AI is complicating cyber attribution

It wouldn’t be an episode of Scooby-Doo if the Mystery Gang didn’t unmask the villain. But for cybersecurity pros, it’s not always easy to uncover who’s behind online threats—and AI is making a tough job even tougher.

Tim Chang, global VP and GM of application security at Thales, told IT Brew that cyber attribution has traditionally been considered a critical part of cybersecurity defenses, as it helps teams better understand, and even anticipate, attackers and their next moves.

“It’s actually something that a lot of customers ask about: ‘What kind of information do we have that we can attribute to the thing or the organization that’s attacking their website?’” Chang said.

Copycat. However, Joe Saunders, founder and CEO of RunSafe Security, said AI may make it harder to point the finger following an attack, by enabling the rise of more false flag operations, which occur when an attacker or threat group disguises their identity by imitating other adversaries or through other means of deception.

“Sophisticated false flags historically required pretty significant expertise and resources to really do that,” Saunders said. “AI certainly can enable actors to imitate others and maybe even make adjustments, whether that’s style or language used or even the infrastructure of choice.”

Saunders added that AI is also accelerating the rate of attacks. While the technology is also helping defenders process large amounts of information faster, Saunders noted that time is still on the attacker’s side: “They can make modifications pretty quickly to help make it more difficult for attribution on the defender side.”

Will attribution still matter? Alon Noy, co-founder and CEO of AI-native exposure management platform Astelia, said today’s AI-assisted attacks might shift conversations away from attribution to detection and prevention.

However, he said, attribution still remains important for companies and governments as they figure out how to handle an incident.

“At the end of the day, when any other crime happens, there is a thief or there is a murderer,” Noy said. “You need to find out who did it. It’s part of the way the world operates.”

Sherrod DeGrippo, VP of threat intelligence at Palo Alto Networks Unit 42, said attribution will always matter, even if it is becoming slightly more difficult to pinpoint in AI-assisted attacks.

“We might need to start looking at different modes of attribution, different methods, examining how we are assigning actor attribution,” DeGrippo said. “The discipline of threat intelligence is going through a reformation, and we’ll have to continue to evolve it into this new AI frontier.”

Double-edged sword. AI might make it easier for cybercriminals to deceive defenders, but Chang reminds us that the same technology has given cybersecurity practitioners more capabilities to track and detect behaviors and patterns.

“It’s helped disguise the attack, but it’s helped us actually interrogate traffic even better,” Chang said. “In terms of attribution, that will always be that cat-and-mouse game, but that’s why we’re in business, is to make sure that we can help our customers really understand the patterns and then really detect what needs to be blocked with a high degree of accuracy.”