Our presentation from 44con Cyber Security on April 28th 2015 discussing how we use public cyber data and some of the problems we have run into. Jointly presented with Ernest Li.

2. 2





3. 3
Direction
Access
Analysis &
Assessment
Dissemination
Action
Customer
Gather
Information
Insight
Expert
Schema
Assess
Source
Define
Action

4. 4
Immediate
Threat
Evolving
Threat
Long Term
Threat
Trend
Analysis
Horizon
Scanning
Futurology
Situational Awareness Strategic Intelligence

5. 5


High-level
Information on
changing risk
The board
Details of a specific
Incoming attack
Defenders
Attacker
Methodologies,
Tools and tactics
Architects &
Sysadmins
Indicators of
Specific malware
SOC staff / IR
Long-TermUseShort-TermUse
Low LevelHigh Level

6. 6




Threat
Source
Threat
Event
Vulnerability
Adverse
Impact
Initiates Exploits Causing
Characteristics:
• Capability
• Intent
• Target
Sequences:
• Actions
• Activities
• Scenarios
• Relevance
Conditions:
• Pervasiveness
• Severity
Controls:
• Effectiveness
Risk:
• Likelihood
• Impact
Risk View

7. 7
Driving
Forces
Public Cyber
Data
Past Incident
Records
Adversaries
(Threat Source)
Threat
Scenarios
Adverse
Impacts
Threat
Events
TTPs Controls
Threat
Personas
Technical
Indicators
Tactical View

8. 8




9. 9






10. 10
















11. 11

 Threat
Events
Countries &
Regions
Industries
Selection
Bias
Sample
Bias

12. 12

13. 13

14. 14

15. 15






16. 16
Threat
Scenarios
Threat
Events
TTPS
Many to
Many
Many to
ManySpecific
Instance with
extensive
business
context.
Collection of
TTPs with
limited Business
Context Standards
not used /
many fudges

17. 17



