Trust the NSA
Following his talk, Juan Guerrero, an analyst with Kaspersky Lab’s Global Research and Analysis Team, asked about the issue of attribution and efforts by some attack groups to manipulate and alter indicators of compromise to thwart attribution or point the finger at someone else.
“It’s amazing the amount of lawyers that DHS, FBI and NSA have,” Joyce said. “So if the government is saying that we have positive attribution too, you ought to book it. Attribution is really really hard, so when the government’s saying it, we’re using the totality of the sources and methods we have to help inform that. [But] because those advanced persistent threats aren’t going away, … we can’t bring all that information to the fore and be fully transparent about everything we know and how we know it.”