Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Creating REAL Threat Intelligence ... with Evernote at Defcon Wall of Sheep on August 8, 2015

2,706 views

Published on

In the presentation that threat intel vendors do not want you to see, threat data from open source and home grown resources meets Evernote as the ultimate braindump repository with the outcome of producing real actionable threat intelligence that your organization can leverage to stop the bad guys. This presentation discusses an experiment of using Evernote as a informal threat intelligence management platform, the specific concepts and strategies used, and its overall effectiveness. Specific topics covered include the advantages of using an open and flexible platform that can be molded into an open/closed source threat data repository, an information sharing platform, and an incident management system. Although using Evernote in this way in large enterprises is probably not possible, organizations can apply the same reference implementation to build similarly effective systems using open source or commercial solutions.

Published in: Technology
  • Be the first to comment

  • Be the first to like this

Creating REAL Threat Intelligence ... with Evernote at Defcon Wall of Sheep on August 8, 2015

  1. 1. Creating REAL Threat Intelligence … with Evernote @grecs NovaInfosec.com
  2. 2. Disclaimer Opinions expressed are solely my own and do not express the views or opinions of my employers. In related news, I’m looking for new career opportunities (new full-time position, consulting, …)
  3. 3. 20 Yrs Industry 16 Yrs Infosec 5 Yrs SOC
  4. 4. Agenda • Background • Dashboarding for Fun/Profit • The Secret Weapon • 3 Legs of Threat Intel • Evernote as an Intel Repo • Alternatives • Future Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  5. 5. BACKGROUND Over Engineering Build (at least try to) Before Buy Problem Requirements Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  6. 6. Background Over Engineering • Tendency to Over Complicate • Keep It Simple Stupid • What Can We Do Quick & Dirty that Will Get Us 60- 70% of the Way There? • Onboarding Workflow System Example Solution Fine As Is Est. Requs. to Develop Eventual Solution
  7. 7. Background Build (at least try to) Before Buy • Before Buying New Commercial Solution – Try Quick & Dirty Solution In-House First • Use Tools Already Have & All Familiar With • Setup Good Set of Processes Since Lacks Safety Checks • Have Smart People Actually Use Solution for 6-12 Mos. • Continually Evolve Processes with Lessons Learned – Maybe that Will Solve Your Needs – Else Understand What REALly Need  Commercial • Invest in People & Process 1st, then Products Case In Point:Threat Intel Services Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  8. 8. Background Problem • Working as Analyst – Looking to Take Advantage of OS Intel – Required Searching Through Sites One-by-One • Restrictions – No Organization Provided Option – No Option to Build Own System Internally • Build My Own – Hosted Externally – Accessible Internally Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  9. 9. Background Requirements • Bucket to Dump All Data Into – Blog/Other Feeds – Data-Driven Feeds – Data Files – Other (anything else find – e.g., APT reports) • Easily Find Data – Searchable – Categories – Tagging for Viewing in Different Ways • Cloud-Based So Wouldn’t Have to Maintain & Accessible Everywhere – Email Folder (like in old days but too kludgy) – Log/Data Aggregation Tools Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs, Analyst Point of View, Not Machine
  10. 10. DASHBOARDING FOR FUN & PROFIT Dashboard 1.0 Dashboard 2.0 Dashboard 3.0 Take-Aways Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  11. 11. Dashboarding for fun & Profit Dashboard 1.0 • SOC Security Engineer Position Many Years Ago Working to Create Dashboards • Wanted to Measure Risk • Use Traditional Risk Equation – Vulnerability Data Based on Patch & Other Tools – Threat? Decided to Use Vendor Threat Levels (e.g., SANS INFOCON, Symantec – normalize and average) Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  12. 12. Dashboarding for fun & Profit Dashboard 2.0 – Google Reader, iGoogle, Feedly
