Been hacked? Now to decide if you chase the WHO or the HOW
Credit:
Imagine a security researcher has plucked your customer invoice database from a command and control server. You're nervous and angry. Your boss will soon be something worse and will probably want you to explain who pulled off the heist, and how.
But only one of these questions, the how, is worth your precious resources; security experts say the who is an emotional distraction.
Thats my takeaway after exploring the cyber crime attribution debate for several months, and although it's not the industry's unanimous position: defence intelligence officials, top security thinkers, serving CISOs, ex-cops, and former bank boffins speaking don't entirely agree on on the value of pinning a hack on an individual or group.
