Attribution of cyber operations: does it really matter? It depends on who’s asking. Based on real APT attack investigations made by Proofpoint researchers and attributed to Russia, Iran, North Korea and regions, we’ll demonstrate what details go into attribution work from the perspective of an email security vendor, why attribution can be useful for defenders and how Blue Teams can use it to better inform threat modeling and risk.
We'll define attribution, compare the concepts of attribution and Attribution and discuss how softer attribution elements should be paired with harder, more technical ones to get the best results.
In closing, we will discuss potential pitfalls we’ve seen with attribution and even dare bring up the controversial topic of threat actor naming, Marketing gimmick, necessary evil, a little bit of both? Let’s find out.