Software Engineering Institute

Computer Network Attack (CNA) attribution presents ongoing challenges for information security professionals. The distributed nature of the Internet combined with various anonymizing technologies contributes to making the attribution problem more difficult, especially when traversing hostile networks. What is needed is a new way to assist in attribution performance; this method must be technology-independent. Culture offers a technology-independent vector for analyzing CNAs. The human mind uses both conscious and unconscious thought, and both of these processes are culturally influenced. This researcher seeks to determine if those cultural influences leave traces in CNA choices and behaviors.

Geert Hofstede’s cultural dimensions provide a framework for evaluating and understanding various behaviors. Hofstede’s framework has been used in academia and business for research in order to better understand other cultures. Hofstede avails his data for researchers in all disciplines. The goal of this study is to determine if Hofstede’s framework can be applied to the cyber environment in order to understand CNAs with the hope of a greater understanding of cyber adversary choices and behaviors.

The preliminary findings support the hypothesis: culture influences CNA choices and behaviors. Two sets of data were examined across all six cultural dimensions. The analyzed data displayed statistically significant findings across three dimensions: power distance, individualism versus collectivism, and indulgence versus restraint.

The tests performed were quantitative and included means comparison tests for the first data set and group comparison tests in the second data set. The findings revealed valuable data in both the easily seen visible results and in the areas that lacked data. These findings suggest that culture not only influences CNA choices and behaviors but may also influence non-behaviors. The results of this research study suggest the need for additional research targeted toward specific cultural dimensions.