Outdated Assumptions:

A Threapost editorial by Gunter Ollman

[Image 1]

The simplistic view of the threat is that the entity conducting the attack contains, manages and orchestrates all the components necessary to perform the attack. Or, in a simple Venn diagram format, the delivery, malware and fraud components are defined as being core components of the “attacker”.

The reality of the situation is very different…

[Image 2]

In today’s federated cybercrime ecosystem, the “attacker” selects and manages relationships with multiple external entities that specialize in the delivery of specific components of an attack. Each specialization is independent of the attacker – and will more than likely be servicing multiple “attackers” simultaneously. More importantly, most of the service providers are so removed from the actual attack (and attacker) that the “victim” is unimportant and irrelevant to their contribution.