  13. 13. Dashboarding for fun & Profit Dashboard 3.0 • Moved from Feedly to Netvibes Since Designed Ground Up as Dashboard • Added “Cyber Intel” Tab with Sources Still Active from Feedly Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  14. 14. Dashboarding for fun & Profit Dashboarding Take-Aways • Nice for “Blog” Post Feeds • Tough to Follow for Data-Driven Feeds – Changing Too Fast – Feedly Pro – NetVibes VIP • Keep All Feed Data & Searchable • Expensive for One-Off Analyst Resource • Introduce Concept of One “Bucket” to Dump All Into • Doesn’t Work for Periodically Updated Data Files Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  15. 15. THE SECRET WEAPON Overview Customization Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  16. 16. The Secret Weapon Overview • Method for Using Evernote as GTD-Based Task Mgmt System – Treat Evernote Like a Database – Notebook == Table – Note == Free Form Record • Organization – Nested Notebooks – Hierarchical Tagging (provide metadata structure) • What  Projects • When  Importance – e.g., 0-6 • Where  E.g., home, work, etc. • Who  E.g., people that action has to do with • Combination Above • Search – ~ Notebook, Tag, Keyword, or Combination Thereof – Saved Searches Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  17. 17. The Secret Weapon Customization • Identifier Symbols for Each W* Category • Carry Through of W* Symbols into Sub-Tags • Included “.” after Symbols to Mark Headings Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  18. 18. THREE LEGS OF THREAT INTEL Background Open Source Intelligence Information Sharing Case Tracking Existing Solutions Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  19. 19. Three Legs of Threat Intel Background • Threat Intel Market Growing – Investigating Threat Intel – Consulted Experts & Users of Threat Intel Services • Basic Take-Aways – Fascinating Area with Lots of Cool Things Mathematically Correlated Together in Some Fancy Big Data Model – Not Much Value Beyond Open Source Resources – A Lot of Data Not Relevant to Organization Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs, “When your threat intel solution is feeling more like a threat intel problem…” - @JohnLaTwC
  20. 20. Three Legs of Threat Intel Open Source Intelligence • Boils Down to – Indictors (e.g., IPs, Domains , URLs, Hashes, Email Addresses, … ) – Reports (e.g., vendor dossiers on threat TTPs) • Historically Lots of Open Source Resources (e.g., MalwareDomainList, Zeus Tracker, …) • Don’t Forget Social Networks (e.g., certain people/resources on Twitter) • Mix in Organizational Data as Well to Enrich (e.g., honeypots) • Commercial (but let’s get the free stuff down first to define requirements) • Existing Solutions: CRITS, CIF, CriticalStack, Vendors Incorporating into Products • Big Need – Centralized Database to Record All this Information Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  21. 21. Three Legs of Threat Intel Intel Sharing • Groups – ISACs (FS-ISAC, MS-ISAC, DIB-ISAC, …) – DIB – Infragard • Historically – Email List – Bulletin Boards • Existing Solutions – Email Lists, Bulletin Boards – Starting to Distribute in Standardized Format (TAXII, STIX) • Big Need – Centralized Database to Record All this Information Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  22. 22. Three Legs of Threat Intel Case Tracking • Pretty Simple with Many Workflow Systems Out There – Open New Case – Work It Periodically Adding Comments of What Done – Eventually Gets Closed • Existing Solutions – Open Source: RT, eTicket, Help Desk Lite, … – Commercial: Remedy, SharePoint • Big Need – Centralized Database to Record All this Information Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  23. 23. Three Legs of Threat Intel Other • All-In-One – ThreatConnect (free to join) • Overall – Lots of Point Solutions But Not Flexible – Ease of Use (CEO down to analyst) – Centralized Database to Record All this Information Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  24. 24. EVERNOTE AS AN INTEL REPO Ah Ha OSINT Intel Sharing Case Tracking Summary Other Tricks EN Search Alternatives Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  25. 25. Evernote as an Intel Repo Ah Ha • Define Notebooks & Hierarchical Tags for Metadata • Perfect Open & Flexible Framework to Build Off Of • Easy to Use Over Heavy Database or Workflow Management System • Start Dumping All Feeds/Data into Evernote Bucket Dashboarding + Secret Weapon + Threat Intel = Evernote as an Intel Repo Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  26. 