Socialis Resistus · @admin
10 followers · 715 posts · Server 2br02b.online
Christoffer S. · @cstromblad
973 followers · 889 posts · Server ioc.exchange

@johnchiment love reading your questions and thoughts that you put out here. Please keep me thinking and reflecting :)

#threatintel #mirrorimaging

Last updated 2 years ago

johnchiment · @johnchiment
14 followers · 62 posts · Server ioc.exchange

more than a little disheartened listening to another threat intelligence brief on a high interest threat vector that provides actionable suggestions for securing against threat actors who might use it - and learning (when the briefer is questioned) that the defensive countermeasures were sourced from Blue operators and what would confound *them*.

Red does not act in the same ways as Blue. Red will make choices and employ TTPs that Blue thinks is dumb - and they may be, but Red doesn't think so. They may also be quite effective against you.

Will the provided suggestions help? Probably. Will they stop or slow down Red? Maybe. Will they expend limited resources defending against TTPs Red would dismiss out of hand and never employ? Absolutely.

All actors are logical - they just don't use *your* logic. Expecting them to act the way your side does invites catastrophic strategic surprise that will be deemed "unforeseeable" in the AAR. The damage will be done by then, however.

#threatintel #mirrorimaging

Last updated 2 years ago