Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy...

25
Judo Threat Intelligence Frank Angiolelli Director of Security Operations

Transcript of Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy...

Page 1: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Judo Threat Intelligence

Frank Angiolelli

Director of Security Operations

Page 2: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Threat Intelligence

Page 3: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Strategy

Page 4: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Photo Courtesy of Wikipediahttps://en.wikipedia.org/wiki/Kan%C5%8D_Jigor%C5%8D

Jigorō Kanō

• Founder of Judo

• Intelligent

• Small Physique

• Lost often

• Studied the Attacker

“Usually it had been him that threw me. Now, instead of being

thrown, I was throwing him with increasing regularity.

…it was the result of my study of how to break the postureof the opponent.

https://en.wikipedia.org/wiki/Kan%C5%8D_Jigor%C5%8D
Page 5: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the
Page 6: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Three Principles of Judo Threat Intelligence

• Use the attackers energy against them

• Maximum effect, minimum effort

• Break their posture, execute the throw

Page 7: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Path

to

Ju

do

Th

reat

In

telli

gen

ce

Automatic Action on TTP

Automatic TTP Identification

Manual Action on TTP

Manual TTP Identification

Patterns in Alarms

Actionable Alarms

Signal to Noise

Transparency

Foundational

Analytical

Operational

Page 8: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Judo Threat IntelligenceIn Action

Web Attacks

Page 9: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Threat IP Address

All Signatures

Regression Test Signatures

Find 100% True Positive Signatures

Find All IPs That Fired

Collect All Metadata

Gives you:• User Agents• Bad IP Addresses• Web Requests• Layer 7 Data

Begin to Build a Profile• What the recon looks like• How they behave• Collisions in data

Stage 1: Jumping Off

Page 10: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Collected Metadata

Create Custom Signatures

Regression Test

Find 100% True Positive Signatures

Find All IPs That Fired

Collect All Metadata

• Creates a Lifecycle

• Maintain Quality Control

• Finds Adaptation & Improvisation on the Attackers Part

Stage 2: Feedback Loop

Identify Meaningful Data

Page 11: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

User Agent Alarms

Bad URL RequestsIPS Signatures

Anomalous Volumes WAF Alarms

Recon Scans

The Feedback Loop in Action

Tactical: ActionQuarantine Track Long Term

Strategic: Risk Analysis

Page 12: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Judo Threat IntelligenceIn Action

@ d&b

Page 13: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Tactical Results

Tracking 120,000+ IP Addresses Auto-quarantine 150,000 times in 2015, 0 FPs

Information is Aged Out Automatically

Alarms on Meaningful Data

Page 14: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Strategic Results

• Protect Customer Trust

• Protect Shareholder Value

• Transcends IP address reputation feeds

• Process for building custom enterprise signatures

• Prioritize investments

Page 15: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Funny Stuff Comes Out of the Woodwork

• Associates that run scanners from their home systems.

• Vendor connectivity anomalies.

• Threats to revenue

• Married TTPs which you would not expect

LPT: You can be selective about what you consider an important ‘attack’

Page 16: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Storytime

Page 17: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Example – Anomalous User Agents

• Identify normal user agent patterns• Baseline abnormal user agents• Identify thresholds

Page 18: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the
Page 19: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Blackspider IPs

Web Request Unique IP Addresses Making This Request

HEAD /admin/fckeditor/ 11HEAD /ckeditor/ 11

HEAD /common/fckeditor/ 11HEAD /images/upload/FCKeditor/ 11

HEAD /editor/ 11HEAD /includes/fckeditor/ 11

HEAD /editor/fckeditor/ 11

HEAD /fckimg/ 11HEAD /editor1/ 11

HEAD /images/upload/fckediter/ 11HEAD /editorold/ 11

HEAD /images/upload/fckimg/ 11HEAD /admin/fck/ 11

HEAD /include/fckeditor/ 11

HEAD /manage/fckeditor/ 11HEAD /js/fckeditor/ 11

HEAD /scripts/fckeditor/ 11HEAD /upload/FCKeditor/ 11

HEAD /sysadmin/fckeditor/ 11

HEAD /system/fckeditor/ 11

Page 20: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

The story of 91.200.12.11

One matching pattern from Chinese IP Address:211.149.192.45

Page 21: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Tool Overlap by IP and URL Request

Source IPs

URL Overlap

Page 22: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Conclusion

“The easy way is the hard way &

the hard way is the easy way.”

- Msgr. Walsh

Page 23: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Frank [email protected]

914-589-4474

Thank you.

mailto:[email protected]
Page 24: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

References/Sources

• http://www.networkworld.com/article/2983243/security/challenges-around-operationalizing-threat-intelligence.html

• http://www.sans.org/reading-room/whitepapers/analyst/cyberthreat-intelligence-how-35767

• http://www.isightpartners.com/wp-content/uploads/2014/07/iSIGHT_Partners_What_Is_20-20_Clarity_Brief1.pdf

• http://www.fierceitsecurity.com/story/threat-intelligence-problem/2014-10-13

• http://www.csoonline.com/article/2969275/data-protection/threat-intelligence-needs-to-grow-up.html

• http://www.securityweek.com/building-narrative-driven-security-model

• http://www.isalliance.org/presentation/1_ISA_Overview_Presentations/2006_12_00_Larry_Clinton_Commerce_Department_Presentation.pdf

http://www.networkworld.com/article/2983243/security/challenges-around-operationalizing-threat-intelligence.html
http://www.sans.org/reading-room/whitepapers/analyst/cyberthreat-intelligence-how-35767
http://www.isightpartners.com/wp-content/uploads/2014/07/iSIGHT_Partners_What_Is_20-20_Clarity_Brief1.pdf
http://www.fierceitsecurity.com/story/threat-intelligence-problem/2014-10-13
http://www.csoonline.com/article/2969275/data-protection/threat-intelligence-needs-to-grow-up.html
http://www.securityweek.com/building-narrative-driven-security-model
http://www.isalliance.org/presentation/1_ISA_Overview_Presentations/2006_12_00_Larry_Clinton_Commerce_Department_Presentation.pdf
Page 25: Threat Intelligence JujutsuThree Principles of Judo Threat Intelligence •Use the attackers energy against them •Maximum effect, minimum effort •Break their posture, execute the

Abstract

SOC and Threat Intel teams are tasked with protecting shareholder value and customer trust while facing attackers of limitless stamina, varying ingenuity and considerable resources. Internal Threat Intelligence can generate value through effective strategies. By combining Security Operations principles with Judo principles, we can generate meaningful and efficient results. This presentation tells the results of applying these principles to dun & bradstreet.


Building Successful Threat Intelligence Programs · Building Successful Threat Intelligence Programs Allan Thomson, LookingGlass CTO June 2017 ... “Threat Intelligence” –evidence-based

Building Successful Threat Intelligence Programs · Building Successful Threat Intelligence Programs Allan Thomson, LookingGlass CTO June 2017 ... “Threat Intelligence” –evidence-based

Empowering threat hunters with artificial intelligence€¦ · Cloud-powered limitless scale Finds stealthy attackers in real-time Rich context to accelerate triage Custom IoCmatching

Empowering threat hunters with artificial intelligence€¦ · Cloud-powered limitless scale Finds stealthy attackers in real-time Rich context to accelerate triage Custom IoCmatching

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

THREAT INTELLIGENCE - CrowdStrike

THREAT INTELLIGENCE - CrowdStrike

Threat Intelligence - Amazon Web Services · Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence ... Goal of Intelligence Analysis. Cyber Kill Chain™ Model ...

Threat Intelligence - Amazon Web Services · Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence ... Goal of Intelligence Analysis. Cyber Kill Chain™ Model ...

ADVANCED THREAT INTELLIGENCE - Bitdefender · Advanced Threat Intelligence Architecture Advanced Threat Intelligence resolves a long-standing blind spot for SOC managers and analysts,

ADVANCED THREAT INTELLIGENCE - Bitdefender · Advanced Threat Intelligence Architecture Advanced Threat Intelligence resolves a long-standing blind spot for SOC managers and analysts,

Threat Intelligence: Collecting, Analysing, EvaluatingThreat Intelligence: Collecting, Analysing, Evaluating mwrinfosecurity.com CPNI.gov.uk cert.gov.uk 4/36 Threat intelligence is

Threat Intelligence: Collecting, Analysing, EvaluatingThreat Intelligence: Collecting, Analysing, Evaluating mwrinfosecurity.com CPNI.gov.uk cert.gov.uk 4/36 Threat intelligence is

Living with the threat of Determined Attackers - RANT0214

Living with the threat of Determined Attackers - RANT0214

Unmask anonymous attackers with advanced threat intelligence webinar 6.29 final (1)

Unmask anonymous attackers with advanced threat intelligence webinar 6.29 final (1)

Threat Intelligence

Threat Intelligence

Cisco 2017 Midyear Cybersecurity Report · Threat intelligence from Talos: On the trail of attacks and vulnerabilities ..... 24 Time to detection: The tug-of-war between attackers

Cisco 2017 Midyear Cybersecurity Report · Threat intelligence from Talos: On the trail of attacks and vulnerabilities ..... 24 Time to detection: The tug-of-war between attackers

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

Threat monitor Threat Intelligence Report Q1 2020

Threat monitor Threat Intelligence Report Q1 2020

Global Threat Intelligence Center (GTIC) 2017 … Security Q2 2017... · Global Threat Intelligence Center (GTIC) Quarterly Threat Intelligence Report Q2 2017. ... In previous editions

Global Threat Intelligence Center (GTIC) 2017 … Security Q2 2017... · Global Threat Intelligence Center (GTIC) Quarterly Threat Intelligence Report Q2 2017. ... In previous editions

Before the Breach: Using threat intelligence to stop attackers in their tracks

Before the Breach: Using threat intelligence to stop attackers in their tracks

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Counter Threat Unit™ Threat Intelligence

Counter Threat Unit™ Threat Intelligence

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

Certified Threat Intelligence Analyst - EC-Council · Certified Threat Intelligence Analyst 1 Certified IA Threat Intelligence Analyst C T CERTIFIED THREAT ... It describes building

Certified Threat Intelligence Analyst - EC-Council · Certified Threat Intelligence Analyst 1 Certified IA Threat Intelligence Analyst C T CERTIFIED THREAT ... It describes building

Certified Threat Intelligence Analyst...04 Certified Threat Intelligence Analyst Why Organizations Need A Threat Intelligence Team Traditional approaches to malicious attacks are slowly

Certified Threat Intelligence Analyst...04 Certified Threat Intelligence Analyst Why Organizations Need A Threat Intelligence Team Traditional approaches to malicious attacks are slowly