Introduction to Threat Intelligence

22

Click here to load reader

Transcript of Introduction to Threat Intelligence

Page 1: Introduction to Threat Intelligence

1All material confidential and proprietary

Interop 2016

COLLECTING AND USING THREAT INTELLIGENCE DATA

Page 2: Introduction to Threat Intelligence

2All material confidential and proprietary

INTRODUCTIONS

Page 3: Introduction to Threat Intelligence

3All material confidential and proprietary

WE MAKE THREAT INTELLIGENCE ACCESSIBLE

ThreatConnect unites cybersecurity people, processes and technologies behind a cohesive intelligence-driven defense. Designed for security teams at all maturity levels, ThreatConnect enables organizations to maximize the value of their security technology investments, combat the fragmentation of their security organizations, and enhance their infrastructure with relevant threat intelligence.

Page 4: Introduction to Threat Intelligence

4All material confidential and proprietary

ABOUT ME

Bhaskar Karambelkar,Data Science Lead

Page 5: Introduction to Threat Intelligence

5All material confidential and proprietary

WHAT IS GOING ON?

Page 6: Introduction to Threat Intelligence

6All material confidential and proprietary

VERIZON 2016 DBIR – DETECTION DEFICIT

• Attackers are getting faster and we are not catching up.•Most compromises happen within

days.•Most compromises are discovered

weeks and months out if not years.

WHAT IS GOING ON?

Source: Verizon 2016 Data Breach Investigations Report.

Page 7: Introduction to Threat Intelligence

7All material confidential and proprietary

VERIZON 2016 DBIR – DISCOVERY METHODS

• Internal discovery is less and less common.• Third Party (often Victims) and L&E

are the ones who discover breaches.

WHAT IS GOING ON?

Source: Verizon 2016 Data Breach Investigations Report.

Page 8: Introduction to Threat Intelligence

8All material confidential and proprietary

THREAT INTELLIGENCE

Page 9: Introduction to Threat Intelligence

9All material confidential and proprietary

GARTNER HYPE CYCLE

SOURCE: http://www.gartner.com/technology/research/methodologies/hype-cycle.jsp

Page 10: Introduction to Threat Intelligence

10All material confidential and proprietary

THREAT INTELLIGENCE (TI)•Gartner defines TI as ‘evidence-based knowledge, including context, mechanisms,

indicators, implications, and actionable advice about an existing or emerging menace or hazard to assets, that can be used to inform decisions regarding the subject’s response to that menace or hazard’.1

• But often TI is mistaken for just the Indicators of Compromise (IOCs) and ergo has become a marketing buzzword. LET US CHANGE THAT PERCEPTION.

• TI works best in collaboration with other security practices, Vulnerability & Patch Management (VM), Security Operations (SOC), Incident Response (IR) etc.

• It is an important piece in the data-driven approach to Threat Management.

Page 11: Introduction to Threat Intelligence

11All material confidential and proprietary

THE THREAT INTELLIGENCE PROCESS

Collect

Enrich

Connect

Contextualize

Analyze & Prioritize

Operationalize

External Sources

Whois/ passive-DNS/ GeoIP

Firewalls, IDS/IPS, Vuln Scanners, Endpoint Sec.

SEIM

Page 12: Introduction to Threat Intelligence

12All material confidential and proprietary

THREAT INTELLIGENCE PROGRAM MATURITY MODELWell-DefinedTIProgram

TIProgramInPlace

Expanding

WarmingUp

Notsurewheretostart

Page 13: Introduction to Threat Intelligence

13All material confidential and proprietary

CHARACTERISTICS OF GOOD TI• RELEVANT

• TIMELY

• COMPREHENSIVE

• ACCURATE

• All these make it ACTIONABLE.

Page 14: Introduction to Threat Intelligence

14All material confidential and proprietary

FEEDS, FEEDS, FEEDS

Page 15: Introduction to Threat Intelligence

15All material confidential and proprietary

TI FEEDS AND DONE, RIGHT ?... WRONG!• Subscribing to a bunch of open and/or premium external feeds and sticking them in your

firewall, IDS/IPS, SIEMs will not work. WHY ?• Too many false positives, too much irrelevant data, exhausted and overworked security

analysts, false sense of security.• If anything this will hurt your security posture.• So feeds are useless then? Not quiet.• External feeds are only a piece of the TI management process. They add a unique value to

the process but are not the be all and end all of TI.• Vetted sources can help drive down the false positives. • Contextualized/Enriched/Connected indicator sources can help Ops, IR teams make

proper decisions and prioritize correctly.

Page 16: Introduction to Threat Intelligence

16All material confidential and proprietary

SO, WHICH FEEDS DO I NEED?WRONG QUESTION, YOU FAIL AT JEOPARDY!• Correct Question: •What are the key areas in my defense that need strengthening based on my security risk

assessment and threat modeling ?

• So what do I do?• Look for vetted feeds.• Compare and contrast premium vendor feeds. • Evaluate your subscribed feeds.• Be part of a Industry specific sharing community (FS-ISAC, ONG-ISAC etc.)

BEST INTEL COMES FROM YOUR OWN ORGANIZATION.

Page 17: Introduction to Threat Intelligence

17All material confidential and proprietary

THREAT INTELLIGENCE PLATFORM

Page 18: Introduction to Threat Intelligence

18All material confidential and proprietary

WHAT IS A TI PLATFORM (TIP) AND WHY DO I NEED ONE ?A product to manage your threat intelligence processes in one central place.

