Certificate Topics — The Cybersecurity Threat Landscape (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Law Enforcement Class: Certificate Topics — Year 1 (Foundations) · Home: Schools — Law Enforcement track Certificate behind this topic: "The Cybersecurity Threat Landscape" — LinkedIn Learning, earned by Minister Destiny Marie Morgan (May 28, 2025) Presented by: Minister Destiny Marie Morgan, Muslim Ordained Minister

This lesson is educational information from Minister Destiny Testimony Schools. It teaches the public body of knowledge in this subject — the same ground Minister Destiny studied for her certificate — in this school's own words. It is not the original course, it does not award the original credential, and it is not legal or medical advice. If you are in danger right now, call 911. It is community-designed training, not agency policy, and school completion is a school achievement only — not a law-enforcement rank, title, or credential.

Before you start

• This school never asks your name. Your progress is saved only in your own browser on this device — the school collects and keeps nothing. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
• Headlines about breaches can feel like weather — constant, frightening, and impossible to act on. This unit turns that noise into a map: who the attackers are, what they want, and how professionals keep the picture current.
• It builds directly on Cybersecurity Foundations: the same threats, vulnerabilities, and risks, now seen at the scale of organizations and nations.

The lesson

Part 1. Reading the Landscape — What “Threat Landscape” Means

The threat landscape is the whole picture of who might attack, what they are capable of, what they want, and which weaknesses they are currently exploiting — for a country, a sector, or one organization. It is not a list of scary stories. It is an assessment that changes as attackers change tools, as defenders close holes, and as world events shift motives. A hospital, a water utility, and a campaign office face overlapping but different landscapes, because their assets and adversaries differ.

Professionals describe an actor with four questions. Who are they? Why — what outcome pays them? How capable are they, in money, skill, and patience? And what are they doing right now, according to current reporting? Keep those four questions in hand and most threat reporting becomes readable. Drop them, and every headline sounds identical: “hackers attack.” The landscape idea exists precisely to replace that blur with distinctions you can plan around.

Part 2. Threat Actors and Their Motives

Cybercriminal groups are the most common actors and are motivated by money: ransomware payments, stolen payment cards, fraud, and selling access to other criminals. Many operate like businesses, with affiliates, help desks for victims, and revenue sharing. State and state-sponsored actors pursue espionage, strategic advantage, and sometimes preparation for future disruption; they are typically well funded, patient, and interested in governments, defense, research, and critical infrastructure. Insiders — employees, contractors, or partners — misuse access they already have, for money, grievance, or coercion; their advantage is that they start inside the perimeter. Hacktivists act for a cause or for attention, favouring website defacement, leaks, and disruption over quiet theft. Individuals and small crews fill the gaps between these categories, and categories overlap: a criminal group may sell access to a state actor, and a state operation may use criminal tooling as cover.

Motive predicts behavior. A criminal group wants payment and will negotiate and set deadlines. An espionage actor wants to stay invisible for months and may never announce itself. An insider already knows where the valuable records sit. Planning against “hackers” in general wastes effort; planning against the actors who plausibly want your assets focuses it.

Part 3. The Ransomware Economy

Ransomware deserves its own part because it reshaped the landscape for schools, hospitals, cities, and small businesses. In a typical modern incident, attackers first gain access — often through phishing, stolen credentials, or an unpatched internet-facing system — then move quietly, steal copies of valuable data, and only then encrypt systems and demand payment. The theft matters: even an organization with good backups faces a leak threat, sometimes called double extortion.

Around the operators sits an economy. Some criminals specialise in gaining initial access and selling it. Others build the ransomware and rent it to affiliates who run the attacks and split the proceeds. Cryptocurrency moves much of the money, and negotiators, launderers, and compromised infrastructure fill supporting roles. Understanding the economy explains defender strategy: disrupting access sellers, payment channels, and infrastructure raises attackers' costs across many incidents at once. It also explains why official guidance stresses prevention and reporting: every paid ransom funds the next victim's attack, and agencies such as CISA publish free ransomware guidance — including the joint StopRansomware resources — so organizations can prepare before they are the headline.

Part 4. Supply-Chain and Third-Party Risk

Organizations do not run only their own software. They rely on vendors, updates, managed service providers, libraries, and cloud platforms — a supply chain of trust. Attackers exploit that trust: compromise one widely used product or provider, and you reach hundreds of downstream victims through a door those victims opened on purpose. Well-documented public incidents have spread through tainted software updates and through remote-management tools, which is why a vendor's security becomes part of your own risk the moment you connect them.

