Attribution, Containment and Response in a Supplier-Network Intrusion

Why an effects test rather than an attribution test

The tempting route is to decide the classification after attribution - 'we will call it a state attack when we can prove who did it'. That inverts the logic and produces paralysis, because attribution in cyberspace is usually probabilistic and slow.

Four questions

1. What is the target? Design data for a front-line radar component. Compromise here is a capability loss, not a data-protection incident.
2. What is the timing? Detection four days into a standoff raises the probability of deliberate intelligence collection linked to a political-military crisis.
3. What is the effect if it continues? An adversary gains design knowledge, shortening its own development cycle or enabling countermeasures. That effect occurs regardless of who the intruder is.
4. Is the harm containable by the ordinary criminal process? No - the police cyber cell can investigate and preserve evidence, but it cannot direct network defence of a defence supply chain.

Conclusion: classify on effects as a national security incident, and run the criminal track in parallel for evidence preservation and prosecution if an individual is identified. The two are not mutually exclusive.

Caution: classification must not depend on the vendor report. Commercial threat intelligence that rests on shared tooling is an indicator, not proof, and treating it as proof invites both misattribution and a diplomatic own goal.

The trade-off

Disconnection stops loss but destroys visibility: you lose the intruder's tooling, infrastructure and intent, and you never learn what else is compromised. Monitoring preserves visibility but permits continued exfiltration.

Decision rule

Weigh continuing loss against intelligence value, using three tripwires:

• If the data already exfiltrated is operationally decisive and continuing loss would be material - cut.
• If the intruder is still in the reconnaissance phase or exfiltration is bounded and encrypted at source - monitor under control.
• If the intruder moves laterally toward operational or weapon-system networks - cut at once, without waiting for the review.

Recommended middle path

1. Quarantine the supplier's network into an isolated enclave, not a full shutdown: business continuity for non-design work, hard block on the outbound address, and removal of all defence design data from that enclave.
2. Preserve and mirror logs before any remediation touches the endpoints, since remediation destroys evidence.
3. Rotate all credentials and certificates that the supplier holds, and revoke its access to the unit's network pending re-certification.
4. Monitor the quarantined enclave with a fixed review at 72 hours.
5. Notify CERT-In immediately, and notify the other suppliers in stages - a targeted advisory on the initial access vector first, since a mass disclosure will leak and warn the intruder.

Reasoning: the objective is not to punish the intruder but to stop loss while buying knowledge. A quarantined enclave achieves both, whereas the two extreme options each sacrifice one objective entirely.

The logic of each posture

Deterrence by punishment requires a credible retaliatory mechanism, a decision-maker willing to use it, and enough certainty that the retaliation lands on the right actor. Shared tooling undermines the third condition: false attribution in cyberspace is a realistic risk, and a public accusation that cannot be sustained costs credibility that will be needed later.

Deterrence by denial requires only that the attack fail. It is robust to uncertainty about who the attacker is.

Applied here

1. Denial first. Segment design networks from enterprise networks; remove design data from supplier premises, working instead through controlled access to a central repository; impose supply-chain security clauses in contracts with audit rights; enforce multi-factor authentication and least privilege at the point where the engineer opened the spreadsheet, which was the actual failure.
2. Attribution as an enabler, not a precondition. Invest in forensics, log retention and intelligence-sharing with CERT-In and partner agencies so that attribution improves over time.
3. Hold punishment in reserve. Public attribution is a diplomatic instrument; it should be used when confidence is high and when a wider policy purpose exists, not as routine signalling.

Judgement: for a defence supplier the correct emphasis is denial, because the asset to be protected is knowledge, and the consequence of a wrong punitive response falls on the state rather than on the intruder. Denial also imposes cost on the attacker by making repeated effort yield nothing - the only deterrent that does not depend on naming him.