Cyber security professionals in Kenya face a complex landscape of threats that originate from diverse actors, both within and outside their organisations. Effectively managing security operations requires a clear understanding of who these threat actors are, their motivations, and how they operate. This chapter focuses on identifying potential threat actors, an essential step in assessing threat risk factors that informs the design and implementation of robust cyber defence strategies. By recognising the full spectrum of internal and external sources of threats, Kenyan organisations such as county government offices, banks, and hospitals can tailor their security measures to the real risks they face.

2.1 Identify potential threat actors, including internal and external sources

Understanding who the threat actors are is fundamental to anticipating and mitigating cyber risks. Threat actors may range from careless employees to highly organised external groups, each presenting unique challenges. Kenyan organisations like KRA and large retail businesses must map these actors carefully to prioritise security controls and incident response plans effectively.

2.1.1 Internal Threat Actors: Types and Motivations

Internal threat actors are individuals within an organisation who can intentionally or unintentionally cause harm to information systems. They are particularly dangerous because they often have legitimate access and knowledge of the organisation’s security measures.

Types of Internal Threat Actors

• Disgruntled Employees: Employees who feel unfairly treated or overlooked may intentionally sabotage systems or leak sensitive data. For instance, a dismissed IT staff member at a county government office might delete critical files as retaliation.
• Negligent Staff: Employees who lack security awareness can inadvertently introduce vulnerabilities by clicking phishing links or using weak passwords. Hospital staff unfamiliar with cyber hygiene protocols may expose patient data.
• Privileged Insiders: Administrators or senior staff with elevated access rights pose significant risks if their credentials are compromised or misused, such as a SACCO system administrator abusing access to customer accounts.
• Contractors and Vendors: Third-party workers with limited but necessary access can become threat vectors, especially if they do not follow strict security policies, as seen in some retail chains outsourcing IT support.
• Infiltrators: Malicious insiders planted by competitors or criminal groups to steal intellectual property or sabotage operations, a risk in universities conducting sensitive research.

Motivations Behind Internal Threats

• Financial Gain: Employees may steal data to sell or use for fraud, such as leaking confidential loan information from a bank.
• Personal Grievances: Revenge against supervisors or the organisation can motivate sabotage.
• Ideological Beliefs: Staff sympathetic to causes opposing the organisation’s mission may leak sensitive information.
• Coercion: Threat actors may be blackmailed into assisting external attackers.
• Carelessness: Lack of training or awareness leads to accidental breaches without malicious intent.

2.1.2 External Threat Actors: Categories and Objectives

External threat actors operate outside the organisation’s perimeter and use various tactics to breach security. Their sophistication and resources vary widely, demanding tailored defensive approaches.

Categories of External Threat Actors

• Cybercriminals: Organised groups or individuals motivated by financial gain using malware, ransomware, or phishing attacks. For example, a hacking group targeting a Nairobi-based insurance company to extract ransom.
• Hacktivists: Activists promoting political or social agendas through cyber attacks, such as defacing government websites in protest of policy decisions.
• State-Sponsored Actors: Government-backed groups conducting espionage or sabotage targeting critical infrastructure like national utilities or financial institutions.
• Script Kiddies: Amateur hackers using pre-made tools to exploit vulnerabilities, often causing random disruptions to small businesses or schools.
• Competitors: Businesses engaging in industrial espionage by stealing trade secrets or disrupting operations.

Objectives of External Threat Actors

• Financial Theft: Stealing funds directly or through fraud schemes.
• Data Theft: Extracting sensitive personal or corporate information for resale or leverage.
• Disruption: Causing downtime or denial of service to damage reputation or operations.
• Espionage: Gaining competitive or strategic advantage by accessing confidential data.
• Ideological Impact: Advancing causes by disrupting or exposing organisations.

2.1.3 Distinguishing Insider from Outsider Threats: Characteristics and Detection

Differentiating between internal and external threats is crucial for effective monitoring and response. Each type exhibits distinct behavioural patterns and indicators.

Characteristics of Insider Threats

• Access Privileges: Insiders already have authorised access, making unusual behaviour harder to detect.
• Anomalous Activity: Uncharacteristic access times or data downloads can signal insider threats.
• Social Engineering: Insiders may be manipulated by outsiders to act maliciously.
• Data Misuse: Copying or transmitting sensitive data without approval.
• Policy Violations: Frequent disregard for security protocols or use of unauthorised tools.

