>> Hello and welcome to the second lesson
from the module, analysis and production.
In this lesson, we will discover
together one technique of analysis,
which is analysis of competing hypotheses.
Analysis of competing hypotheses is also
called ACH and in this video,
we'll mostly call it ACH.
This lesson is fully dedicated to
>> explain this technique,
>> and we will start with a quick definition.
We also will explain how is it used at NTCI,
and we will enumerate the different steps of ACH.
Finally, we'll close this video with
a practical study case about WannaCry incident.
CIA defines ACH as a tool to aid judgment on
important issues requiring careful weighting
of alternative explanations or conclusions.
It helps an analyst overcome or at least minimize
>> some of the cognitive limitations that make
>> progression intelligence analysis
so difficult to achieve.
Analysis of competing hypothesis, or ACH,
requires an analyst to explicitly
identify all the reasonable alternatives and have them
compete against each other for
>> the analyst's favor rather than evaluating
>> their plausibility one at a time.
>> Like many other cyber threat intelligence models
that were borrowed from parallel domains,
especially military, ACH
was also borrowed to aid analysts.
Producers and consumers of
cyber threat intelligence have largely relied on ACH
to evaluate data and analyze it on
the basis of identifying attribution,
patterns, and more.
ACH is an eight-step procedure.
The first step is enumerate
>> all the possible hypothesis.
>> In this step, we do not consider feasibility.
The second step is support hypothesis by seeking
additional evidence for support
and or refute an hypothesis,
and we discuss missing evidence.
Third step, we compare the evidence and for this we
use a metrics of
evidence like the one displayed in this slide.
Fourth step, we will find the metrics
by removing non-diagnostic evidence,
adding overlook at evidence is now applicable,
including formulation of new hypothesis
and documenting the excluded evidence.
Fifth step is prioritize the hypothesis by likelihood.
Then we determine evidentiary dependence,
which means confidence of evidence and
consequences of that evidence being invalid.
Seventh step,
report conclusions including all considered hypothesis,
key evidence, and proper estimate of language.
The final step is qualify or evaluate needs,
which means to take in consideration
that evidence may change in time and
these changes may impact
the outcome so that you need to note under
which circumstances evidence may change
and how these changes would affect your conclusions.
After enumerating the different steps of ACH,
now we are ready to see how we can use
ACH in real life analysis.
Cybersecurity intelligence provider, Digital Shadows,
gave a real-world example of ACH
in action in May 2018 when it
modeled and published a report about
multiple competing hypotheses surrounding
the WannaCry ransomware incidents.
The malware impacted enterprise networks and
or organizations across the globe and
a variety of explanations also began
to warm their way through
the information security community.
Who was responsible for
WannaCry campaign and what was their objective?
Digital Shadows outlined four possible hypotheses
about potential attribution and
tested them against the set of evidence that become
>> available during and after the incident occurred.
>> H1 or hypothesis number one is
a sophisticated financially
motivated cyber criminal actor.
H2, an unsophisticated
financially-motivated cyber criminal actor.
H3, a nation state or
states-affiliated actor
conducting a disruptive operation.
H4, a nation state or state-affiliated actor
aiming to discredit the National Security Agency, NSA.
Now, after outlining the different hypotheses
and base it on the information
available about this incident,
a list of evidence was
created and they were compared against each
other using a metrics of
hypothesis as one displayed on the slide.
The next step will be refining
this matrix and removing
all the evidence that is not relevant.
After refining the ACH metrics
and eliminating the evidence
with little value and based on
the available information about WannaCry,
we can get the metrics displayed on this slide.
The WannaCry campaign was most likely
launched by either an unsophisticated,
financially-motivated cyber criminal actor,
H2, or a nation state or
a state-affiliated actor aiming to
discredit the National Security Agency,
NSA, which is H4.
From the ACH metrics,
we can identify that H2,
which is an unsophisticated,
financially-motivated cyber criminal actor,
was the strongest scoring hypothesis
from the evidence that was available.
While ACH brings many benefits,
the main problem with using
this approach is that there is currently
no way to structure the process of
testing evidence against a set of hypothesis.
As a result, producers of intelligence often create
multiple competing hypothesis around
a given threat hoping to
identify the strongest hypothesis.
Example, the one most
supported by the available evidence.
If a process of
testing evidence can be structured more effectively,
the benefits of ACH will become even more apparent.
In this lesson, we discovered together what is ACH.
We've seen ACH and cyber threat intelligence.
We enumerated the different steps
or the eight steps of ACH,
and we've seen a real case of how we
can use ACH in a real-world case,
which was WannaCry incident.
As a key takeaway,
please take in consideration that there is no guarantee
that ACH or any other procedure
will produce a correct answer.
Analysis of competing hypothesis does, however,
guarantee and appropriate process of analysis.
This procedure leads you through a rational,
systematic process that avoids
some common analytical pitfalls or cognitive biases.
This is all for analysis of competing hypotheses.
In the next video, we'll discover
together another technique of analysis,
which is actually a combination or a merging of
two techniques which are
Cyber Kill Chain and Diamond Model.