26. Evernote as an Intel Repo OSINT • Archive of Organization Relevant Data from Open Source Resources • Benefits – Database Can Search and Pivot Around In – Annotation of Notes • Dumping – Automated via Feeds – Clip into Evernote with Browser Add-On • Recommended Tagging Structure Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  27. 27. Evernote as an Intel Repo OSINT • Threat Data/Intel – MalwareDomainList (RSS) – Zeus Tracker (RSS) – SSL Blacklist (RSS) – Malware-Analysis Traffic (RSS) – Dynamoo (RSS) – @sshbrute, @netmenaces (Twitter) • Vulnerability – Offensive Security Exploit Database (RSS) – NIST NVD CVE (RSS) – US CERT All Products (RSS) • Situational Awareness – SANS ISC Blog (RSS) – ThreatBrief (RSS) Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  28. 28. Evernote as an Intel Repo OSINT Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  29. 29. Evernote as an Intel Repo OSINT - Automation • Email into Evernote – Sign Up for Service Using Evernote Email • IFTTT/Zapier for RSS Feeds – Easily to Implement – Limit of Only Getting Partial Data – Write Own RSS Scraper / FiveFilter • IFTTT/Zapier with Email Integration – Helps Some if Offer Mailing List with Full Data • StormStack - Open Source Clone+ of IFTTT • Scripts – E.g., Retrieve Files & Insert into Evernote • CriticalStack / CIF Feeds Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  30. 30. Evernote as an Intel Repo OSINT – IFTTT Automation Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  31. 31. Evernote as an Intel Repo OSINT – Script Automation Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs, Thanks for Initial Script: Ameer M.
  32. 32. Evernote as an Intel Repo Intel Sharing • Intel Sharing – Shared Evernote Notebook for Partner Group – Create Note, Place in Shared Notebook to Distribute, & Use Standard Tags to Track • Case Tracking – Evernote Notebook with a Note per Investigation – Establish Note Template with – Tags to Id Workflow (e.g., Open, Working, Closed) • Other: Adversaries, Campaigns, Waves, Individual Attacks, Indicator DB Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  33. 33. Evernote as an Intel Repo Summary !.When ].What @.Where ^.Who Case Tracking !.Case Tracking !High !Medium !Low ** ].Case Tracking ]CAS10000 ]CAS10001 @.Case Tracking @Inbox @Working @Closed ^.Case Tracking ^jsmith ^acren Intel Sharing @.Intel Sharing (no tag -> new) @Relevant @Irrelevant ^.Intel Sharing ^DIB ^FS-ISAC OSINT DB ].OSINT DB ]NVD ]Exploit-DB ]Zeus Tracker @.OSINT DB (no tag -> new) @Useful @Useless ^.OSINT DB ^NIST ^Offensive S. ^Abuse.ch Only Tag if Relevant Primary Tags (**) Used to Cross-Ref Source or Who Added/Upd Workflow or State Data Type Priority, Confidence, Rep
  34. 34. Evernote as an Intel Repo EN Search • How to Find Find All Data Threw into Evernote – Tags – Basic Search – Advanced Search • Specific Notebooks, Tags, Terms, Dates • “AND” Boolean Support • Example – Search for IP & Find Note – Run Secondary Search Around that Timeline – Discovery Similar Happenings • Saved Searches (e.g., Case Tracking) Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  35. 35. Evernote as an Intel Repo Show & Tell Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  36. 36. Alternatives • Log Management Solutions • SIEMs • Others
  37. 37. Future • More/Improved OSINT Resources – Deconflict Sites with Multiple Feeds & Add if Needed – File Base Pulls (script / replace existing RSS) – Vendor APT Reports – News Blogs - Track Happenings Around Specific Period – Integration with CIF to Centralize/Tag Data • Improved/Formalized Tagging Structures • API Automation (e.g., auto tagging IP addresses) • 3rd Party App that Uses Evernote as Backend • EaaS (Evernote as a SIEM ;) ) Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  38. 38. Conclusion • Lots of Point Solutions but None Bring Together Like Good ‘ol Evernote • Start with Evernote to “Figure Stuff Out" • In End Determine REAL Requirements – Solution Fine As Is – Build In-House/Buy Commercial Full Out Solution Creating REAL Threat Intelligence … with Evernote NovaInfosec.com@grecs,
  39. 39. Questions? • Twitter @grecs • Website NovaInfosec.com, @novainfosec • Contact http://bit.ly/nispcontact o Questions/Consulting

×