Know Your Adversary

In February 2013, incident management and forensics expert Mandiant issued a report exposing the identities of three members of a cyberespionage group known as APT1. In May 2014, the US Department of Justice indicted five Chinese hackers for computer hacking and economic espionage. Attributing security incidents such as corporate espionage, customer data theft, and denial of service attacks to specific adversaries was once a rare practice, but it's now becoming more and more common even for private sector enterprises, not just security experts and government agencies. It allows security and risk (S&R) pros to put a name and a face to a once nebulous attacker operating from somewhere in cyberspace. When you know what group is targeting you as well as their motivations and capabilities, you can transition your cybersecurity strategy from a largely ineffective, haphazard defensive approach to one that is proactive and targeted. In this report, Forrester will explain the fundamentals of adversary intelligence, discuss its pros and cons, and provide S&R pros with specific recommendations for how they can operationalize adversary intelligence into their cybersecurity strategy. This is an update of a previously published report; Forrester reviews and updates it periodically for continued relevance and accuracy.