Spotting the Bear: Credible Attribution and Russian Operations in Cyberspace

How do we know who is behind a cyberattack? What are the tools and techniques that could help to identify the hackers who have conducted a cyber-operation? And why is credible attribution in the case of cyberattacks carried out or masterminded by Russia so challenging? These are the questions which this chapter aims to address in detail. However, before examining the technical, intelligence and geopolitical aspects of attribution, this chapter will first explain what attribution is and why it is important in the domain of cybersecurity.