Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to...

32

Transcript of Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to...

Page 1: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 2: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Using Threat Intelligence to Secure IoT

Threat Hunting with Open Source

Steve Skoronski [email protected]

Page 3: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Why?

• IoT is expanding rapidly, as is connectivity

• The stakes have never been higher

• The impact has never been so severe

Page 4: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

IoT Security Market Overview

Page 5: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 6: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

8©2018 Check Point Software Technologies Ltd.

Spectre and Meltdown

Page 7: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Proof of Concept

Page 8: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Firmware Emulation - Firmadyne

Page 9: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Cyber Kill Chain from Lockheed Martin

Page 10: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Where to Start?

• Security Professionals and Administrators alike are drowning in data

• This means there is a lack of situational awareness

• It also means a long time to react, amplifying the security event impact on the business, reputation and brand perception

Page 11: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

The Setup

Page 12: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 13: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 14: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Diagram credit to Corelight

Page 15: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 16: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 17: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

IoT Development Kits

Page 18: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Stage 1: Collection - Data Inputs

• The reference infrastructure has many data collection points we can ingest to start getting a wider and deeper view;• Network Firewall – providing information on layer 2-7 data

crossing that network perimeter

• Ubiquiti’s Unifi Software Defined Controller for UAP-AC-Lite Wireless Access Point

• Syslog from simpler network devices / bro for devices that cannot log (IoT)

Page 19: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 20: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Stage 2 – Normalization

• Search and Reporting App very helpful to validate correct collection and format• Apps were used in conjunction with data inputs to view

from several perspectives, IE, Splunk Security Essentials

•Validation with proxy indicators – other correlation and reporting tools as a starting point for asking questions of the dataset

Page 21: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 22: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 23: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Threat Feeds

Page 24: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 25: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 26: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 27: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Transportation

Manufacturing

Smart cities

Smart buildings

Banking

Utilities

Healthcare

Telecom

Automotive

Energy

Smart homes

cloud

AI ADAPTIVE SECURITY CONTROLS

Page 28: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.
Page 29: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

33©2018 Check Point Software Technologies Ltd.

Introducing the Micro Gateway

Centralized Management

Easy Deployment / Zero Touch Provisioning

Integrated FW & VPN in a Micro Gateway

Wired & Wireless Support

Monitoring & Control via Mobile App

Page 30: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

34©2018 Check Point Software Technologies Ltd.

Protection Against Known and Unknown Threats

Enforce defined security policies

Accurately detect anomalous behavior

and identify threats in real time

Granular protocol understanding

Discover all IoT devices

Page 31: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

35©2018 Check Point Software Technologies Ltd.

Page 32: Using Threat Intelligence to - Champlain College Saint-Lambert · Using Threat Intelligence to Secure IoT Threat Hunting with Open Source Steve Skoronski sskorons@checkpoint.com.

Off to the Lab!

I appreciate your time!


Certified Threat Intelligence Analyst...04 Certified Threat Intelligence Analyst Why Organizations Need A Threat Intelligence Team Traditional approaches to malicious attacks are slowly

Certified Threat Intelligence Analyst...04 Certified Threat Intelligence Analyst Why Organizations Need A Threat Intelligence Team Traditional approaches to malicious attacks are slowly

Shellshock Threat Intelligence Report

Shellshock Threat Intelligence Report

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

Kaspersky Threat Intelligence Portal...Threat Intelligence Resource Subscribers to Kaspersky’s Threat Intelligence Portal enjoy a single point of entry to: Kaspersky Threat Data

Kaspersky Threat Intelligence Portal...Threat Intelligence Resource Subscribers to Kaspersky’s Threat Intelligence Portal enjoy a single point of entry to: Kaspersky Threat Data

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

NETSCOUT THREAT INTELLIGENCE REPORT · NETSCOUT Threat Intelligence LETTER FROM NETSCOUT THREAT INTELLIGENCE Today, attackers can release enormous terabit-per second-scale DDoS attacks

NETSCOUT THREAT INTELLIGENCE REPORT · NETSCOUT Threat Intelligence LETTER FROM NETSCOUT THREAT INTELLIGENCE Today, attackers can release enormous terabit-per second-scale DDoS attacks

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

Threat Intelligence Solution Demonstration

Threat Intelligence Solution Demonstration

Cyber Threat Intelligence

Cyber Threat Intelligence

SMARTER Threat Intelligence · Our threat intelligence is derived from the Webroot® Threat Intelligence Platform, our proprietary cloud-based security analysis architecture designed

SMARTER Threat Intelligence · Our threat intelligence is derived from the Webroot® Threat Intelligence Platform, our proprietary cloud-based security analysis architecture designed

ADVANCED THREAT INTELLIGENCE - Bitdefender · Advanced Threat Intelligence Architecture Advanced Threat Intelligence resolves a long-standing blind spot for SOC managers and analysts,

ADVANCED THREAT INTELLIGENCE - Bitdefender · Advanced Threat Intelligence Architecture Advanced Threat Intelligence resolves a long-standing blind spot for SOC managers and analysts,

Building Successful Threat Intelligence Programs · Building Successful Threat Intelligence Programs Allan Thomson, LookingGlass CTO June 2017 ... “Threat Intelligence” –evidence-based

Building Successful Threat Intelligence Programs · Building Successful Threat Intelligence Programs Allan Thomson, LookingGlass CTO June 2017 ... “Threat Intelligence” –evidence-based

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Threat intelligence platform explained

Threat intelligence platform explained

Global Cyber Threat Intelligence

Global Cyber Threat Intelligence

Threat intelligence platforms

Threat intelligence platforms

Threat Intelligence

Threat Intelligence

Operational Cyber Threat Intelligence:

Operational Cyber Threat Intelligence:

THREAT INTELLIGENCE PLATFORMSdocs.media.bitpipe.com/io_12x/io_128188/item_1253423/ThreatCon… · Effective threat intelligence management is an ongoing effort. The threat landscape

THREAT INTELLIGENCE PLATFORMSdocs.media.bitpipe.com/io_12x/io_128188/item_1253423/ThreatCon… · Effective threat intelligence management is an ongoing effort. The threat landscape