3 ms·

I believe the term "nation state actor" is a term that means "country" but with the bonus of connoting that the writer is an armchair infosec wizard. This specu

by Y_Y 3y ago

I believe the term "nation state actor" is a term that means "country" but with the bonus of connoting that the writer is an armchair infosec wizard. This speculation is not valuable without adding information, otherwise it's just McCarthyist bluster.

hyperhopper 3y ago
Whales is a country but it is not a nation-state and probably does not have its own APT.
- Y_Y 3y ago
  I'll bite. Wales is a country only in a "traditional" sense, since it does not currently hold the type of sovereignty we require of "countries" in the usual sense. As Voltaire said, "This body which called itself and which still calls itself the Holy Roman Empire was in no way holy, nor Roman, nor an empire.". Wales, when independent, could reasonably be described as a nation state, being roughly associated with the Welsh people and their culture, language, history etc. But most countries are not nation states! The USA, Russia, and China for instance are explicitly plurinational. If you think "nation" and "state" are synonyms (along with "country") then it's redundant to use both. If you think that "state" alone might lead someone to think of Alabama or Minas Gerais then say "nation". If you think "nation" will make people think of Cherokee, then say "country" or "sovereign state". "Nation state" has a specific and well-established meaning, misusing it is like misusing any other jargon and just comes across as a failed attempt to seem part of the ingroup and hence authoritative. (yes, apparently I will die on this hill)
  - stavros 3y ago
    Are there any actual nation states? Even small countries, like Greece, contain other nationalities.
    - Y_Y 3y ago
      Greece is certainly a nation state, being primarily occupied by "Greeks" (referring the the nebulous concept of a national identity). It doesn't matter if some French or Turks live there. A country that strictly limited residency by ethnic identity might be called an "ethnostate" and indeed it's hard to find a pure example of one of those.
MattPalmer1086 3y ago
Nation state actor is a standard info sec term. Using it does not imply any kind of wizardry. Edit: most threat actors do not have the patience or the motive to behave in this way. It is reasonable to suppose that this is a nation state actor.
- XorNot 3y ago
  There are organised crime networks which buy 0-days to run ransomware, and actively target companies to do it. Why couldn't this be an attempt at finding or selling exploit access on the black market? The problem here is no one is looking properly at the scope. It's more then trivial so everyone is leaping for "nation-state" as though that's the only threat actor with motivation and patience.
  - MattPalmer1086 3y ago
    Granted, other threat actors remain a possibility, there is no proof. It looks like the sort of thing nation states would do and develop. It could be some other group hoping to make money as you say. Whoever they are, they seem to have good opsec, over multiple years.
- HelloNurse 3y ago
  It's also a term that implies the competent, official hacking departments or espionage agencies of that country, rather than government-supported amateurs (e.g. an untrained policeman) or generic people from that country.

by Y_Y 3y ago

hyperhopper 3y ago

Whales is a country but it is not a nation-state and probably does not have its own APT.

Y_Y 3y ago
I'll bite. Wales is a country only in a "traditional" sense, since it does not currently hold the type of sovereignty we require of "countries" in the usual sense. As Voltaire said, "This body which called itself and which still calls itself the Holy Roman Empire was in no way holy, nor Roman, nor an empire.". Wales, when independent, could reasonably be described as a nation state, being roughly associated with the Welsh people and their culture, language, history etc. But most countries are not nation states! The USA, Russia, and China for instance are explicitly plurinational. If you think "nation" and "state" are synonyms (along with "country") then it's redundant to use both. If you think that "state" alone might lead someone to think of Alabama or Minas Gerais then say "nation". If you think "nation" will make people think of Cherokee, then say "country" or "sovereign state". "Nation state" has a specific and well-established meaning, misusing it is like misusing any other jargon and just comes across as a failed attempt to seem part of the ingroup and hence authoritative. (yes, apparently I will die on this hill)
- stavros 3y ago
  Are there any actual nation states? Even small countries, like Greece, contain other nationalities.
  - Y_Y 3y ago
    Greece is certainly a nation state, being primarily occupied by "Greeks" (referring the the nebulous concept of a national identity). It doesn't matter if some French or Turks live there. A country that strictly limited residency by ethnic identity might be called an "ethnostate" and indeed it's hard to find a pure example of one of those.

MattPalmer1086 3y ago

Nation state actor is a standard info sec term. Using it does not imply any kind of wizardry. Edit: most threat actors do not have the patience or the motive to behave in this way. It is reasonable to suppose that this is a nation state actor.

XorNot 3y ago
There are organised crime networks which buy 0-days to run ransomware, and actively target companies to do it. Why couldn't this be an attempt at finding or selling exploit access on the black market? The problem here is no one is looking properly at the scope. It's more then trivial so everyone is leaping for "nation-state" as though that's the only threat actor with motivation and patience.
- MattPalmer1086 3y ago
  Granted, other threat actors remain a possibility, there is no proof. It looks like the sort of thing nation states would do and develop. It could be some other group hoping to make money as you say. Whoever they are, they seem to have good opsec, over multiple years.
HelloNurse 3y ago
It's also a term that implies the competent, official hacking departments or espionage agencies of that country, rather than government-supported amateurs (e.g. an untrained policeman) or generic people from that country.