Google Revamps Naming System for Hacking Groups
Google introduces a new naming system for hacker groups.
1The Naming Problem in Cybersecurity
The cybersecurity industry has long been assigning names to different hacker groups. However, each company using a different naming system makes tracking difficult. This situation complicates the process even for professionals within the industry. Google has developed a new system to address this issue.
2Google's New Naming System
Google will now assign more memorable names to hacker groups instead of using numbers like APT1 or APT41. In the new system, the first word will be random and memorable, while the second word's initial will indicate the group's origin. For example, 'Castle' for China, 'Ion' for Iran.
3Effort to Bring Clarity
Shane Huntley, CTO of Google Threat Intelligence Group, stated that the new system was developed to bring clarity to both internal and external security researchers. Huntley mentioned that they did not anticipate having so many threat groups in the early 2010s.
4The Importance of Tracking Hacker Groups
Naming and tracking hacker groups is not just an academic exercise. It is a critical step in understanding who is attacking whom and how. This information helps organizations recognize threats faster, prepare against them, and investigate incidents more promptly.
5State-Sponsored Hackers vs. Cybercriminals
Tracking state-sponsored hackers is easier than tracking cybercriminals. State-sponsored groups have more consistent targets and activities, while cybercriminals' members come and go, sometimes splintering. This makes tracking more challenging.
6Different Views Among Companies
Each company has a slightly different view of every group based on their own data sets and telemetry. Shane Huntley noted that this situation cannot be resolved simply by sharing more information among companies and research groups.
7Integration of Google's Old System
Google merged the naming systems of its old Threat Analysis Group and Mandiant, reducing the number of systems to remember. This provides significant convenience for security researchers.
8The Importance of Information Sharing in Cybersecurity
Information sharing in cybersecurity is crucial for understanding and preventing threats. However, no company or organization has perfect visibility. Therefore, different companies' views must be combined to better understand threats.