A digital forensic investigation will normally attempt to discover how and why an incident has occurred, but is also focused on identifying and holding individuals or groups accountable for their actions. The process and ability to identify and hold accountable is called attribution, and is one of the greatest challenges in the cybersecurity field.
In this section, you will learn how to describe the role of attribution of assets and threat actors in an investigation.
Attribution is important because it leads to a reduction of attack incidence. This reduction is driven from two independent directions. Firstly, attribution allows a wrongdoer to face justice and reduces their ability to carry out subsequent attacks (through incarceration or restrictions on computer/network access). Secondly, attribution and the threat of justice has a deterrent effect.
Difficulties...