At a hotel, leadership wants the threat actor's legal name on the first day, but the only fact in hand is a foreign address on a consumer VPN. What can the analyst honestly report from that fact?
Select an answer to reveal the explanation.
Short Explanation
A return address on an envelope is not a birth certificate. You can report the foreign address you actually have, and you cannot turn it into someone's legal name. The trap is filling the blank with a vendor executive, a nearby guest, or a logo hash.
Full Explanation
Day-one attribution stops at the artifact that was actually observed. The only fact is a foreign address reached through a consumer VPN, and one shared exit address does not identify a human being. The honest report is Report the foreign address as infrastructure and stop short of naming a person. An address can be recorded as an indicator and as infrastructure used for the session. It becomes a person's name only when some other evidence ties that session to an individual. Report the legal name of the consumer VPN provider's chief executive as the actor invents a person from a company that only supplied the tunnel. Report the registered guest whose room sat nearest the access point that evening invents a person from physical proximity, and nothing places that guest on the session. Report the hash of the hotel logo file from the public booking site as the actor swaps in an unrelated file fingerprint that says nothing about who connected. Exam caveat: an address can support an investigation, and it is not, by itself, the legal identity of a threat actor. Operational check: record the address, the time, and the VPN observation in the ticket, and leave the actor name blank until a separate source ties the session to a person.