What it means
Cyber threat attribution assesses who is responsible for activity at a stated level of confidence using technical, behavioral, contextual, and sometimes nontechnical evidence.
Why it matters
Attribution can shape major decisions, so analysts must separate evidence from inference and resist pressure to be more certain than the data supports.
Practical focus
- Define the attribution question and required level of specificity
- Consider alternative actors and false-flag possibilities
- Use independent evidence streams
- State confidence, gaps, and what could change the judgment
Common mistakes
- Attributing from one tool, language, address, or malware family
- Conflating infrastructure use with ownership
- Reusing another organization's judgment without evidence
- Allowing policy preference to determine the analytic conclusion
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: