Operationalizing Threat Intelligence · Operationalizing Threat Intelligence David Foose Emerson...

Emerson Confidential 1Emerson Confidential 1

Operationalizing Threat

Intelligence

David Foose

Emerson

August 27, 2018

22

Who Am I

• Ovation Security Solutions Program Manager

• Old Novell/Notes Admin

• [email protected]

• @DaveFoose

• www.linkedin.com/in/davidfoose

DHS Alert (TA18-074A)https://www.us-cert.gov/ncas/alerts/TA18-074A

mailto:[email protected]

33

What is Threat Intelligence?

• Threat Intelligence is data collected, organized, analyzed and refined about potential or current attacks:

– Indicators of Compromise

– Tradecraft

– (possible)Attribution

• Helps users understand the risks of the most common and severe threats

44

Common Terms

• Information Sharing and Analysis Centers (ISAC)

• Indicators of Compromise (IOC)

• Tradecraft or Tactics Techniques and Procedures (TTPs)

• Remote Access Tool (RAT)

• Open Source Intelligence (OSint)

• Command and Control (C2 or C&C)

• Advanced Persistent Threat (APT)

• Attribution/False Flags

55

Attribution Explains Motivation

• Attribution is hard

• Skiddies

• Nation State

• Crimeware

• Hacktivists

66

Traffic Light Protocol

• Limited Disclosure

• Restricted to peers, community, and sector

• Not for disclosure

• Direct participants only

• Exchanged verbally or in person

• Limited disclosure

• Restricted to “Need to Know” Organizational members or direct partners

• No disclosure limitations

• Subject to standard copyright rules

77

A Rose By Any Other Name…

88

Sources of Threat Intelligence

Industry GroupsCERT

Government

Vendor Informal or

Self-Gather

99

Ovation Cyber Emergency Response Team (Ovation-CERT)

Contact Us with Your Concerns

[email protected]

1-800-445-9723, Option 3

Ovation-CERT Alerts

Ovation Users’ Group Website

https://www.ovationusers.com

Advisories & Security Patches

Ovation Cybersecurity Alerts

• Monitors news media, industry resources and your inquiries for cyber threats and publicized vulnerabilities

• Evaluates impact to the Ovation product line

• Responds with information and mitigation actions to keep your systems secure

• Notifies end-users via Ovation-CERT alerts to keep you informed

1010

Common Elements to Threat Intel

File Attributes Network Special

• Names

• Locations

• Known hashes

• URL/Web Addresses

• IPs

• YARA Sigs

• Known Exploits

• Unique TTPs

1111

Example of Threat Intel – Vendor Document

Noted Features

Reporting Party

Explanation of Problem

Custom Mitigations

https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf

1212

Example of Threat Intel – Research Document

Noted Features

Deep Examination of the threat

Code Review

Stepping analysis of payload & capability

https://dragos.com/blog/crashoverride/CrashOverride-01.pdf

1313

Example of Threat Intel – CERT Alert

Noted Features

Reporting Party

Explanation of Problem

High Level Mitigations

Reference Links

IOCs/YARA (sometimes)

https://ics-cert.us-cert.gov/alerts

1414

Good Morning, Defender

What Are My Actions?

Find/Verify the report

Is This New?

Immediate Response to C-level

Leverage Relationships

Find Technical Source

Defend/Hunt

Follow up

1515

Walk Through of Alert (TA18-074A)

DHS Alert (TA18-074A)https://www.us-cert.gov/ncas/alerts/TA18-074A

1616

Walk Through of Alert (TA18-074A) – TLDR Evaluation

1717

Walk Through of Alert (TA18-074A) – Defense Information

1818

Walk Through of Alert (TA18-074A) – Defense Information

1919

Grizzly Steppe/Burlington Electric

2020

Grizzly Steppe/Burlington Electric

2121

What can I do?

• Get an Asset List

• Find/Acquire Access

• Gap Analysis

• Hire the Right People

2222

Emerson Confidential


Emerson Corporate Template

Version 7.16


Please Do Not Modify/Change the Layouts

• For the sake of consistency and to maintain our company’s profession image, please DO NOT modify the existing layouts.

• The template has been carefully and thoughtfully designed according to the latest brand and image standards, and tested thoroughly.

• The comprehensive layouts and color palette contain numerous options to make your presentations look professional.

• Any layout changes must be approved my Emerson Corporate

• Version 7.16 fixes a bug with footers an page numbers


Three Ways to Apply A Slide Layout

This template is a large variety of slide layouts and there are three ways you can apply them.

1. Select Layout - arrow, under the home tab, to select and insert any layout.

2. Select New Slide - arrow, under the Home tab, to select and insert any layout.

3. Right-click anywhere on the slide, select Layout, to view and select any layout.


Condensing Your Slide Master

If you prefer using just a few of the most popular of the slides/layouts

1. Download a “Condensed Version” with 10 commonly used basic layouts on Global Marketing Portal

2. Create your own slide master by removing the layouts that you don't regularly use

a. Select the View tab, in the Master Views group, click Slide Master.

– Open Slide Master view, a blank slide master with the default associated layouts appears.

– NOTE: In the slide thumbnail pane, the slide master is the larger slide image at the top, and the associated layouts are positioned beneath the slide master and indented to the right.

b. To remove any of the built-in slide layouts from the default deck

– In the slide thumbnail pane, right-click each slide layout that you want to delete.

– click Delete Layout on the shortcut menu.

– NOTE: You can only delete layouts from the master if the slide is NOT being used in the deck. You must delete the slide from the deck first before you can delete in the master view.

d. On the Slide Master tab, in the Close group, click Close Master View.

https://sales.emersonprocess.com/marketing/mediaspecific/PowerPoint-Templates/Pages/default.aspx

Text Slide Options


Agenda Sample

Presenter Name Section Title








One Column with No Tombstone

• Body text is RGB: 63/64/64, the second color in the color theme order

• Title text is RGB: 0/75/141, the fifth color in the color theme order

• ARIAL font size 16 or larger is strongly recommended, first level body text is Arial 24 pt

• Date formats: Please avoid “FY” before fiscal years, any Emerson financial data is assumed to be FY when just the year is shown

• Highlight important points by bolding text

– Body text is RGB: 63/64/64, the second color in the color theme order

– Title text is RGB: 0/75/141, the fifth color in the color theme order


• Best practice: No more than 6-9 bullets


One Column with No Tombstone and No Logo









• Best practice: No more than 6-9 bullets

Emerson Confidential 31Emerson Confidential 31Emerson Confidential 31Emerson Confidential 31

One Column with One Line External Tombstone

• The blue tombstone layout options should be used for all external, customer-facing presentations and can be used for internal presentations, other than for planning conferences where yellow is the preferred option






One Line, EXTERNAL Blue Tombstone


One Column with Two Line External Tombstone







Two Line, EXTERNAL Blue Tombstone

Text is 24pt, Bold and Title Case


One Column with Three Line External Tombstone







Three Line, EXTERNAL Blue Tombstone


Three Line Key Takeaway


One Column with One Line Internal Tombstone

One Line, INTERNAL ONLY Yellow Tombstone

• The yellow tombstone layout options are for internal presentations and specifically for planning conferences, as this is the standard that Emerson corporate uses







One Column with Two Line Internal Tombstone

Two Line, INTERNAL ONLY Yellow Tombstone









One Column with Three Line Internal Tombstone







Three Line, INTERNAL ONLY Yellow Tombstone









Two Column Slide with No Tombstone












Two Column Slide with No Tombstone and No Logo







Two Column Slide with Heading and No Tombstone

Insert Heading Insert Heading












Two Column Slide with Heading and No Tombstone and No Logo













Two Column Slide with Heading and One Line External Tombstone

One Line, EXTERNAL Blue Tombstone for Key Message


The blue tombstone layout options should be used for all external, customer-facing presentations and can be used for internal presentations, other than for planning conferences where yellow is the preferred option.



Two Column Slide with Heading and Two Line External Tombstone

Two Line, EXTERNAL Blue Tombstone






Two Column Slide with Heading and Three Line External Tombstone

Three Line, EXTERNAL Blue Tombstone







Two Column Slide with Heading and One Line Internal Tombstone

One Line, INTERNAL ONLY Yellow Tombstone


The yellow tombstone layout options are for internal presentations and specifically for planning conferences, as this is the standard that Emerson corporate uses.



