Attribution

Attribution in the cybersecurity world refers to the process of tracking, identifying and placing blame on the hacker (perpetrator) or organization behind an attack. Following an attack, an organization should conduct an investigation to attribute the incident to specific threat actors to gain a detailed understanding of the attack, what the motivation behind the attack was, and possibly bring the hacker(s) to account.

Unfortunately, It is often difficult to impossible to track down who the perpetrator was in an attack, considering all of the avenues hackers can take to cover their tracks. 

Additionally, increasingly sophisticated hackers are employing an approach known as “false flags” to hide their tracks.  In this method of obfuscation, the hacker leaves evidence from other nation states, hacker groups, or languages behind in their attacks.  This can be source code stolen from those other hacker groups, or it can be small language snippets they have used previously in their malware code. The purpose of a false flag is to leads investigators into incorrect conclusions about the source of an attacker or hacking group.

Related Term: False Flag, Nation-State Hackers

Source: TechTarget

To learn more about attribution challenges, watch this short video: