After a noisy weekend ransomware hit on a library public PC, staff start calling every attacker an "APT." How should the civic SOC correct that mix-up?
Select an answer to reveal the explanation.
Short Explanation
APT is a reserved parking spot, not the name of every dented bumper. A smash-and-grab on a library public PC is still a threat actor — just not an advanced persistent one. Keep "APT" for capable, long-haul adversaries and use the generic words the rest of the time.
Full Explanation
After a noisy weekend ransomware hit on a library public PC, staff start calling every attacker an "APT." The civic SOC should reserve APT for capable, persistent adversaries and use threat actor or adversary as the general terms. Civic framing matters because library and other municipal incidents vary widely in sophistication; inflating every smash-and-grab into APT confuses prioritization, funding narratives, and Enterprise Security case language.
Labeling every civic incident as APT so leadership funds the SOC fails by concept: funding needs honest severity and scope, and misusing APT erodes credibility when true persistent campaigns appear. Calling the library incident zero trust because the PC was on a guest VLAN fails by concept: zero trust is a control model, not a name for the attacker or the ransomware event. Treating the ransomware affiliate as command-and-control until a hash is published fails by concept: C2 is a channel or infrastructure stage, not a synonym for the affiliate or a placeholder until IoCs arrive.
Exam caveat: SPLK-5001 terminology discipline expects APT as a reserved class—use threat actor/adversary generically unless sophistication and persistence are evidenced.
Operational check: Correct ticket and chat language on the library ransomware case to "threat actor" or "ransomware affiliate," reserve APT for long-haul capable campaigns, and brief leadership with accurate labels rather than inflated ones.