Two Column Slide with Heading and Two Line Internal Tombstone

Two Line, INTERNAL Yellow Tombstone






Two Column Slide with Heading and Three Line Internal Tombstone

Three Line, INTERNAL Yellow Tombstone







Three Column with Heading

Insert Heading Insert Heading Insert Heading

















Three Column Image and Text Slide

Click picture icon above to insert picture

from file

OR

Copy image (from other slide or web)

then select box above and paste image

into box


from file

OR



into box


from file

OR



into box


Four Column with Heading

Insert Heading Insert Heading Insert Heading Insert Heading






















Four Column Image and Text Slide

Click picture icon above

to insert picture from file

OR

Copy image (from other slide

or web) then select box

above and paste image into

box



OR




box



OR




box



OR




box


2x2 Column with Heading




• ARIAL font size 16 or larger is strongly recommended

• Date formats: Please avoid “FY” before fiscal years. Any Emerson financial data is assumed to be FY when just the year is shown



• Date formats: Please avoid “FY” before fiscal years. Any Emerson financial data is assumed to be FY when just the year is shown




• ARIAL font size 16 or larger is strongly recommended


Left Side Callout






Insert Text Here

Use bold font when placed over grey call out box



Right Side Callout






Insert Text Here



Title Slide and Section

Breaker Options


Small Angle Title Slide

Presenter Name and/or Subtitle


Large Angle Title Slide



Additional Image Slides – Separate File

For external presentation needs that require additional image options, please be sure to ask your marketing manager about the separate Emerson Image Slide PPT file if you did not receive it with this template.

The following two slides use the full slide custom image “Layout” that is built into the template master. You can insert or copy a full slide image, then “Send to Back” behind the angle graphic, text and logo. Be sure to use the appropriate full color or reversed Emerson logo depending on the lightness or darkness on the image your are using behind the logo.


Full Slide Image Title Slide (Insert full slide image, then “Send to

Back”, use this STANDARD Emerson

logo when light image behind logo)



Full Slide Image Title Slide (Insert full slide image, then “Send to

Back”, use this REVERSED Emerson

logo when dark image behind logo)


Emerson Blue

Breaker Slide

Light Blue

Breaker Slide

Green

Breaker Slide

Orange

Breaker Slide

Blue/Green

Breaker Slide


Blue Angle Breaker Slide

Insert divider subtitle


Green Angle Breaker Slide



Orange Angle Breaker Slide


Chart and

Table Samples


Charts and Tables

• It is recommended that PowerPoint charts and tables be used for presenting data if at all possible

• Allows for faster edits: highlighting, row or column addition/deletion, format changes, etc.

• Minimizes revealing confidential information

• Please minimize use of embedded Excel charts and tables; sometimes they do not display correctly and they can contain confidential information

• “Metadata” can contain confidential information in embedded spreadsheets. In addition, the entire workbooks is embedded, which can reveal data in hidden tabs

• When time constrained, paste excel files as images, rather than embedding the Excel itself

• White backgrounds only, no gridlines

• Avoid use of 3D charts


Full Slide Chart and Line Chart Sample

Insert Chart Title Here

2.4

4.4

1.8

2.8

0

1

2

3

4

5

6

Category 1 Category 2 Category 3 Category 4

Series 1 Series 2 Series 3

Source: Slide Source Here. Second Source Here.


One Chart Slide with Right Side Call Out and Pie Chart Sample


4

3.2

1.4

1.2

0.5 1

1st 2nd 3rd 4th 5th 6th


Insert Text Here




Two Chart Slide with Bar Chart Samples

Insert Chart Title Here Insert Chart Title Here

4.3

2.5

3.5

4.5

Cat. 1 Cat. 2 Cat. 3 Category 4

4.3

2.5

3.5

4.5

2.4 4.4

1.8

2.8

Cat. 1 Cat. 2 Cat. 3 Cat. 4

Series 1 Series 2

Source: Slide Source Here. Second Source Here. Source: Slide Source Here. Second Source Here.


Full Slide Chart with Area Chart Sample


1956 1962 1968 1974 1980 1986 1992 1998 2004 2010


$X.XXChart info goes here

$X.XXChart info goes here


Three Chart Slide with Various Chart Samples

Insert Chart Title Here Insert Chart Title Here Insert Chart Title Here

4.3

2.5

3.5

4.5

Cat. 1 Cat. 2 Cat. 3 Cat. 4

8.23.2

1.41.2

1st Qtr 2nd Qtr 3rd Qtr 4th Qtr

2.4

4.4

1.8

2.8

0

1

2

3

4

5

6

Category1

Category2

Category3

Category4

Series 1 Series 2 Series 3

Source: Slide Source Here. Source: Slide Source Here. Source: Slide Source Here.