Allows you to:• subscribe to internal/external feeds.• enrich/connect/contextualize/prioritize your data.• integrate your TI data with security tools (Firewalls, IDS/IPS, WAFs, VM, SIEMs).• keep track of historic data for reference and trend analysis.• interact with common interest communities for sharing data.

And also allows:• various security teams (IR, SOC, IT) to collaborate on threat data.• your CIO/CISO and other senior execs to gain insights for strategic decision making.

Page 19: Introduction to Threat Intelligence

19All material confidential and proprietary

HOW DO I GET ONE?Find a TIP vendor!

• Things to consider when looking for a vendor:o Integration with existing tools.o Hosting options (multi-tenant, on-prem, private cloud)o Collaboration, Community supporto Reporting and Dashboards.o Service provider support.

Your TIP needs to be a team player in your security infrastructure and aid you in your tactical/operational/strategic threat management needs.

Page 20: Introduction to Threat Intelligence

20All material confidential and proprietary

ACTING ON THREAT INTELLIGENCE

Page 21: Introduction to Threat Intelligence

21All material confidential and proprietary

PUT THOSE IOCS RIGHT TO BED WORK!•Make your TIP the central nervous system of your security infrastructure.

• There should be bi-directional communication between your TIP and your firewalls/SIEMs/IDS/IPS/Endpoint Security.

• Not all devices need all IOCs, segregate by device type as well as kill chain target.

• Vet good IOCs, share them as much as possible/allowed with peers.

•Mark bad IOCs (known goods or false positives) but don’t completely get rid of them as they may provide context.

Page 22: Introduction to Threat Intelligence

22All material confidential and proprietary

THANK YOU!• Comments/Questions

• http://www.treatconnect.com/

• https://twitter.com/bhaskar_vk• https://www.linkedin.com/in/bhaskarvk


Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Threat Intelligence Briefing

Threat Intelligence Briefing

Using Threat Intelligence

Using Threat Intelligence

NETSCOUT THREAT INTELLIGENCE REPORT · NETSCOUT Threat Intelligence LETTER FROM NETSCOUT THREAT INTELLIGENCE Today, attackers can release enormous terabit-per second-scale DDoS attacks

NETSCOUT THREAT INTELLIGENCE REPORT · NETSCOUT Threat Intelligence LETTER FROM NETSCOUT THREAT INTELLIGENCE Today, attackers can release enormous terabit-per second-scale DDoS attacks

Introduction to Threat Containment, Malware & DNS · Threat Intelligence Data to Mitigate Threats Easily Acquire, Aggregate and Distribute Threat Intelligence Data Out-of-the-box

Introduction to Threat Containment, Malware & DNS · Threat Intelligence Data to Mitigate Threats Easily Acquire, Aggregate and Distribute Threat Intelligence Data Out-of-the-box

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Enterprise & Cyber … Threat Intelligence Enterprise & Cyber Security August 2017 Copyright Fujitsu Limited 2017 Global Impact Fujitsu Cyber Threat Intelligence

Cyber Threat Intelligence Enterprise & Cyber … Threat Intelligence Enterprise & Cyber Security August 2017 Copyright Fujitsu Limited 2017 Global Impact Fujitsu Cyber Threat Intelligence

SMARTER Threat Intelligence · Our threat intelligence is derived from the Webroot® Threat Intelligence Platform, our proprietary cloud-based security analysis architecture designed

SMARTER Threat Intelligence · Our threat intelligence is derived from the Webroot® Threat Intelligence Platform, our proprietary cloud-based security analysis architecture designed

Artificial Intelligence in Business, threat or opportunity · Artificial Intelligence in Business, threat or opportunity INTRODUCTION: What is AI (Artificial Intelligence) Artificial

Artificial Intelligence in Business, threat or opportunity · Artificial Intelligence in Business, threat or opportunity INTRODUCTION: What is AI (Artificial Intelligence) Artificial

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

Threat monitor Threat Intelligence Report Q1 2020

Threat monitor Threat Intelligence Report Q1 2020

Cyber Threat Intelligence Workshop Series - Foundation · 2020. 12. 22. · Introduction and Objective Cyber Threat Intelligence (CTI) Workshop Series is a 5-days workshop, which

Cyber Threat Intelligence Workshop Series - Foundation · 2020. 12. 22. · Introduction and Objective Cyber Threat Intelligence (CTI) Workshop Series is a 5-days workshop, which

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

Certified Threat Intelligence Analyst...04 Certified Threat Intelligence Analyst Why Organizations Need A Threat Intelligence Team Traditional approaches to malicious attacks are slowly

Certified Threat Intelligence Analyst...04 Certified Threat Intelligence Analyst Why Organizations Need A Threat Intelligence Team Traditional approaches to malicious attacks are slowly

Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity.

Threat Intelligence in Splunk · 2017-10-13 · Introduction Threat Intelligence in Action ... Security Threat Intelligence framework to raise the risk score of an asset or identity.

Threat Intelligence: Collecting, Analysing, EvaluatingThreat Intelligence: Collecting, Analysing, Evaluating mwrinfosecurity.com CPNI.gov.uk cert.gov.uk 4/36 Threat intelligence is

Threat Intelligence: Collecting, Analysing, EvaluatingThreat Intelligence: Collecting, Analysing, Evaluating mwrinfosecurity.com CPNI.gov.uk cert.gov.uk 4/36 Threat intelligence is

THREAT INTELLIGENCE - Microsoft · PDF fileSOTION PIM Threat Intelligence 2 Introduction To improve detection, response and resolution of relevant threats to their business, security

THREAT INTELLIGENCE - Microsoft · PDF fileSOTION PIM Threat Intelligence 2 Introduction To improve detection, response and resolution of relevant threats to their business, security

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence