Your team has learned about the differences in the cyber culture as well as the laws and regulations that exist for the nations at the summit.
In hopes of finding the source of the anomalous network activity, the host of the summit has provided your team with the IP addresses associated with the anomalous behavior.
These IP addresses are unfamiliar, and you need to find out information about them and about their source. The host of the summit has given these IP addresses to each nation’s cybersecurity team to analyze and take steps for defense and remediation of their nation team’s infrastructure. No other information is given.
As a team, you will provide an Attribution Report to the host of the summit, determining the bad actors. This two- to three-page report will be part of your Security Baseline Report.
You are familiar with ip2nation, and you want to examine the contents of the files, but first you want to determine the source. You need to be sure because any error can have ramifications in international diplomacy. You are also aware of AlienVault Open Threat Exchange and its capabilities for providing attribution for indicators, and additional information on adversaries.
You can use these two systems to help identify the indicator information. You and your team members will analyze the indicators and IP addresses using the systems.
Review the list of IP addresses that have been associated with the anomalous behavior.
Define what criteria you will use to confirm the attribution and determine which website serves to provide greater corroboration. Give reasons for that determination. Determine the effect on trusted relationships among the nations based on the international policy you have researched that governs the nations’ relationships with each other and with your nation team. Take your research seriously and properly cite your sources. Incorporate this information into your report.
This report will be provided by your team as part of the Security Baseline Report.