

5.4 Impact Scoring Guide

5.5 Velocity Scoring Guide

5.6 Interpretation

5.7 Example Calculation

Part 6: Threat Monitoring Program

6.1 The Threat Monitoring Framework

6.2 The Four Stages

6.3 Threat Monitoring Sources

Summary and Bridge to Lesson 2.2