Threat Intelligence Naming Conventions: Threat Actors, & Other Ways of Tracking Threats

Cyber Threat Intelligence (CTI) analysts must have ways of clustering adversary intrusions to find patterns and make meaningful recommendations to defenders. Incident responders and security personnel must be able to simply interpret those recommendations for actionable results. And yet the ways the community clusters activity and assigns names to it can be extremely confusing and seems inconsistent. Is APT A the same group as FANCY SQUIRREL? If not why not? And does it matter? What is a Threat Group? And how is that different than an Activity Group? Or a Campaign? This webcast presents concepts to consider when clustering intrusions and making assessments on adversary activity. It also highlights some unanswered questions in CTI for future exploration and some potentially problematic areas for analysts.