>> Hello, and welcome to the new module about Attribution.
The first lesson will be an introduction
>> to this module.
>> As introduction, we need to
understand what is attribution,
the different types of
attribution, and approaches to attribution,
and you we'll see important requirements
that are needed for attribution.
When discussing the latest targeted attacks,
the question invariably arises,
who laws behind it?
It's a simple question,
but it became difficult, and complex to answer.
Attribution of cyber attacks
has never been an exact science.
At the same time, attribution is done
based on similarity of digital fingerprints,
such as code similarity,
share tools, and share infrastructure.
However, attribution using such methods
is becoming increasingly difficult,
especially with a trend of
attackers using file as threats,
such as dual use tools for example, PsExec.
There is also the classic problem of
attackers inserting false flags,
including purposeful misdirection, obfuscation,
and fake clothes designer to mask their identities.
Despite these challenges, attribution
remains an important part of attack analysis.
By tying activity to specific groups,
we start to see patterns of behavior that
allows us to better understand
>> the attacker's motivation,
>> their target profile, and the assets they are pursuing.
But there are limits to
how far we can go with attribution.
For instance, even if we can tie
specific incidents to unknown attack group,
identifying who, or what organization
is directing, or funding that activity,
is not in the scope, or focus of what we are doing.
This level of attribution requires
the substantial resources, and access to
information that is generally available only to
law enforcement, or government intelligence agencies.
Attribution to cyber attacks
means different things to different audiences.
In some cases, analysts
only care about a group in multiple intrusions
together to identify
an adversary group, or their campaigns.
To others, attribution means determining the person,
organization, or nation state
responsible of the successful intrusion, or attack.
Rob M. Lee, the CEO, and
founder of cybersecurity company Dragos,
defines two types of attribution.
The first one is true attribution,
which means that we are attributing
an intrusion to an individual threat actor,
or a group of actors who are executing the intrusion.
It can also be attribution to nation state,
which means that the actors are
operating for interests of the government.
The second type is campaign attribution,
which means that we are linking a set of
intrusions using Command key indicators.
The second, attribution is much more
useful than true attribution for network defense.
It helps defenders identify,
group, and investigate activity faster.
Robert Lee defines also four roads to true attribution.
The first approach is adversary admission.
Here the adversary admits that they did the intrusion.
The second road, or approach is through leaks.
Here the adversary releases the information,
or someone else releases this information about them.
The third road is through direct access.
Here it's requires interaction with
the adversary, and or
their systems to collect information.
In other words, spying on the adversary.
The fourth approach is through campaign attribution.
Here we are talking about
intrusion analysis that we've
explained in the previous slides.
Why does a distribution matters?
Now let's see if attribution matters.
The security blog [inaudible] security,
has a great post about the value of attribution.
Here are five reasons why attribution matters,
based on five levels of strategic thoughts.
Starting from the bottom,
at the tools level,
attribution matters because
identifying adversary might tell
defenders what software they can expect to
encounter during an intrusion, or a campaign.
It is helpful to know if the adversary uses
simple tools that traditional defenses can counter,
or if they can write custom code, and exploits to
evade most any programmatic countermeasures.
The benefits of attribution are
similar at tactics level,
Tactics describes how adversary acts
within an engagement, or a battle.
The level of operations, or campaigns,
describes activity over long periods of time,
from days to months,
and perhaps years,
over a wider theater of operations.
So from a department, or
a network segment to
an entire organization's environment.
Defenders who can perform attributions,
will better know their
opponents long-term patterns of behavior.
Basically, does the adversary prefer to conduct
operations around holidays,
>> or certain hours of the day,
>> or days of the week?
Attribution helps defenders
answer these unrelated questions.
At the level of strategy,
attribution matters to
an organization's management and leadership,
as well as policymakers.
These individuals must decide
if they should address how they conduct business,
based on who is attacking, and damaging them.
One cannot think strategically without
recognizing, and understanding their adversaries.
Finally, the level of
policy, or program goals in the diagram.
Is the supreme goal of
the government officials
and top organizational management,
such as CEOs, and their corporate boards.
Policymakers can apply many
>> government tools to problems,
>> such as law enforcement, legislation,
diplomacy, sanctions, and so forth.
Policymakers may choose to
fund programs to reduce vulnerabilities,
which is in some sense attribution free approach.
However, addressing the threat
>> in a comprehensive manner,
>> demands knowing the threats.
Attribution is the key to any policy decision where
one expects other parties to
act, or react to one's own moves.
When it comes to requirements for attribution,
it is essential for any analysts
to defeat their biases, and logical errors.
We will have two lessons dedicated
to focus on these two concepts.
But you need to keep in mind that biases are
especially dangerous when performing any analysis.
Because analysis leans so
heavily on the human thought processes,
that it can lead us to inappropriate conclusions.
This is all for this video.
In this lesson we introduced attribution.
We've seen the different types of attribution.
We've seen that there is one type called a
true attribution and the roads to true attributions.
We also discovered why attributions matters,
and we defined some requirements for attribution.
The next video we'll be focused on cognitive biases,
and before moving to the next lesson,
I will leave you with this short comics
>> of Little Bobby.