# Cyber Threat Actors for the Factory of the Future
## 3 Classifying Cyber Threat Actors (CTAs)
### Nation-State Actors  
Nation-states can be considered as active threat actors in cyber security [5]. Their objectives are more varied than that of regular cyber criminals, typically aiming to gather intelligence or support national interests (e.g., nuclear non-proliferation, financing, technology transfer and dissident control). The cyberspace toolset has enhanced the abilities that nation-states have already previously held, especially in espionage.  
For the last 20 years, a lot of reporting has been published on cyber operations aimed at technology proliferation. In this, state actors have been tied to campaigns using industrial espionage to elevate the capabilities of domestic companies, typically tied to military technologies. China, for instance, has been especially effective bridging the technology gap using various methods.  
Strategic sabotage is one of the techniques that nation-state actors use. Maybe the best known suspected nation-state cyber action was the Stuxnet incident [32]. In this incident centrifuges used by the Iranian nuclear program were sabotaged by infecting their air-gapped control systems with an advanced malware causing them to deteriorate. While the target was a state-run program, the attack path went through a commercial actor's control software.  
Some states have been linked to cyber activities which indicate usage of cyber operations to enable other state activity limited by international sanctions. The SWIFT banking system attacks have been linked to nation-states using it as a way to finance their operations under strict economic sanctions [33]. These operations can be thought of as infrastructure enabling other activities. In smaller scale, nation-state actors using cyber operations for their aims may also need botnet infrastructure to maintain ability to use and mask cyber operations.  
Ukrainian and Georgian critical infrastructures have both been subject to cyber operations seeming to originate from Russia. These cyber operations have similar aims as conventional military attacks on infrastructure, but without the need of a full blown war, with international condemnation and sanctions following. Cyber war operations however can be hard to attribute to specific actors, and there is always plausible deniability [34]. Even when attribution is reliable, there are a lot of legal gray areas to hide [35].  
Nation-states target not only other nations, but also organizations (e.g., companies and non-governmental organizations (NGOs)), and they also practice mass surveillance of individuals. The stated aims are typically counterterrorism work and internal security. One more recent aspect for state actors is political campaign interference [36].  
There are at least two major paths to national cyber operation capability. Some nations use well-funded intelligence agencies, while others use cyber criminal organizations. Such state sponsored groups are typically easier to identify, but have had a higher degree of deniability by the state [24].  
It should be noted that, for most organizations, propaganda operations by nation-states (e.g., fake news, troll farms, social media manipulations) are not a valid cyber threat. Moreover, operating in certain nations may force the organization to adhere to that country's cyber laws (e.g., national firewalls, DNS blacklisting, legal backdoors to systems or mass surveillance of people). These are also out of the scope of cyber security policies and our paper.  
Nation-states activities present a large part of documented cyber incidents in the wild. It represents the second largest source of measured cyber incidents [5]. In the analysis 19 of the 22 organizations identified nation-state actors as a CTA (Table 1).