Cyber attribution identifies the threat actors of an attack in an investigation. Threat actors are the individuals, groups, organizations, or states that are responsible for conducting or sponsoring a cyberattack. Threat actors can have different motives, such as financial gain, espionage, sabotage, activism, or warfare. Cyber attribution can help investigators to determine the identity, location, affiliation, and motivation of the threat actors, as well as to hold them accountable and impose sanctions or legal actions. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 5: Security Policies and Procedures, Lesson
5.2: Incident Response, Topic 5.2.3: Cyber Attribution, page 5-14.

In the context of Linux systems, each active program is tracked using a process identification number (PID)
. The PID is a unique number that the system uses to refer to a specific process, which is an instance of an executed program. This allows the system and the SOC analyst to monitor and manage different processes, including those initiated by users, the system itself, or by applications.
References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) training material provides insights into how a Security Operations Center (SOC) operates and the tools and data used by analysts to monitor and investigate security incidents, including the tracking of active programs on system

Role-Based Access Control (RBAC) is an approach to restricting system access to authorized users based on their roles within an organization. It depends on the job functions that individual users have as part of their responsibilities and is designed to reduce administrative work by assigning roles based on job competency, authority, and responsibility. References: Cisco Cybersecurity Operations Fundamentals, Module 1: Security Concepts, Lesson 1.2: Data Protection, Topic 1.2.2: Access Control Models

Secure boot and restricting USB ports are two components that can reduce the attack surface on an endpoint.
The attack surface is the sum of all paths for data into and out of the environment. Reducing the attack surface means minimizing the number and complexity of these paths, and thus reducing the opportunities for attackers to exploit vulnerabilities or gain unauthorized access. Secure boot is a feature that ensures that only trusted and verified code can run during the boot process, preventing malware or unauthorized software from compromising the system. Restricting USB ports is a policy that limits the use of USB devices, such as flash drives or external hard drives, that can introduce malware or exfiltrate data from the endpoint.
[Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Module 4: Network Intrusion Analysis], [Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Module 5: Security Policies and Procedures]

With stronger data visibility, detailed information about the data in real-time is provided. This enhanced visibility allows for a more comprehensive analysis of network traffic, enabling security professionals to identify and mitigate threats more effectively. References := Cisco Cybersecurity Operations Fundamentals