In this session, Ms. Rolston will identify some of the characteristics of teams that will create and perform cyber attacks, including those with ICS cyber weapons. - What the tier levels are and how we define them - Influence of Tier 1 researchers on the researchers around them - What advanced threat characterization can tell us about a threat actor, i.e. the Google Aurora attacks were interesting because of the difference in point of entry exploits (browser, app), apparent comfort as Microsoft power users rather than Linux style attackers hacking Microsoft products. She will use the Red October campaign as an example of the attack team profiling characteristics. This is one example that moves away from the focus on suspected attackers from China.