This is a great point, we discuss hybrid cyber / kinetic attacks a lot in reporting and research, but really they are all attacks and we have to defend against them holistically. via @alexmartin.bsky.social & @therecordmedia.bsky.social - ThreadSky

ransomwaresommelier.com • 5 days ago

This is a great point, we discuss hybrid cyber / kinetic attacks a lot in reporting and research, but really they are all attacks and we have to defend against them holistically.

via @alexmartin.bsky.social & @therecordmedia.bsky.social

Comments

johnsalomon.bsky.social•5 days ago

Curious that anyone would oppose use of a descriptor, which is necessarily part of understanding the nature of, and motivations behind, an attack - always a vital part of preparation, detection, countermeasures, and recovery.

Semantics has little place in information- or any other kind of security.

ransomwaresommelier.com•5 days ago

I understand your point, but I disagree with it slightly.

By focusing on the cyber/kinetic aspects separately you wind up where we are today:

Each attack is handled in isolation, rather than looking at the whole picture.

Defending against “attacks” allows you to “see the whole battlefield”

johnsalomon.bsky.social•5 days ago

I'm afraid I don't follow.

It's important to understand elements of an attack individually so you can design and deploy effective countermeasures. That isn't, and must never be, mutually exclusive with understanding whether and how they're part of a broader campaign..am I missing something?

shadylink.lol•5 days ago

Knowledge that an attack is part of a broader campaign shouldn't be driving your defense, prioritize focus areas maybe but even then you would be restricting your scope. Technique focused defense is key, knowing who delivered the technique does nothing to stop it.

johnsalomon.bsky.social•5 days ago

Not "driving", but definitely informing. It's never not useful to understand who is likely behind any coordinated effort, and what TTPs have a higher-than-average probability of being encountered. Information and context are always good.

shadylink.lol•5 days ago

Definitely agree that knowledge and context is useful but I'm still not sold on how knowing who is behind an attack is valuable for your posture outside of chasing rabbits. Your response should be the same regardless of what threat group is doing the attacking.

johnsalomon.bsky.social•5 days ago

(Full disclosure, I am exceptionally tired so may not be firing on all cylinders. It's a topic I need to revisit ex-coma....) 8)

Comments

Posting Rules

Reply