Unstructured threats are conducted over short periods of time (lasting at most a few months), do not involve a large number of individuals, have little financial backing, and are accomplished by insiders or outsiders who do not seek collusion with insiders (Chapter 1). Script kiddies, individual criminal hackers, and small groups typically fall into this category.

A structured threat is characterized by a greater amount of planning, longer time to conduct the attack, and more financial backing than in an unstructured attack (Chapter 1). Criminal Organizations are an example of this threat category.

A highly structured threat is characterized by a much longer period of preparation, tremendous financial backing, and a large and organized group of attackers. The threat may include attempts not only to subvert insiders but also to plant individuals inside of a potential target in advance of a planned attack  (Chapter 1). Viruses are typically easily detected (consider modern anti-virus software) and generally not the tool of choice for highly structured attacks (Chapter 1). Rather, highly structured attackers are typically state actors or advanced persistent threat actors who engage in information warfare and attacks on critical infrastructure (among other activities). The cyberweapons family of Flame, Gauss, Stuxnet and DuQu are examples of malicious code likely created by highly structured threat actors. In this case, the U.S. and Israel are suspected of developing these cyberweapons.

Any of these threats can pose a national security risk. (Even a so called script kiddie can launch an attack on a critical infrastructure as exemplified in the examples of threats covered in Chapter 1.). Clearly, the government needs a way to defend against and deter attacks.

For this discussion, answer the following based on Chesneyàdiscussion on pages 27 and 28, I B. Encouraging Potential Victims to Defend Better. (Version 3.0).

What does the text say about minimizing unauthorized (and excessive) access, assuming a threat from any of the three above?

What does the text say about improving defense assuming the victim is a likely target of one of the threats above? Answer based on a single threat above and be sure to mention which threat you are discussing.

What incentives have been (or could be) brought to bear to incentivize assuming the victim is a likely target of one of the threats above? Answer based on a single threat above and be sure to mention which threat you are discussing. 

LINK: https://ssrn.com/abstract=3547103