Cyber attribution

☆ Save On Wikipedia ↗

In computer security, attribution is finding out who perpetrated an attack. Uncovering a perpetrator may give insights into various security issues, such as infiltration methods, communication channels, etc., and may help in enacting specific countermeasures. Attribution is a costly endeavor requiring considerable resources and expertise in computer forensics.[1][2]

For governments and other major players dealing with cybercrime would require not only technical solutions, but legal and political ones as well, and for the latter ones attribution is crucial.[2]: xvii 

Attributing attacks is difficult, and of limited interest to targeted companies. In contrast, secret services often have a compelling interest in finding out whether a state is behind the attack.[3] A further challenge in attribution of cyberattacks is the possibility of a false flag attack, where the actual perpetrator makes it appear that someone else caused the attack.[3] Every stage of the attack may leave artifacts, such as entries in log files, that can be used to help determine the attacker's goals and identity.[4] In the aftermath of an attack, investigators often begin by saving as many artifacts as they can find,[5] and then try to determine the attacker.[6]

See also

References

  1. Tsagourias, Nicholas; Farrell, Michael (2020). "Cyber Attribution: Technical and Legal Challenges". Computers & Security. 95. doi:10.1093/ejil/chaa057. Retrieved October 8, 2024.
  2. Yannakogeorgos, Panayotis A. (2017). Strategies for Resolving the Cyber Attribution Challenge (PDF) (Report). Maxwell Air Force Base, Alabama: Air University Press. Retrieved October 8, 2024.
  3. Skopik & Pahi 2020, p. 1.
  4. Skopik & Pahi 2020, pp. 1, 6.
  5. Skopik & Pahi 2020, p. 12.
  6. Skopik & Pahi 2020, p. 16.

Further reading