Attribution of Cyber Attacks

We define cyber attribution as allocating a cyber attack to a specific attacker or group of attackers in a first step and unveiling the attacker’s real-world identity in a second step. While the methods of attacker allocation have made significant progress in recent years, digital technologies often still do not provide sufficient evidence of an attacker’s real identity. However, digital forensics can be combined with evidence from the physical world, as bits and bytes are still bound to a physical infrastructure, which opens up various possibilities for detecting adversaries. Gaps can also be closed by conventional espionage and the systematic collection, consolidation and analysis of threat intelligence data. This chapter provides an overview of cyber attribution’s current methods and practices with real-world examples.