Do Attribution and Motives Matter?Whenever people think of APTs and targeted attacks, people ask: who did it? What did they want? While those questions may well be of some interest, we think it is much more important to ask: what information about the attacker can help organizations protect themselves better?
Let?s look at things from the perspective of a network administrator trying to defend their organization. If someone wants to determine who was behind an attack on their organization, maybe the first thing they?ll do use IP address locations to try and determine the location of an attacker. However, say an attack was traced to a web server in Korea. What?s not to say that whoever was responsible for the attack also compromised that server? What makes you think that site?s owner will cooperate with your investigation?
Source:
Do Attribution and Motives Matter?
