Cyber threat Intelligence and Incident Response by:-Sandeep Singh

33
Cyber Threat Intelligence Sandeep Singh OWASP Delhi & null Delhi 30 January 2015

Transcript of Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Page 1: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Cyber Threat Intelligence

Sandeep SinghOWASP Delhi & null Delhi30 January 2015

Page 2: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

I am not an intelligence analyst but would love to be The topic is close to my heart Do not expect any FM (Freakin Magic ) The objective is to help attendees get familiar with the

world of threat intel

Disclaimer

Page 3: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Overview of Threat Intel Understanding Threat Intel What is Cyber Threat Intelligence Types of Threat Intel Intelligence Lifecycle Threat Intel – Classification & Vendor Landscape Threat Intel – Standards Open Source Threat Data/Intel Sources Bonus Agenda

Agenda

Page 4: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

What is Threat Intelligence?

Page 5: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

• Buzzword• Growing field- $250M in 2013- $1.5B in 2018

• Lots of new service providers entering the market

• and still maturing

Overview

Page 6: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Risk = Vulnerability * Threat * ImpactThreat = Intent * Capability

We like the term "Threat Actor". May be any of:• Cybercrime• State-sponsored• Hacktivism• Insider• Industry competition

Threat

Page 7: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Intelligencea.k.a. Renseignement, ré-enseignement

• Environment → Data → Information → Intelligence • Intelligence is a cyclic process• Analysis and contextualization• Models help counter diversity with abstraction

Page 8: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Accurate Relevant Timely Aligned Predictive Integrated

Actionable Intel

Page 9: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Cyber Area of interest/ of collection

Threat Subject of interest

Intelligence Process

Cyber Threat Intelligence

Page 10: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Key Elements of Threat Intel

Page 11: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Types of Threat Intel

Page 12: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

• Target audience: decision-makers• Focus on changing risks, high level topics• Geopolitics• Foreign markets• Cultural background

• Vision timeframe: years

Note: You may never have heard of this; could be explained by lack of maturity in orgs

Strategic TI

Page 13: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

• Target audience: defenders• Focus on current & future attacks:• Who, what, when?• Early warning on incoming attacks• Social media activity

• Vision timeframe: months, weeks, hours

Operational TI

Note: Hard for private companies to obtain on advanced attackers; traditionally collected through HUMINT / SIGINT

Page 14: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

• Target audience: architects & sysadmins• Focus on "TTPs":• Attacker modus operandi• Blue team / red team tools• Exfiltration / C2 methods• Persistence / stealth / deception mechanisms

• Vision timeframe: weeks to a year

Note: The most common form of threat intel (and marketing ) produced today; easy to obtain

Tactical TI

Page 15: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Technical TIa.k.a. Data

• Target audience: SOC, IR people• Focus on raw observables:• Indicators of compromise• Host and network artifacts• Yara, Snort, OpenIOC rules

• Vision timeframe: hours to years

Note: Man-hours are valuable. Technical TI is abundant. Processing should be as automated as possible.

Page 16: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Strategic Will feed SWOT, risk assessments, Porter Diamond model...

Tactical Cyber Kill-chain, Diamond model, ACH

Operational OODA Loop, Pyramid of Pain

Technical F3EAD, CIF, FIR, MISP, Malcom, Maltego,….

Weaponry

Page 17: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Intelligence Cycle

Page 18: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Intelligence Cycle applied to CTI in orgs

• Planning• What are you looking for?

• Collection• OSINT/HUMINT• Logs/Data points inside the org• Honeypots/nets/docs, social networks• FM-5

• Processing• Synthesizing the collected data so that intelligence analyst can

work• Analysis

• Finished Intelligence• Dissemination

• Present to the right audience

Page 19: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Thre

at In

tel

Threat Intel Platform

Threat Intel Enrichment

Threat Intel Integration

Open Source Intel (OSINT)

Human Intel (HUMINT)

Technical Intel

Adversary Intel

Vulnerability Intel

Strategic Intel

Threat Intel - Classification

Page 20: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Vendors

Page 21: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Can you guess the price of commercial threat Intel?

Page 22: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Symantec's 12-month retail subscription to its reputation feed costs $95,300 (INR 6100000 approx.)