Table Sample

Item 1 Item 2 Item 3 Item 4 Item 5

Group 1 XXX XXX XXX XXX XXX

Group 1 Sub XXX XXX XXX XXX XXX












Table Sample

Item 1 Item 2

Group 1Enter text here

Group 1 Sub


Group 2 Sub


Group 3 Sub


Group 4 Sub


Group 5 Sub


Group 6 Sub


Gantt Chart Sample

Item 1Month Month Month Month

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

• Point one with critical part

bolded if desired

– Sub point one

– Sub point two

• Point two with critical part

bolded if desired

– Sub point one

– Sub point two

• Point three with critical part

bolded if desired

– Sub point one

– Sub point two

Sample Use of Angle Heading Here

Complete In-process

Date

Date

The following slides have been built into the template Slide Master so that

graphic assets and frequently needed guidelines can quickly be accessed

for reference or to copy and paste for use on slides

To access the Slide Master:

Select the View tab, then click Slide Master in the Master Views group

To exit Slide Master View:

Select the Slide Master tab, then click Close Master View on the far right

Design Guidelines and Graphic Assets to Copy and Paste

The following slides have been built into the template Slide Master so that

graphic assets and frequently needed guidelines can quickly be accessed

for reference or to copy and paste for use on slides

To access the Slide Master:

Select the View tab, then click Slide Master in the Master Views group

To exit Slide Master View:

Select the Slide Master tab, then click Close Master View on the far right

Design Guidelines and Graphic Assets to Copy and Paste

1 32 54

0/75/141 0/164/21098/187/70149/151/151 247/148/40255/207/3463/64/64

195/217/65 211/18/690/170/126

Core Theme Colors

6

110/41/141

Limit color use to the core theme colors,

their light/dark variations and the

additional brand colors below

There are duplicates of Emerson Blue in the Theme Colors.

This is intentional and either can be used.

Default Chart Color Order

Grey

Call-out First variation

under white

242/242/242

Body Text Title Text

Do not use

Standard Colors

Tip: To quickly add one of the three colors to

the right that are not in the template Theme

Colors; first select one of the boxes, then

click on Shape Fill, then select More Fill

Colors and click OK.

Footer Text

Hyperlink

Text

Negative

Numbers/Text

1 32 54

0/75/141 0/164/21098/187/70149/151/151 247/148/40255/207/3463/64/64

195/217/65 211/18/690/170/126

Core Theme Colors

6

110/41/141







Grey


under white

242/242/242


Do not use

Standard Colors






Footer Text

Hyperlink

Text

Negative

Numbers/Text

Template Theme Colors

1 32 54

0/75/141 0/164/21098/187/70149/151/151 247/148/40255/207/3463/64/64

195/217/65 211/18/690/170/126

Core Theme Colors

6

110/41/141







Grey


under white

242/242/242


Do not use

Standard Colors






Footer Text

Hyperlink

Text

Negative

Numbers/Text


211/18/69

0/75/141

149/151/151

0/170/126

135/229/255

110/41/141

247/148/40 0/164/210

98/187/70

Start

Here

255/207/34

External Tombstone

Background Color

Tombstone

Line Color

138/75/5

Negative numbers

or text

211/18/69

0/75/141

149/151/151

0/170/126

135/229/255

110/41/141

247/148/40 0/164/210

98/187/70

Start

Here

255/207/34

External Tombstone

Background Color

Tombstone

Line Color

138/75/5

Negative numbers

or text

The Color Wheel

211/18/69

0/75/141

149/151/151

0/170/126

135/229/255

110/41/141

247/148/40 0/164/210

98/187/70

Start

Here

255/207/34

External Tombstone

Background Color

Tombstone

Line Color

138/75/5

Negative numbers

or text


Keep content within this blue space

so that critical information

does not get cut off

Graphics such as color blocks (tombstones and angle headers)

and images can go to the edge of the slide






Clear Space for Content







a an and

at but by

for in nor

of on or

so the to

up yet

a an and

at but by

for in nor

of on or

so the to

up yet

All Titles and Tombstones Use Title Case

All Body Copy Uses Sentence Case, Unless Treated As a Subtitle

Capitalize the Principal Words

The principal words of a title include the first and last words of that title, which you should always capitalize. You shouldalso capitalize all verbs, nouns, pronouns, adjectives, adverbs and some conjunctions. Finally, capitalize every word that is more than three letters long.