The plain-language lesson is not “trust no one.” It is: know who your critical suppliers are, ask how they patch, authenticate, and notify customers of incidents, limit what each vendor can reach, and keep an exit and recovery plan for the day a trusted tool becomes the problem. Third-party risk also applies at home in miniature — a compromised app or browser extension arrives carrying permissions you granted. In both cases the pattern is identical: the attack rode in on trust, so trust has to be specific, limited, and reviewed, not automatic and forever.

Part 5. Insider Threats — the Door Already Open

An insider threat is harm from someone with authorised access: an employee selling data, a contractor copying records before leaving, a coerced staff member, or — far more often — a careless worker who emails the wrong file or approves a fraudulent request. Malicious insiders are the minority; negligent insiders cause the steady drip of real-world loss. That distinction should shape the response: clear rules, least-privilege access, logging that is known and fair, separation of duties for sensitive actions, and off-boarding that promptly removes accounts when people leave.

For law-enforcement learners, insider risk carries a particular weight. Records systems hold information that can endanger witnesses, victims, and investigations if it leaves through an authorised account. Agencies therefore treat unusual access — bulk lookups, after-hours curiosity browsing in systems like criminal-justice databases — as a serious integrity issue, not a paperwork slip. The healthy culture is not suspicion of everyone; it is the shared understanding that access is a trust, that the audit trail protects honest staff as much as it catches misuse, and that anyone pressured or coerced into misusing access should have a safe, known route to ask for help.

Part 6. How Threat Reporting Works — and How to Read a Breach Headline

Nobody watches the whole landscape alone, so defenders share. In the United States, CISA (the Cybersecurity and Infrastructure Security Agency) publishes advisories — plain announcements describing a vulnerability, an active campaign, or required mitigations, often jointly with the FBI, NSA, and international partners. CISA also maintains the Known Exploited Vulnerabilities catalogue, a public list of flaws known to be used in real attacks, which tells defenders what to patch first. Vendors, researchers, and sector information-sharing groups add their own reporting. A good advisory answers Part 1's questions: who is acting, what they exploit, who is at risk, and what to do by when.

Now read a breach headline critically. Ask: What actually happened — theft, encryption, defacement, or “access” with effects still unknown? What data, whose, and how much — and is that confirmed or feared? How did they get in, if reporting says? What is the source — the victim, a regulator filing, a researcher, or the attackers themselves, who may exaggerate? And what does it mean for me: am I a customer who should change a password and watch statements, an organization running the affected product who should patch today, or a bystander who should simply file the lesson? That five-question habit turns frightening news into proportionate action — which is the whole point of studying the landscape.

Words to know — The Cybersecurity Threat Landscape

• Threat actor — a person or group carrying out, or capable of carrying out, harmful cyber activity.
• Threat landscape — the current overall picture of actors, motives, capabilities, and methods affecting a place, sector, or organization.
• Ransomware — malicious software that encrypts systems or data and demands payment; modern groups often also steal data to add leak pressure.
• Double extortion — demanding payment both to unlock encrypted data and to not publish stolen data.
• Supply-chain attack — compromising a trusted vendor, update, or component to reach many downstream victims.
• Insider threat — harm from someone with authorised access, whether malicious, coerced, or careless.
• Espionage — quiet theft of information for strategic advantage, usually aiming to stay undetected.
• Hacktivist — an actor motivated by a cause or publicity, typically favouring disruption and leaks.
• Advisory — an official notice describing a threat or vulnerability and the actions defenders should take.
• Critical infrastructure — systems such as energy, water, health, transport, and communications whose disruption harms public safety and daily life.

Myths vs facts — The Cybersecurity Threat Landscape

• Myth: All hackers are lone geniuses in hoodies. Fact: The landscape is mostly organized — criminal businesses, state programs, affiliates, and access sellers with specialised roles.
• Myth: If we have good backups, ransomware cannot hurt us. Fact: Backups defeat the lock, not the leak. Stolen-data threats and downtime still cause serious harm.
• Myth: Insider threat means hunting for villains on staff. Fact: Most insider incidents are careless, not malicious. Clear rules, least privilege, and prompt off-boarding prevent more loss than suspicion does.
• Myth: A big-name vendor's product is automatically safe. Fact: Supply-chain incidents spread precisely through trusted products. Vendor trust must be specific, limited, and reviewed.
• Myth: Every breach headline means the worst case happened. Fact: Early reporting mixes confirmed facts with fears and attacker claims. Critical reading separates what is known from what is guessed.