FireEye threat intelligence appliances cost around $17000 at starting price and increase upto $175000 per unit

Page 23: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Managing Threat IntelAs tough as it sounds

Page 24: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

• MISP - Event-based indicator sharing• FIR - Incident management platform + indicator correlation• CRITS - Platform to store threat-related information• Malcom - Correlation of network traffic with maliciousness feeds• CIF - Query indicators + variety of output formats• Grr, osquery - Endpoint hunting

not mature…but lots of stuff is going on

Page 25: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

What’s so nice about “standards”

• MITRE - STIX, TAXII, CybOX, MAEC• IETF - IODEF• Mandiant - OpenIOC• VERIS• MANTIS

Page 26: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Black List IP Address Sources • emergingthreats.net• binarydefense.com• zeustracker.abuse.ch• palevotracker.abuse.ch• feodotracker.abuse.ch• sslbl.abuse.ch• spamhaus

Phishing URL Sources• openphish.com

Vulnerability Database Sources• scip.ch• cxsecurity.com• exchange.xforce.ibmcloud.com• packetstormsecurity.com

Honeypots/Honeynets

Open Source Threat Data Sources

Page 27: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Bonus Agenda

Page 28: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

• Developed by REN-ISAC• http://csirtgadgets.org/collective-intelligence-framework/• Does not generate data, simply takes sources normalizes it and

then outputs by given types• Limited in the types of data it can handle

– URLs– Domains– IPs – MD5s

• Certainly more to threat intel than this, but it’s a start

CIF: Collective Intelligence Framework

Page 29: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

CIF Architecture

Page 30: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

• A target-centric approach to intelligence analysis

• Bridge between operations and intelligence• a.k.a. “Hunting”

F3EAD

Page 31: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

• TI is closely related to traditional intelligence• Models help but have limitations• The quality of your TI directly influences the quality of your

response• Tools to store, analyze, and share intelligence exist, but

there's room for improvement

Conclusion

Page 32: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

http://sroberts.github.io http://direct.tomchop.me/slides http://frodehommedal.no/presentations/first-tc-oslo-

2015 https://www.mwrinfosecurity.com/system/assets/

909/original/Threat_Intelligence_Whitepaper.pdf Google

References:

Page 33: Cyber threat Intelligence and Incident Response by:-Sandeep Singh

Thank you,Sandeep Singh – Chapter Leader, OWASP Delhi & null [email protected]@null.co.in@Sandy1sm

Q & A


How To Turbo-Charge Incident Response With Threat Intelligence

How To Turbo-Charge Incident Response With Threat Intelligence

Assessing Targeted Attacks in Incident Response Threat ... · PDF fileAssessing Targeted Attacks in Incident Response Threat Correlation ... Indicators, Actors • Ensure ... Assessing

Assessing Targeted Attacks in Incident Response Threat ... · PDF fileAssessing Targeted Attacks in Incident Response Threat Correlation ... Indicators, Actors • Ensure ... Assessing

RSA Incident Response Threat Emerging Threat Profile: Shell_Crew

RSA Incident Response Threat Emerging Threat Profile: Shell_Crew

Leveraging Threat Intelligence In Incident Response/Management€¦ · Securosis — Leveraging Threat Intelligence in Incident Response/Management "3 Cisco (NASDAQ: CSCO) is the

Leveraging Threat Intelligence In Incident Response/Management€¦ · Securosis — Leveraging Threat Intelligence in Incident Response/Management "3 Cisco (NASDAQ: CSCO) is the

LOCK DOWN (Serious Threat or Incident) - Joseph …josephvargaschool.nsw.edu.au › wp-content › uploads › 2016 › 01 › ...LOCK DOWN (Serious Threat or Incident) Students should

LOCK DOWN (Serious Threat or Incident) - Joseph …josephvargaschool.nsw.edu.au › wp-content › uploads › 2016 › 01 › ...LOCK DOWN (Serious Threat or Incident) Students should

ICS, SCADA, and Non-Traditional Incident … ICS, SCADA, and Non-Traditional Incident Response Kyle Wilhoit Threat Researcher, Trend Micro

ICS, SCADA, and Non-Traditional Incident … ICS, SCADA, and Non-Traditional Incident Response Kyle Wilhoit Threat Researcher, Trend Micro

Security Operations Maturity Model€¦ · To facilitate collaboration across members of the threat detection, threat investigation, and incident response teams, security teams likely

Security Operations Maturity Model€¦ · To facilitate collaboration across members of the threat detection, threat investigation, and incident response teams, security teams likely