Characteristics of External Threats

• Access Attempts: Repeated failed login attempts or scanning for vulnerabilities.
• IP Anomalies: Connections from unusual geographic locations or known malicious IPs.
• Malware Delivery: Use of phishing emails or infected websites to gain entry.
• Command and Control Signals: Communication with external servers for remote control.
• Exploitation of Public-Facing Systems: Attacks targeting web servers, VPNs, or email gateways.

Detection of Insider and Outsider Threats

Detecting insider and outsider threats requires tailored approaches due to their differing behaviors and access levels. For insider threats, organizations such as the Kenya Revenue Authority (KRA) often deploy user behavior analytics to monitor for anomalies in access patterns, such as unusual login times or excessive file downloads. Regular audits and privileged access reviews help identify misuse of credentials. For outsider threats, detection relies on monitoring perimeter defenses for signs of intrusion, such as repeated failed login attempts from foreign IP addresses, or alerts from intrusion detection systems triggered by malware signatures. Kenyan banks commonly use threat intelligence feeds and SIEM (Security Information and Event Management) tools to correlate suspicious activity with known external attack campaigns. Both types of detection benefit from employee awareness training and collaboration with national Computer Incident Response Teams (CIRTs) to share threat indicators.

Detection of Insider Threats

Detecting insider threats requires specialized monitoring and analysis due to the legitimate access insiders possess. Kenyan organizations such as the Kenya Revenue Authority (KRA) often use user behavior analytics to identify anomalies, such as staff accessing sensitive tax records outside normal hours or downloading unusually large volumes of data. Regular privileged access reviews and internal audits help uncover misuse of credentials or policy violations. Employee awareness training is also crucial, as it empowers staff to recognize and report suspicious activities by colleagues, reducing the risk of undetected insider incidents.

Detection of Outsider Threats

Outsider threats are typically detected through perimeter security measures and external monitoring tools. For example, Kenyan banks deploy intrusion detection systems (IDS) to flag repeated failed login attempts from foreign IP addresses or malware signatures associated with known attack campaigns. Threat intelligence feeds and Security Information and Event Management (SIEM) platforms help correlate suspicious activity with global threat trends. Collaboration with national Computer Incident Response Teams (CIRTs) enables organizations to receive timely alerts about new external threats targeting the financial sector, enhancing their ability to respond quickly to emerging risks.

2.1.4 Emerging Threat Actors and Trends in Kenya’s Cyber Landscape

The threat environment is dynamic, with new actors and tactics evolving continually. Kenyan cyber security professionals must stay informed to adapt their defence strategies.

Emerging Threat Actors

• Insider Threats with Remote Work: The rise of remote work in Kenyan banks and universities increases insider risk as employees access systems from less secure environments.
• Cyber Terrorists: Groups using cyber means to support violent extremism, targeting government or critical infrastructure.
• Supply Chain Attackers: Exploiting weaknesses in third-party software or hardware suppliers used by Kenyan enterprises.
• Social Media Manipulators: Actors using fake accounts to influence public opinion or spread misinformation.
• Automated Bots: Used to launch large-scale attacks like credential stuffing against online platforms.

Trends in Kenyan Cyber Threats

• Increase in Ransomware Attacks: Several hospitals and county governments have experienced ransomware locking critical systems.
• Phishing Campaigns Targeting Mobile Money Users: With widespread mobile money use, attackers exploit users’ lack of awareness.
• Targeting of SMEs: Small and medium enterprises are increasingly targeted due to weaker security.
• Growth of Cybercrime-as-a-Service: Professional cybercriminals offering tools and services to less skilled actors.
• Regulatory Pressure: Organisations face stricter compliance requirements, increasing the need for comprehensive threat actor identification.

Chapter Summary

This chapter focused on assessing threat risk factors by first identifying potential threat actors, recognizing both internal sources such as employees or contractors and external sources like cybercriminals or competitors. It then explored methods to analyze the likelihood and impact of these threats through qualitative approaches, which rely on expert judgment and descriptive assessments, and quantitative techniques that use numerical data to evaluate risk levels. The integration of threat intelligence was highlighted as a critical tool to improve the accuracy of risk assessments by providing timely and relevant information about emerging threats. Understanding the behavior and motivations of threat actors allows security managers to prioritize risks effectively. Applying both qualitative and quantitative analyses ensures a comprehensive evaluation of potential security incidents. Finally, leveraging threat intelligence supports proactive decision-making and strengthens overall security operations management.