Inside the mind of a hacker

What kind of person becomes a hacker, and what drives them to attack a network? If we believe the Hollywood stereotype, the average hacker is a bored teenager in a basement, looking for ingenious ways to remotely bypass system security – either for the thrill of it, or to show off.

But while bored teen hackers certainly exist, they’re far from the biggest risk to CSPs and their customers, says Holly Grace Williams, managing director of cybersecurity consultancy Secarma.

“One of the biggest problems with security is that organizations think that all hackers are motivated in the same way. That they all have the same backgrounds and reasons for doing what they’re doing,” she says. “And of course, that’s not true at all.”

From foreign agents to lone opportunists - why hackers hack

It’s a wide remit because the techniques used by hackers are as broad as their motivations. Williams explains that as well as bored teenagers and foreign intelligence agents, there are politically-motivated hackers “who want to disrupt systems if they disagree with the owners of those systems or their recent actions. Those tend to be sabotage attacks, like taking down a website, or destroying data.”

Then there’s an array of financially-motivated attackers, whose aims could be anything from getting rich quick to funding organized crime or terrorism. They’ll use techniques ranging from deploying ransomware, to co-opting IoT-connected devices into crypto-coin mining botnets, to bribing company employees to carry out certain actions. Many hacks involve social engineering, and this is a risk that’s often overlooked. “Paying members of staff [to carry out an action] is a threat that a lot of organizations don’t consider,” Williams says.

New technologies present new attack opportunities

At the same time, she says, advances in technology do create new opportunities for hackers. The Internet of Things is a prime example, simply because it vastly increases the number of access points to a network. “As we connect more and more devices to the internet, the threat [from hackers] could increase just because the attack surface has increased - even though the motivations remain the same.”

And while people are used to installing anti-malware software on their laptops and smartphones, they don’t always think the same way about a home automation system, a security camera or an interconnected fridge. That’s a risk when connected devices store personal data or have access to payment gateways. Williams says that if a threat actor gained access to a smart fridge: “There's a range of attacks they could do. They could deny service, which would stop it from operating correctly. They could remotely break it. They could purchase something unexpected, or something not for you.”

Slicing is a way of optimizing systems for speed and latency, but in some cases, the network can also be partitioned to allow devices to be isolated from one another. That brings security benefits, as Williams explains: “If we can prevent attackers from moving from one area of the network to another, then that can increase security by making the propagation across the system more difficult. A software-defined network can allow us to be more granular about how the system operates."

Segmenting the network should also help with traceability, she adds, saying that as more connected devices are assigned individual IP addresses, it can be harder for operators to trace the origin of hacks like DDoS attacks.

Advice to CSPs - Put yourself in a hacker’s shoes, then design layers of defense

Williams advises CSPs to take an outside-in approach when designing network defenses. “Don’t just consider hackers as a single entity, because they’re not” she says. “Look at the threat modeling side of things. Ask yourself why a hacker might target your organization, and what they have in terms of capability. Then, what’s the best way to prevent those attacks from taking place?”