7 ms·
The white house and the document itself never list attribution as the goal. Robert M Lee seems to think because it refers to the attackers as Russia, it is conf
by sigmar 10y ago
The white house and the document itself never list attribution as the goal. Robert M Lee seems to think because it refers to the attackers as Russia, it is confusing readers. The summary at the beginning makes it clear to me that the document is presupposing the attacker is Russia as to be consistent with all future public reports.
I don't think this is the best written report, but his conjecture around completely leaving out attribution if it doesn't include evidence seems rooted in playing to the lowest common denominator (ie poor media coverage of what this report entails)
- Gargoyle 10y agoThe timing of the release of this document, at the same time as the announcement of sanctions on Russia for the hacking, can't be overlooked. It's quite reasonable to assume the release of this report was intended to create the impression of evidence for attribution, even if it actually contains no such thing. Otherwise why not release it on any other day to avoid confusion? It looks to me like the confusion was quite intentional.
- drvdevd 10y agoIt also can be seen as a meaningful signal of attribution capability to certain parties. Think of the form - an official document intended for public consumption - as not really being intended for consumption by the general public.
- sigmar 10y agoWhite House stated pretty clearly why the Grizzly Steppe report went out: "to better help network defenders in the United States and abroad identify, detect, and disrupt Russia’s global campaign of malicious cyber activities." https://www.whitehouse.gov/the-press-office/2016/12/29/fact-sheet-actions-response-russian-malicious-cyber-activity-and https://www.whitehouse.gov/the-press-office/2016/12/29/fact-... Attribution is sexy and the media likes to talk about it. I don't believe the confusion was intentional. The White House is pretty bad at PR and 'never ascribe to malice that which can be explained by incompetence'
- Natsu 10y ago> The White House is pretty bad at PR They have a press secretary whose job is, literally, to manage the media. I'm honestly not sure if your post was intended as satire. The meat of the report might as well have been copy pasted from OWASP. So if it's not to provide political cover for the yet-to-be-proven claims that Russia did it, they didn't get the message out.
- rrggrr 10y agoI question the importance of attribution on this issue. The Office of Personnel Management hack seems far worse than this report's conclusions, but there was a fraction of the outrage. Sadly, the problem is not confined to one state actor. INFOSEC is systemically broken and although the solution is starring Congress in the face, I suspect software/hardware lobbyists will prevent meaningful legislation.
- mistermann 10y agoWhat is the solution?
- rrggrr 10y agoTort reform that extend products liability to sodtware and hardware developers and their partners. The problem is too complex for corporate or individual end users to manage. This plus retooling NSA through SBA conduit to provide protections to small businesses, law firms, health providers.