Typical attribution focuses on ‘whodunnit’ - with little clear benefit to network defenders. This talk will consider attribution by activity and behavior – to develop strategies, playbooks, and responses to types of attack, while leaving nation state attribution to amateurs and reporters.
@jfslowik Joe Slowik currently hunts ICS adversaries for Dragos, pursuing threat activity groups through their malware, their communications, and any other observables available. Prior to his time at Dragos, Joe ran the Incident Response team at Los Alamos National Laboratory, and served as an Information Warfare Officer in the US Navy. Throughout his career in network defense, Joe has consistently worked to "take the fight to the adversary" by applying forward-looking, active defense measures to constantly keep threat actors off balance. When not hunting adversaries or playing with open source security projects, Joe loves playing ice hockey and building Legos.