USA 2003

The panel discusses ways to characterize cyber adversaries by combining evidence about their tools, techniques, capabilities, intent, and behavior. Speakers present scoring and classification models and explain how threat assessments can inform security planning, incident response, and decisions about where to direct resources. The discussion also considers group behavior, social engineering, insider access, and the limits of drawing conclusions from network activity alone.