Threat Intelligence 101 - Steve Lodin - Submitted
3 likes1,519 views
This document provides an overview of threat intelligence and how organizations can build threat intelligence programs. It discusses what threat intelligence is, why organizations should care about it, and how threat intelligence can be used for attack prevention, detection, forensics, and hunting. It also covers threat intelligence technologies, platforms, feeds, sharing approaches, and common challenges organizations may face when developing threat intelligence capabilities. The goal is to help organizations understand threat intelligence and evaluate their own maturity to incorporate these strategies.
Ad
More Related Content
What's hot (20)
Viewers also liked (7)
Ad
Similar to Threat Intelligence 101 - Steve Lodin - Submitted (20)
Ad
Threat Intelligence 101 - Steve Lodin - Submitted
- 2. Getting Smarter Steve Lodin Sallie Mae Bank Director, Cyber Security Operations
- 3. Threat Intelligence 101 • Learn about Threat Intelligence • What/Why/How • Technology • Be able to evaluate your organization’s maturity • Understand some of the Gotchas
- 4. Traffic Light Protocol Before we begin… https://www.us-cert.gov/tlpWeare:
- 5. Acronyms • CND – Cyber Network Defense • CISA – Cyber Information Sharing Act • CTI – Cyber Threat Intelligence • CybOX – Cyber Observable eXpression • CTIIC - Cyber Threat Intelligence Integration Center • DGA – Domain Generation Algorithm • IOA – Indicators of Attack • IOC – Indicators of Compromise • ISAC / ISAO – Information Sharing and Analysis Center / Organization • MD5 – Message Digest v5 • MRTI – Machine Readable Threat Intelligence • NCCIC - National Cybersecurity and Communications Integration Center • OSINT – Open Source Intelligence • OTX – Open Threat eXchange • SHA1/SHA2 – Secure Hash Algorithm v1 and 2 • SIEM – Security Information and Event Management • STIX – Structured Threat Information eXchange • TAP – Threat Analytics Platform • TAXII – Trusted Automated eXchange of Indicator Infomation • TLP – Traffic Light Protocol • TTP – Tactics, Techniques, and Procedures Before we begin…
- 6. Example Threat Intelligence Before we begin… What/How Who/Why/How Investigate Implement Hunt Share
- 7. What / Why / How
- 8. Gartner – May 2013 What is Threat Intelligence? Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard. What / Why / How
- 9. Where are we? What / Why / How Audience Participation: Are you aware of CTI Sharing…?
- 10. Where are we? What / Why / How Audience Participation: Do you think it is valuable…?
- 11. Why should you care? • Sobering Stats • There were 38% more cyberattacks in 2015 than in 2014, along with a 56% rise in the theft of intellectual property • In the U.S., a mind-boggling 169 million personal records were compromised, across the major sectors of financial, business, education, government and healthcare • In 2015 ISACA survey, 86% of nearly 3500 organizations believed there is a shortage of skilled IT security professionals to handle these problems What / Why / How TechRepublic Article 3/15/2016
- 12. Why should you care? • Tactical Perspective • Proactively detect or defend against attacks before they happen • Diagnose infected corporate systems • Breach Discovery • Discovery of an APT • Strategic Enhancements • Track threats targeting your company or industry • Use of Analysis to Improve Risk Assessments • Change in Defenses • Community Posture • Be a good neighbor – help support your sharing community What / Why / How
- 13. How does a company use Threat Intelligence? • Attack prevention/detection • Primary use case • Forensics • Helping to investigate attacks and compromises • Hunting • Using big data to discover anomalies What / Why / How
- 14. What “data” do you see? • Compromised Devices • Systems communicating with known bad sites and C&Cs • Malware Indicators • IOAs and IOCs • IP Reputation • Geolocation • Known bad Tor/Proxy/VPN providers • Watering Holes • Command and Control Networks • Malware origination, botnet controllers • Phishing Messages • Business Email Compromise and Email Attack Campaigns What / Why / How
- 16. Pain Level David Bianco What / Why / How
- 17. What does the team do? What / Why / How What’s coming at us How we respond
- 18. What does the team do? What / Why / How Threat Intelligence Sources Security Solutions Distribute Indicators of Compromise Nothing Found Investigate Forrester Research + Steve
- 19. Here is how we handle threats! What / Why / How Sometimes that can backfire!
