Understanding and performing threat attribution
Threat attribution is important to understand adversaries' activities and the threats your organization might face. Contrary to threat and intrusion analyses, which depend on fact (evidence), adversary attribution is based on assessment, as summarized in the following Diamond model of intrusion analysis:
Figure 15.19 – A Diamond model for threat attribution
We leverage the Tactics, Techniques, and Procedures (TTP), Victim, and Infrastructure to attribute a threat or attack to a specific group, campaign, and actors (including nation-state actors). Because threat attribution is based on assessment, it is important to consider the confidence level with which the assessment is performed. Confidence assessment must be supported by evidence and facts (IOCs, adversary intent, capabilities, and opportunities). The confidence assessment levels, which is fundamental for use cases 4, 5, and 6, are explained...
