Threat Activity Attribution - Differentiating the Who from the How

Threat Activity Attribution - Differentiating the Who from the How

Explore the complexities of threat activity attribution in cybersecurity through this BSidesCharm 2018 conference talk. Delve into traditional attribution methods, examining their benefits and drawbacks while highlighting common infosec failures and media misrepresentations. Learn about the Diamond Model for intrusion analysis and its application in differentiating between operational behaviors and attacker identities. Analyze real-world examples such as ALLANITE, COVELLITE, and LAZARUS to understand the nuances of attribution. Gain insights into making defense more manageable and developing a process-oriented approach to threat attribution that distinguishes the "who" from the "how" in cyber attacks.