SSCP Systems Security Certified PractitionerRisk Identification, Monitoring, and AnalysisMedium
A security analyst is investigating a series of suspicious activities involving several user accounts. They notice that the affected accounts exhibit similar patterns: unusual login times, access to sensitive data they normally don't use, and attempts to connect to internal systems from unfamiliar IP addresses. The analyst suspects a coordinated attack by a specific threat actor group. Which concept is the analyst primarily trying to identify to understand the adversary's actions?
- ARisk Appetite
- BVulnerability Management
- CIndicators of Compromise (IoCs)
- DTactics, Techniques, and Procedures (TTPs)
Show answer & explanationAnswer & explanation
Correct answer: D. Tactics, Techniques, and Procedures (TTPs)
Tactics, Techniques, and Procedures (TTPs) describe the 'how' an adversary operates. The scenario describes patterns of behavior (unusual login times, access to specific data, connection attempts from unfamiliar IPs) that suggest a specific methodology, which aligns directly with identifying TTPs to understand a threat actor's actions.
Why the other options are wrong
- A. Risk appetite is an organization's willingness to accept risk, unrelated to adversary actions.
- B. Vulnerability management is about patching weaknesses, not identifying adversary behavior.
- C. IoCs are atomic indicators (IPs, hashes), but TTPs describe the broader behavioral patterns.
Tactics, Techniques, and Procedures (TTPs)
The 'how' an adversary operates, encompassing their strategic goals (tactics), specific methods (techniques), and repeatable actions (procedures).
- Tactics: high-level goals (e.g., Initial Access).
- Techniques: specific ways to achieve tactics (e.g., Spearphishing).
- Procedures: detailed steps for techniques (e.g., using a specific phishing template).
- Helps predict and defend against future attacks.
Memory trick: TTPs: Tactics are Goals, Techniques are Methods, Procedures are Steps.