Think it through — The Cybersecurity Threat Landscape

A regional news site reports: “Hackers breach county vendor; resident data may be exposed.” The vendor runs the payment portal for several towns. Your office uses the same portal for fee payments, and a resident calls, frightened, asking if her bank account is “gone.”

Walk it through: (1) Use Part 6's questions first: the confirmed fact is a breach at the vendor; what data and how much are still “may,” not established. (2) Place the actor provisionally using Part 2: a payment portal suggests a money-motivated criminal group, which predicts fraud and possible extortion rather than espionage. (3) Apply Part 4: this is third-party risk arriving exactly as described — your office's exposure runs through a trusted supplier, so the right moves are asking the vendor, in writing, what was affected and what they have done, and checking what access the portal connection has. (4) Answer the resident proportionately: her account is not “gone”; she should watch statements, keep alerts on, change the portal password, and use official channels — calm, concrete steps instead of panic or false reassurance.

Try this — The Cybersecurity Threat Landscape

• ☐ Find CISA's advisory page at cisa.gov and read one current advisory, answering: who, why, how, and what to do
• ☐ Take one recent breach headline and write the five critical-reading answers from Part 6 in your own words
• ☐ List three vendors or services your household or workplace depends on, and one security question you would ask each
• ☐ Write, for one system you use, what a money-motivated attacker would want from it versus what an espionage actor would want
• ☐ Check how accounts are removed where you work or volunteer when someone leaves — and note any gap you find

Resources to keep — The Cybersecurity Threat Landscape

• Cybersecurity and Infrastructure Security Agency (CISA) — cisa.gov — advisories, the Known Exploited Vulnerabilities catalogue, and StopRansomware guidance.
• FBI Internet Crime Complaint Center (IC3) — ic3.gov — where internet crime is reported in the U.S., and publisher of annual internet-crime reports.
• National Institute of Standards and Technology (NIST) — nist.gov — risk and incident guidance that underpins threat reporting.
• National Cybersecurity Alliance — staysafeonline.org — plain-language explainers on current scams and ransomware for non-specialists.

What you earned / what's next — The Cybersecurity Threat Landscape

✅ The Cybersecurity Threat Landscape complete (quiz score 80% or higher): You can tell the major threat actors apart by motive, explain the ransomware economy and supply-chain risk, and read a breach headline with calm, critical questions.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — The Cybersecurity Threat Landscape

This certificate is presented by Muslim Ordained Minister Destiny Marie Morgan

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. You can now look at frightening headlines and see a map instead of a storm — who, why, and what to do next. That calm is a form of protection for everyone around you. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or the original course credential. School rank and completion are school achievements only — not a law-enforcement rank, title, or credential.

What's next: Return to the Certificate Topics for your next Year 1 Foundations topic.

Sources

• Cybersecurity advisories, Known Exploited Vulnerabilities catalogue, and StopRansomware Guide — Cybersecurity and Infrastructure Security Agency (cisa.gov) — actor reporting, ransomware economy, and advisory practice.
• Internet Crime Reports — FBI Internet Crime Complaint Center (ic3.gov) — criminal-actor and loss reporting used for the criminal landscape.
• NIST risk-management and incident-response publications — National Institute of Standards and Technology (nist.gov) — landscape and risk vocabulary.
• National Cybersecurity Alliance resources — National Cybersecurity Alliance (staysafeonline.org) — plain-language threat explainers.

Your Progress — On Your Device Only — The Cybersecurity Threat Landscape

• Learning outcomes: On completing this unit, the student can:
• define the threat landscape and assess an actor by identity, motive, capability, and current activity
• compare criminal, state, insider, and hacktivist actors and predict behavior from motive
• explain how the ransomware economy works, including affiliates, access sellers, and double extortion
• describe supply-chain and third-party risk and the questions to ask a critical vendor
• distinguish malicious from careless insider threats and name proportionate controls for each
• read a breach headline critically and find and use a CISA advisory
• Study time: Approximately 1.5 hours — an estimate covering reading, activities, and the test. Students move at their own pace.
• Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved only in your own browser on this device, and retakes are allowed.
• Level: Certificate Topics — Year 1 (Foundations) · Law Enforcement school · working rank on completion path: Freshman → Sophomore.
• Version: Version 1.0 — October 2026.

Minister Destiny Testimony Schools — Law Enforcement. Educational information only. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).