What NOT to Capitalize

Don’t capitalize articles, prepositions, or conjunctions that have fewer than four letters. That leaves a pretty short list of words that aren’t capitalized:

Pay Special Attention to Prepositions

When you write titles that contain prepositions, your word processor will likely tell you that you should leave words like “with,” “about,” and “around” lowercase. Defiantly look past the squiggly line indicating a potential error, and remember that in AP title case, prepositions with four or more letters should be capitalized.

The Verb “Is”

Many writers make the error of leaving “to be” verbs in lower case. Even though “is,” “are,” “was,” and “be,” are all short words, they should still be capitalized in a title becausethey are verbs.

a an and

at but by

for in nor

of on or

so the to

up yet


1pt Template Header Line

4.5pt Callout/Tombstone Line

6pt Table Border

Blue Callout

Single Blue

Call Out and Section Tracker Options

Line Styles Arrow Styles

Blue with arrow Green with arrow Light Blue with arrow Yellow with arrow

6pt Table Border

Blue Callout

Single Blue

6pt Table Border

Blue Callout

Single Blue

6pt Table Border

Blue Callout

Single Blue



6pt Table Border

Blue Callout

Single Blue




6pt Table Border

Blue Callout

Single Blue

6pt Table Border

Blue Callout

Single Blue

6pt Table Border

Blue Callout

Single Blue

Lines, Arrows and Call Outs to Copy and Paste



6pt Table Border

Blue Callout

Single Blue




6pt Table Border

Blue Callout

Single Blue

6pt Table Border

Blue Callout

Single Blue

6pt Table Border

Blue Callout

Single Blue
















Table/Agenda Sample to Copy and Paste









Timeline Sample to Copy and Paste

Source: Slide Source Here. Second Source Here.Sample Use of Angle Heading Here

Lorem ipsum dolor sit amet,

labitur qualisque mea ad.

Nominavi comprehnsa in

mea, persius amet corpora

concludatuque eos ad.






2014 2015 2016 2017












4 Column

3 Column

2 Column

4 Column

3 Column

2 Column

2, 3 and 4 Column Sidebar and Header Lines to Copy and Paste


Click Here to Change Top Border Color

To change color bar above:

1. Click the blue header text in the table cell above

2. Click on the Table Tools Design tab

3. Change your Pen Weight to 6pt

4. Change your Pen Color to what you’d like to use

5. Then apply the Top Border of the Table only


The color of the bar above can be changed the same as you would change any Table Border

It is a 6pt Top Border

Color bars in all tables (such as sample agenda) can be changed the same way by applying a 6pt Pen Weight and Theme Color


































Sidebar Tables to Copy/Paste























Office/Technology Security

PeopleMeasurement Miscellaneous

Office/Technology Security

PeopleMeasurement Miscellaneous

Icon Library to Copy/Paste, Fill Color Can be Changed As Needed

Environmental/Energy Food Buildings

Transportation/Construction/Industrial/Manufacturing Medical

Environmental/Energy Food Buildings

Transportation/Construction/Industrial/Manufacturing Medical

Icon Library to Copy/Paste, Fill Color Can be Changed As Needed


North America

Sites: 15

Latin America

Sites: 2

Asia-Pacific

Sites: 21

Africa

Sites: 2

Europe

Sites: 68

North America

Sites: 15

Latin America

Sites: 2

Asia-Pacific

Sites: 21

Africa

Sites: 2

Europe

Sites: 68

Sample Map with Call Outs to Copy/Paste

North America

Sites: 15

Latin America

Sites: 2

Asia-Pacific

Sites: 21

Africa

Sites: 2

Europe

Sites: 68


The angle graphic element can be used above or below a column, as a heading or as a call out to add color and draw attention to a key point. It should be used for short statements only.

Two Column Blue Angle

One Column Left Side Green Angle

One Column Right Side Green Angle

One Column Right Side Blue Angle

Two Column Green Angle

One Column Left Side Blue Angle

The angle graphic element can be used above or below a column, as a heading or as a call out to add color and draw attention to a key point. It should be used for short statements only.







Angle Heading or Call Out Graphic to Copy/Paste







Operationalizing Threat Intelligence · Operationalizing Threat Intelligence David Foose Emerson...

Documents

Transcript of Operationalizing Threat Intelligence · Operationalizing Threat Intelligence David Foose Emerson...