One analytical struggle in my life is whether a group executed poorly conceived tradecraft, or well executed deception. Deception is rarely discussed on the "threat intelligence" side of information security. Maybe folks are unfamiliar, or intimidated, I don't know. #threatintel
We're naive to think we cannot be deceived. Governments with seemingly infinite resources and elaborate espionage capabilities get deceived. It's a thing. I'll go further, there's plenty of regular intelligence analysts who rarely discuss deception. It probably scares them.
An entire field is dedicated to carefully misleading intelligence apparatuses. That means understanding your processes, requirements, and capabilities in order to craft essentially an illusion for you to consume. You may execute sound analysis and still be dead wrong.
We execute sound analytical processes as a matter of best practice. That's good. However, we should always at least as the question or entertain the possibility or probability that the top tier in the game can and likely do conduct deception and counterintelligence.
Good intelligence analysts operate in degrees of uncertainty, because they rarely have all the facts. That's why they generally make assessments instead of prove a case. They have to consider information they have is incomplete, incorrect, or worse, specially crafted to mislead
• • •
Missing some Tweet in this thread? You can try to
force a refresh
