An Introduction into Threat Intelligence

1. Leveraging Threat Intelligence
Sherif Mansour

2. Threat Intelligence is like teenage sex: everyone
talks about it, nobody really knows how to do it,
everyone thinks everyone else is doing it, so
everyone claims they are doing it...

7. What Can Threat Intel Tell Me?
1. Information about "bad actors”
Public Threat Feeds
Private Threat Feeds
2. Alerting if your org is listed as a bad actor
3. TTP Tactics, Techniques, Procedures

8. Information about "bad actors”
• Origins – IPs/ASN/Domains
• Compromised Organizations / accounts
• Malware signatures etc..

9. Alerting if your org is listed as a bad actor
If you find this, you are having a bad day!

10. TTP Tactics, Techniques, Procedures
• Learning from other’s grief!
• Allows you to check if your org is prepared for defending, detecting
such campaigns.
• Requires a well thought out process
• It’s usefulness also depends on the orgs ability to map those issues to
impacted resources (i.e. a good asset inventory, good vulnerability
management coverage).

11. Credential Stuffing Mitigation
• Receive data on compromised credentials
• Try them against your user base
• Identify users susceptible to credential stuffing
• Take measures to protect the users (such as altering user
or notify as well as invalidate sessions and require
password reset etc..)

12. What can go wrong?
• Poor data quality
• False positives
• Unable to leverage data – difficult to integrate