3 ms·
> The question is, with all of these companies performing IR, why didn't they see mass exfiltration and C2? 1. Good tradecraft means that, except for skilled I
by jnwatson 6y ago
> The question is, with all of these companies performing IR, why didn't they see mass exfiltration and C2?
1. Good tradecraft means that, except for skilled IR folk, they wouldn't see mass exfil/C2.
2. American IR companies know what side of their bread is buttered on. From both employees' personal allegiances to their former employers and the company's active government contracts, there's not a lot of incentive to report on their own government's actions.
- closeparen 6y agoHow would they know it’s their own government? If the NSA were in the habit of leaving calling cards, then sure some info-sec people might keep quiet out of patriotism, but others would be screaming from the rooftops about proof of conspiracy. More likely, as the author mentions, the NSA disguises its attacks as less sophisticated than they really are.