With the increasing frequency, complexity and sophistication of cyber attacks – such as Stuxnet, the Sony Hack – how is attribution done?