- 20. Sharing • Threat intelligence sharing is considered the most effective in preventing attacks. • According to respondents, an average of 39% of all hacks can be thwarted because the targeted organization engaged in the sharing of threat intelligence with its peers. • Additionally, out of all technologies available, threat intelligence sharing was cited by 55% of respondents as the most likely to prevent or curtail successful attacks. • Requires an excellent IT security infrastructure • The platform also must be part of a larger, global ecosystem that enables a constant and near real time sharing of attack information that can be used immediately to apply protections to prevent other organizations in the ecosystem from falling victim to the same or similar attacks. What / Why / How Ponemon Report: Flipping the Economics of Attacks Jan 2016
- 21. Types of Sharing • OSINT • Share with the world • ISACs • Share your attacks and IOCs with your industry peers • Anonymous • Share your attacks and IOCs with peers under no attribution • Cybersecurity Information Sharing Act • Share your data with the DHS and DOJ What / Why / How
- 22. How can you succeed? 1. Understand Threat Intelligence 2. Achieve Organizational / Leadership / Board Buy-in • Requires approval for People / Process / Technology 3. Determine Necessary Skills and Staffing • Options are internal, outsourced, MSSP 4. Buy Appropriate Technology Solutions • RFI/RFP and PoC 5. Choose the Right Feeds 6. “A Cyber Hunting We Will Go” What / Why / How
- 23. Technology
- 24. Threat Intelligence Feeds • Internal (+$0-$$$, +Info, +Private) • Security logs and network data, including DNS logs, email logs, web proxy logs, etc… • OSINT and Open Source Data ($0, +Info, +Work) • Open source intelligence (OSINT) providers comb through a multitude of information sources, looking for intelligence about possible threats against your company. • OSINT feeds give you needed intelligence to prevent attacks before they happen. • ISACs (+$, ++Industry, +Info) • Information sharing and analysis centers (ISAC) provide threat intelligence to specific industries. Examples FS-ISAC, MS-ISAC, NH-ISAC and HITRUST Cyber Threat XChange • Commercial (++$$, ++Info) • Threat intelligence feeds from commercial companies contain proprietary research determined by how the company detects threats. • Some companies focus mainly on threat intelligence streams. Other companies offer threat intelligence streams as part of an integrated suite of security services. Technology Audience Participation: Who has a team using…?
- 26. OSINT & Commercial Feed Example Technology
- 30. Platforms • These are threat intelligence aggregation, analysis, and collaboration environments. • Provides visibility across feed sources, threat classifications, network, applications, host elements and many other threat observables. Technology
- 31. Platform Functions • Ingest threat intelligence and normalize it • Rate intelligence sources (over time) • Provide an analyst workspace • Provide visualization and pivoting • Provide enrichment • Enable internal and external collaboration/sharing Technology
- 33. ThreatConnect Level 4 – Well-defined Threat Intelligence Program Operational and Strategic Operational Playbooks, C-level Alignment, Integration with Biz, IT, Sec Leading Industry and/or Technology TI Community Level 3 – Threat Intelligence Platform in Place Dedicated Personnel, Multi-tier People/Process/Tech Bi-directional Sharing, Participation in ISAC Level 2 – Expanding Threat Intelligence Capabilities Team and SOC Threat Intelligence Platform Hunt and Respond, Internal and External Level 1 – Warming up to Threat Intelligence Small Team Some Automation Internal Focus Level 0 - Unclear where to start No Team Manual, incident based efforts Internal Focus Maturity
- 34. Hunting Maturity Model Maturity David Bianco – Oct 2015
- 35. Gotchas
- 36. Overloading the team • To say that the threat landscape is overwhelming is the understatement of the year. Targeted attacks are on the rise with increasing sophistication, and our detection and response capabilities are woefully inadequate. Advanced persistent threats, espionage, spear phishing, and disrupted denial of service attacks dominate the headlines. Gotchas
- 37. Got Intelligence? Now what? • When the incoming sources start adding up, how do you manage that efficiently? • Need to scale up to a platform • Wouldn’t it be easier to have high confidence threat indicators loaded into your security systems for detection and immediately take action? • Orchestration • Easier said than done Gotchas
- 38. Things are not always as they seem • Location, Reputation, and Confidence Conflicts • Indicators can age Gotchas
- 39. Things are not always as they seem • Over compensating for every threat that may not impact your company Gotchas
- 40. There is no silver bullet • Quality matters more than quantity when choosing feeds • It's Not What You Know, It's What You Do With It • It’s not so much the collection or processing of intelligence. • It's the communication of intelligence between different areas of the organization. Red teams, security operations centers (SOCs), incident response (IR), vulnerability management… Gotchas
- 41. Closing
- 42. Threat intelligence cannot be bought Rather, the threat intelligence journey is a multistep road map 1) lays a solid foundation of essential capabilities 2) establishes buy-in 3) identifies required staffing and skill levels 4) establishes your intelligence sources 5) drives actionnable intelligence Closing
- 43. Possible Solution Providers Closing Forrester Research 2015
- 45. Why (or Why Not)? Closing Audience Participation: Do you feel stronger now about using TI than when we started today...? Is TI more valuable now?
- 46. Why? The power of threat intelligence is it allows somebody else's detection to be your prevention. Orchestration and bi- directional participation signals growing in maturity. Closing Median Days to Breach Detection FireEye/Mandiant
- 48. Thank you! Email: [email protected] Twitter: @stevelodin LinkedIn: http://www.linkedin.com/in/stevelodin