Conceptualizing attribution and why it matters
summary
Attribution is a three-layered process: technical, operational, strategic analysis that combines forensic evidence with HUMINT, SIGINT and geospatial sources to reduce uncertainty. Casework shows investigators run hypotheses against motive and opportunity, confront communication trade-offs (for example the US had hacked North Korean networks while attributing the Sony intrusion), and adopt calibrated language—language of estimated probability—to state degrees of confidence without burning sources or overclaiming.
AI-written summary · about
chapters (4)
related talks
20mThe Art of Attribution: Identifying and Pursuing your Cyber Adversaries
43mPanel: Cyber Operations, Doctrine, And Geo-Politics
15mLink by Link: Crafting the Attribution Chain
50mFrom Attribution to Accountability: Upholding International Rules Online
09mORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion...
43mWho Did It? And Why (insert any country here), but Only by 21.37%?
28mWho Did It? Getting Started with Threat Actor Profiling
14mThe CyberPsychology of CyberCrime