Attribution (information security)

In computer security, attribution is finding out who perpetrated an attack. Uncovering a perpetrator may give insights into various security issues, such as infiltration methods, communication channels, etc., and may help in enacting specific countermeasures. Attribution is a costly endeavor requiring considerable resources and expertise in computer forensics.

For governments and other major players dealing with cybercrime would require not only technical solutions, but legal and political ones as well, and for the latter ones attribution is crucial.: xvii 

Attributing attacks is difficult, and of limited interest to targeted companies. In contrast, secret services often have a compelling interest in finding out whether a state is behind the attack. A further challenge in attribution of cyberattacks is the possibility of a false flag attack, where the actual perpetrator makes it appear that someone else caused the attack. Every stage of the attack may leave artifacts, such as entries in log files, that can be used to help determine the attacker's goals and identity. In the aftermath of an attack, investigators often begin by saving as many artifacts as they can find, and then try to determine the attacker.

See also

References

  1. ↑ Tsagourias, Nicholas; Farrell, Michael (2020). "Cyber Attribution: Technical and Legal Challenges". Computers & Security. 95. doi:10.1093/ejil/chaa057. Retrieved October 8, 2024.
  2. 1 2 Yannakogeorgos, Panayotis A. (2017). Strategies for Resolving the Cyber Attribution Challenge (PDF) (Report). Maxwell Air Force Base, Alabama: Air University Press. Retrieved October 8, 2024.
  3. 1 2 Skopik & Pahi 2020, p. 1.
  4. ↑ Skopik & Pahi 2020, pp. 1, 6.
  5. ↑ Skopik & Pahi 2020, p. 12.
  6. ↑ Skopik & Pahi 2020, p. 16.

Further reading