Tenable Blog

Good cyber hygiene means appropriately protecting and maintaining IT systems and devices and implementing cybersecurity best practices. When good cyber hygiene is built upon a continuous network monitoring platform, you continuously visualize the security posture of your entire IT infrastructure and better protect your organization against advanced cyber attacks.

Last week in Attribution is Hard, Part 1, I described a classic hacking incident and discussed the challenges of establishing attribution. This week, I explain what weak attribution is, and I conclude the discussion on the four requirements of establishing attribution.

Weak attribution

Last week’s cliff hanger probably left you wondering what I mean by "weak attribution." Well, there are several forms of weak attribution that warrant discussion.

In 1995 I landed my first independent consulting project: an incident response for an important financial institution in New York City. That experience has informed my attitude about attribution ever since, because it was one of the rare incidents I’ve ever been involved in when we actually learned the identity and location of the attacker with a high degree of certainty. The attacker was accessing an X.25 connection to the institution, had guessed an account/password pair on one of the Unix hosts, logged in and began looking around.

Recently there have been several great books that illustrate the importance of information security in today’s world, including Kevin Mitnick’s “Ghost in the Wires,” Andy Greenberg’s “This Machine Kills Secrets” and Brian Krebs’ “Spam Nation.” Joining the list at the top is Kim Zetter’s “Countdown to Zero Day.” The book tells the story (which you probably thought you already knew) of Stuxnet and the geopolitical maneuverings that brought it into existence. The book is engaging to read and meticulously researched.

With 2014 drawing to a close and the New Year almost upon us, it’s the perfect time to reflect on this year’s security events and to plan for changes in 2015. Certainly 2014 seemed like the year of the security breach, with major retailer breaches, Heartbleed, Shellshock, and Sony dominating the headlines. With over 7000 vulnerability reports published in the National Vulnerability Database so far this year, it would be too easy to become inured to the daily data security news.