Re-thinking threat intelligence

Abstract

Attribution relies largely on technology; however, experts who rely on technology may inadvertently inject their own biases when evaluating findings. Attackers are now deceiving the analysts, by misleading them through the use of deceptive data and exploiting defender and analyst biases. One set of biases that can be objectively measured is cultural bias. Cultural biases are so firmly engrained that they act as a type of automatic processing system. Culture influences thoughts, choices and behaviors in the physical world, so culture can be expected to have the same influences in the cyber world. To date, culture has been shown to play a role in specific cyber behaviors; this study was performed to determine if culture plays a role in cyber decisions. Zone-H data from the year 2011 was examined for a list of known attackers by most used attack vectors. The popularity of attack vectors was examined within the context of Hofstede’s national cultures framework looking for evidence of cultural preferences associated with attack vector choices. The findings indicated cultural preferences in three of six cultural dimensions. These findings add to the growing body of work that have shown cultural preferences in cyber behaviors, and lend support to the further examination of cyber choices.