Who Did It? And Why (insert any country here), but Only by 21.37%?
summary
The talk explains methods for attributing cyberattacks to specific countries, discussing analyst challenges and the limits of “digital fingerprints.” It uses examples of attacks targeting Poland to illustrate practical attribution techniques and their uncertainties (e.g., partial confidence like 21.37%).
AI-written summary · about
chapters (16)
- 0:00Introduction
- 2:08What is cyber operation attribution
- 5:22Threat actor classification
- 8:29State cybersecurity approaches
- 10:54Threat group naming
- 14:23Cyber mercenaries and models
- 16:08State cyber operation goals
- 17:31Attribution models overview
- 20:39False flags and detection
- 23:08Olympic Destroyer case
- 26:41Financial Supervision Commission incident
- 31:36Legal investigation and sanctions
- 33:39Ghost Writer campaign: Belarus or Russia?
- 37:55Polish counterintelligence findings
- 40:46Germany’s stance on Ghost Writer
- 42:31Summary and discussion
related talks
20mThe Art of Attribution: Identifying and Pursuing your Cyber Adversaries
50mFrom Attribution to Accountability: Upholding International Rules Online
43mPanel: Cyber Operations, Doctrine, And Geo-Politics
49mResponding to a Cyber Attack with Missiles
29mCybersecurity and cyberdefense: a geopolitical issue
52mThe Role of Partnerships in Advancing Cyber Diplomacy
05mConceptualizing attribution and why it matters
10mCCyberattacks: Is the Juice Worth the Squeeze?