A shrug is not a threat model
"Hackers" is not a threat model. A ransomware crew going after Australian healthcare, a state-backed group interested in mining and energy, and a teenager selling stolen logins all behave differently and need different defences. A profile answers three questions: who is likely to target us, what do they want, and how do they usually operate? That lets you prioritise. Without one, you are defending against everything, which in practice means nothing in particular.
The frames for this lesson are MITRE ATT&CK (Groups and Navigator), the Admiralty Code for grading sources, and the Diamond Model for a single intrusion. The product is one or two pages someone can use.
Types of actor, briefly
- Cybercriminals: money. Ransomware, business-email compromise, credential theft for resale.
- State-sponsored: espionage, pre-positioning, occasionally disruption.
- Hacktivists: publicity and causes. Defacements, denial of service, leaks.
- Insiders: access they already have, with mixed motives.
"Hackers" is a shrug with a budget attached. A profile is what you write when the shrug stops being good enough.