Musing about the differences and similarities between paleontologists vs. threat intel – a thread with above all unanswered Qs.
1/7 In a wonderful TEDx talk palaeontologist Jack Horner asks the question: “where are all the baby dinosaurs?” "Why is there no smaller version of a Tyrannosaurus Rex in museums?"
2/7 The answer was first provided in an article published in 1975 by Prof. Peter Dodson. He revealed that dinosaurs didn’t grow like reptiles but instead grew like birds. Bird species quickly grow to 80% of their mature size before their crest starts to grow.
3/7 So, if you knew nothing about their growth behaviour, and you found a young and old bird of the same species you might confuse them and think they are two different ones.
4/7 This finding didn’t sink in as much as it should have. Because “Scientists have egos. And scientists like to name dinosaurs. …Everyone likes to have their own animal that they named. And so every something that looked a little different, they named it something different.”
5/7 I don’t want to renew the conversation here about the value of naming conventions – for a good primer see @cyb3rops piece. medium.com/@cyb3rops/the-…
6/7 But, I would be curious to hear people’s thoughts on non-linear behavior and development of threat actors in this respect. The difficulty of tracking as a threat actor matures, gets backed by a state etc.
7/7 and what use are conventional tracking models/frameworks for this? If at all. Can the threat intel community learn from models in biology – like Dodson paper on functional growth of an alligator? …lpublications.onlinelibrary.wiley.com/doi/10.1111/j.…
