Cyber Attribution

When your organization experiences a cyber attack, chances are, there’s probably one question on your mind: who did this? However, thanks to the relative anonymity of the internet, it can seem impossible to answer this question. For years, cybercriminals have relied on the difficulty of attribution to get away with crime online — many may assume that they’ll never be caught. There is one discipline, however, that is concerned with finding the perpetrators of attacks: cyber attribution.

Cyber Attribution: An Overview

What is cyber attribution? 

Cyber attribution is the process of identifying the source or actor behind a cyberattack. Cyber attribution is a part of cybercrime investigation and can be performed by any agency or group that investigates cyber attacks. The discipline of cyber attribution involves analyzing digital evidence, tracking attack patterns, and linking those attacks to specific individuals, groups, or nation-states. It’s a difficult but essential practice when it comes to identifying and bringing cyber criminals to justice, as well as shining a light on the actors and motives behind attacks and breaches.

What are the types of cyber attribution? 

There are three main categories of cyber attribution:

• Technical attribution: Identifying digital fingerprints, such as IP addresses, malware signatures, or coding styles.
• Political attribution: Assessing motives and geopolitical factors to determine which entities benefit from the attack.
• Legal attribution: Gathering enough evidence to take action, such as sanctions, indictments, or retaliatory cyber operations.
• International relations: Cybercrime is often sponsored by nation states. Knowing who is behind an attack can help us better understand which countries are allies, and which are not. 

What challenges are associated with cyber attribution?

Cyber attribution is difficult, and demands both time and resources. In fact, because it is so difficult to pinpoint an attacker with 100% certainty, attribution can be a controversial field. This is largely because of the tools and techniques attackers use to cover their tracks, as well as because of the anonymous nature of the internet itself. VPNs, false flags, stolen credentials, and other tactics make it hard for investigators to discover exactly which individuals or groups are behind a given attack. In many cases, investigators may not be able to identify the perpetrators with 100% certainty. 

Why is cyber attribution relevant in today’s cyber security landscape?

Is cyber attribution worth the effort and cost? 

There are several worthwhile reasons behind cyber attribution, despite the complexities and challenges of the field: 

• Justice and accountability: Perpetrators should be identified and face consequences for their actions. This can deter other attacks and sends a clear message that cybercrime will be exposed and prosecuted. 
• Research: Knowing who is behind attacks helps researchers better understand cyberattacks, and allows them to better understand emerging threats.
• Incident response: Understanding who the attackers are and why they attack helps organizations with incident response. 

Who investigates cybercrime? 

There are several types of cybercrime investigators. Many work for law enforcement agencies, but others work for the private sector: 

• Law enforcement: Criminal justice agents, such as police officers, prosecutors, and judges, are responsible for the prevention, mitigation, detection, investigation, prosecution, and punishment of cybercrime. The specific agencies responsible, however, vary by country.
• National security agencies: National security agencies, like the military, may be involved in cybercrime investigations. This is mostly the case if a nation state has been involved in a cyber attack, however.
• The private sector: Because private companies tend to own and manage the digital critical infrastructure, private businesses often are involved in the detection, prevention, mitigation, and investigation of cybercrime. Private businesses are often targets as well, and conduct their own internal investigations.

Can your own team help with a cybercrime investigation? 

When an outside organization steps in to investigate a crime, it may seem as though your own team has to step back, but that’s not the case. Businesses are critical partners in cybercrime investigations. Your team can contribute to cyber attribution efforts in many ways: 

• Preserving digital evidence
• Providing access to relevant data and system logs
• Providing all context around relevant security alerts and incidents
• Reporting suspicious activity promptly
• Maintaining strong cybersecurity practices that help identify potential threats

How Flare Helps your Team Learn About Cyber Attribution

How does Flare help you learn about cyber attribution? 

Flare’s new training series, Flare Academy Training, is a series of free cybersecurity webinars covering a variety of topics for both security experts and those without security training. The Academy also provides a Discord community where learners can meet, share information and resources, and discuss security issues with the experts who have appeared in our webinars. 

What do you get with Flare’s free training? 

• High-value training from cybersecurity experts
• Interactive learning with peers
• Actionable cybersecurity insights
• CPE credits toward security certifications
• A resource hub and learning community on Discord

Who can attend Flare’s webinars? 

Many webinars are available to anyone, but some content may be a bit advanced for non-technical learners. To help you choose the best fit for your experience, we label each webinar as beginner, intermediate, or advanced.

I missed a webinar. What should I do? 

No worries. You can watch any webinar whenever you like! Recordings of all the webinars are available for replay on our Discord community, as are additional resources, access to the experts who spoke in each webinar, and discussion and networking opportunities with other participants. This allows all our webinars to be watched by members of the Discord, or to be rewatched by participants who want to revisit certain content.

Cyber Attribution and Training with Flare Academy

Flare Academy training provides security practitioners with highly relevant and highly engaging lessons on subjects like threat intelligence, operational security, investigation techniques, and more. Led by expert instructors, these free trainings combine on-demand video lessons with diverse learning tools. Students can also gain access to the Flare Academy Discord Community where they can ask questions, explore advanced topics, and continue their learning journey wherever it leads. 

Find the right option at Flare Academy: sign up for the next training here.