Chapter 7: Cyber Attribution

What is the goal of cyber attribution?

• To hide the attackers' identity

• To gain a complete picture of the attack

• To promote cyber attacks

• To ignore cyber attacks

What are the challenges of cyber attribution?

• Unlimited jurisdictional power

• Lack of resources & expertise

• Abundance of resources & expertise

• Easy identification of intruders

Which of the following is a cyber attribution technique?

• Analyzing metadata connected to the attack

• Ignoring metadata

• Avoiding forensic investigation

• Not examining tactics and procedures

What is an enabler for public attribution?

• Incident Severity

• Lack of intelligence

• Minimal attribution information

• Geopolitical Situation

Why do businesses need cyber attributions?

• To have serious consequences

• To promote cyber attacks

• To conduct investigations

• To hide cyber attacks

What are the key indicators to enable attribution?

• Only Intent and Indicators from external sources

• Tradecraft, Infrastructure, Malware, Intent, and Indicators from external sources

• Only Tradecraft and Infrastructure

• Only Malware and Intent

What are the best practices for attribution?

• Ignoring human error

• Avoiding collaboration and information sharing

• Looking for machine error

• Rigorous analytic tradecraft

What is an objective of cyber attributions?

• To avoid sanctions

• To ignore adversaries

• To enforce a set of standards for appropriate behavior

• To encourage malicious activities

What is an enabler for public attribution related to Incident Severity?

• The attacker's identity

• The attacker's motivation

• The attacker's intention

• The attacker's location

What is an enabler for public attribution related to Geopolitical Situation?

• The absence of geopolitical factors

• The spectrum of responsibility

• The level of state irresponsibility

• The lack of state involvement