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

CYBER THREAT INTELLIGENCE TO IMPROVE INCIDENT RESPONSE · 2017-11-28 · CYBER THREAT INTELLIGENCE TO IMPROVE INCIDENT RESPONSE Cyberdrill, Tanzania MIKHAIL NAGORNY ... COMMERCIAL

CYBER THREAT INTELLIGENCE TO IMPROVE INCIDENT RESPONSE · 2017-11-28 · CYBER THREAT INTELLIGENCE TO IMPROVE INCIDENT RESPONSE Cyberdrill, Tanzania MIKHAIL NAGORNY ... COMMERCIAL

INCIDENT STATUS SUMMARY (ICS 209) - FEMA...Current Incident Threat Summary and Risk Information in 12-, 24-, 48-, and 72-hour timeframes and beyond. Summarize primary incident threats

INCIDENT STATUS SUMMARY (ICS 209) - FEMA...Current Incident Threat Summary and Risk Information in 12-, 24-, 48-, and 72-hour timeframes and beyond. Summarize primary incident threats

TIPS Threat Assessment, Incident Management and Prevention Services.

TIPS Threat Assessment, Incident Management and Prevention Services.

Incident Overview & Bomb Threat Protocols and Protective ...20Threat... · Threat poses minimum risk to victim and public safety. ... • Doesn’t correlate to a received threat

Incident Overview & Bomb Threat Protocols and Protective ...20Threat... · Threat poses minimum risk to victim and public safety. ... • Doesn’t correlate to a received threat

RSA Incident Response: Emerging Threat Profile€¦ · RSA Incident Response incident response RSA Incident Response: Emerging Threat Profile . Shell_Crew . January 2014

RSA Incident Response: Emerging Threat Profile€¦ · RSA Incident Response incident response RSA Incident Response: Emerging Threat Profile . Shell_Crew . January 2014

222 80 123 · Incident Containment Analyze & Mitigate Novel Threat Interpretation STAGE 2 ADVANCED THREAT PROTECTION STAGE 3 Incident Resolution Investigate & Remediate Breach Threat

222 80 123 · Incident Containment Analyze & Mitigate Novel Threat Interpretation STAGE 2 ADVANCED THREAT PROTECTION STAGE 3 Incident Resolution Investigate & Remediate Breach Threat

Leveraging Threat Intelligence for Cyber Security in · PDF fileCorrelate incident and threat indicators to the associated threat context to inform impact value and prioritization.

Leveraging Threat Intelligence for Cyber Security in · PDF fileCorrelate incident and threat indicators to the associated threat context to inform impact value and prioritization.

OPERATIONALIZING INCIDENT RESPONSE - CDM Media › Kansas_City_Summit_RSA...Cultivate Threat Intelligence for remaining Threat Priorities. 3. Establish IR Plan around your Threat Priorities

OPERATIONALIZING INCIDENT RESPONSE - CDM Media › Kansas_City_Summit_RSA...Cultivate Threat Intelligence for remaining Threat Priorities. 3. Establish IR Plan around your Threat Priorities

INFORMATION TECHNOLOGY SECURITY THREAT MANAGEMENT … · Information technology security threat management combines IT security disciplines of threat detection, incident management,

INFORMATION TECHNOLOGY SECURITY THREAT MANAGEMENT … · Information technology security threat management combines IT security disciplines of threat detection, incident management,

THREAT COMPASS - Blueliv...Threat Compass. Targeted threat intelligence saves time and maximizes security resource while accelerating threat detection, incident response performance

THREAT COMPASS - Blueliv...Threat Compass. Targeted threat intelligence saves time and maximizes security resource while accelerating threat detection, incident response performance

Digital Guardian Endpoint Detection & Response · aware endpoint threat detection and response (EDR) solution. Digital Guardian’s incident responders and threat hunters developed

Digital Guardian Endpoint Detection & Response · aware endpoint threat detection and response (EDR) solution. Digital Guardian’s incident responders and threat hunters developed

RSA Incident Response: Emerging Threat Profile · PDF fileRSA Incident Response: Emerging Threat Profile . Shell_Crew . ... Installation of Web shells ... they are also referred to

RSA Incident Response: Emerging Threat Profile · PDF fileRSA Incident Response: Emerging Threat Profile . Shell_Crew . ... Installation of Web shells ... they are also referred to