"Cyber Shield Up: They Shall Not Pass" Abstract: "Cyber Shield Up: They Shall Not Pass" is a lecture aimed at demystifying the complex world of cyber defense for computer science students. This presentation is structured into three parts, each designed to equip students with an understanding of cybersecurity's challenges and opportunities. Part A: Anatomy of Cyber Threats — The first part is a deep dive into the vast array of cyber threats that challenge the integrity of our digital ecosystem. This exploration ranges from financial motivated threats, hacktivism to more sophisticated cyber espionage and Advanced Persistent Threats (APTs). By examining the tactics, techniques, and procedures (TTPs) of cyber adversaries, students will gain an understanding of the threat landscape and the importance of staying ahead in the cybersecurity game. Part B: The Corporate Cyber Shield — This part will provide insights about how organisations stay protected against modern cyber threats (explained in the first part of the lecture). Students will explore the disciplines that organizations adopt, including threat intelligence, security operations centers (SOCs), vulnerability management, and others. The goal for the students is to understand how today’s cyber defense teams are structured. Part C: Building the Cyber Defenders — The final part focuses on the next generation of cybersecurity professionals. It outlines the essential technical skills, such as system security, application security, and incident response, and pairs them with critical core skills like analytical thinking and effective communication. Students will leave with actionable advice on how to embark on their cybersecurity careers, including certifications, networking, and continuous education pathways. "Cyber Shield Up: They Shall Not Pass" aims not only to highlight the threats and defenses but also to inspire students to envision their roles in safeguarding our digital ecosystem.

1. CYBER SHIELDS UP:
THEY SHALL NOT PASS
Lecture @ Computer Science Department
University of Crete
2 April 2024
Andreas Sfakianakis
Cyber Threat Intelligence Professional

2. WHO AM I
▪ Proud CEID and CSD Alumni
▪ CTI in Financial, Energy, and Technology sectors
▪ SANS, ENISA, FIRST.org, European Commission
▪ Twitter: @asfakian
Website: www.threatintel.eu

3. DISCLAIMER

4. OUTLINE
Anatomy of Cyber
Threats
The Corporate
Cyber Shield
Building the
Cyber Defenders

6. ANATOMY OF CYBER THREATS
Image from bestofspain.es

8. TIMELINE OF IMPORTANT EVENTS IN CTI HISTORY
1989
Cuckoo’s
Egg
2009
Operation
Aurora
2010
Stuxnet
2011
LM Kill
Chain
2013
APT1
Report
2013
Pyramid
of Pain
2013
Snowden
Leaks
2014
Heart
Bleed
2015
ATT&CK
2016
The
Shadow
Brokers /
US
Elections
2017
Wanna
Cry /
Petya
APT Becomes Mainstream
Wider CTI Adoption

9. WHO ARE THE CYBER
THREAT ACTORS?

10. https://www.crowdstrike.com/adversaries/

11. https://cyb3rops.medium.com/the-newcomers-guide-to-cyber-threat-actor-naming-7428e18ee263

14. https://www.fbi.gov/wanted/cyber/apt-40-cyber-espionage-activities/apt-40-fbi-wanted-8-5x11-web-june-2021.pdf

15. https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and

16. https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and

17. https://www.fbi.gov/wanted/cyber/irgc-cyber-actors

19. THE HUMAN BEHIND THE KEYBOARD

20. State Sponsored

21. https://www.youtube.com/watch?v=KJIqgQKoHYg

22. HOW DO GOVERNMENTS DO
ATTRIBUTION?

26. Cybercriminals

27. WHAT IS THE TOP CYBER
THREAT NOWADAYS FOR
ORGANISATIONS?

28. https://github.com/cert-orangecyberdefense/ransomware_map/blob/main/OCD_WorldWatch_Ransomware-ecosystem-map.pdf

29. https://www.coveware.com/blog/2024/1/25/new-ransomware-reporting-requirements-kick-in-as-victims-increasingly-avoid-paying

30. HOW MUCH IS THE AVERAGE
RANSOM PAYMENT?

31. https://www.coveware.com/blog/2024/1/25/new-ransomware-reporting-requirements-kick-in-as-victims-increasingly-avoid-paying

32. HOW LONG DOES IT TAKE TO
GET RANSOMWARED?

33. https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/

34. Hacktivists

35. https://twitter.com/Cyberknow20/status/1760288169952784736

36. THE CORPORATE CYBER SHIELD

37. WELCOME TO CYBER SECURITY
https://www.linkedin.com/pulse/cybersecurity-domain-map-ver-30-henry-jiang/

38. SECURITY OPERATIONS
AND INCIDENT RESPONSE

39. VULNERABILITY MANAGEMENT
https://www.infotech.com/research/ss/implement-risk-based-vulnerability-management

40. THREAT INTELLIGENCE
https://www.crowdstrike.com/cybersecurity-101/threat-intelligence/

41. THREAT HUNTING
https://attack.mitre.org/

42. RED & PURPLE TEAMING
https://twitter.com/LetsDefendIO/status/1706614342219628912

43. THE CORPORATE CYBER SHIELD
https://www.linkedin.com/pulse/cybersecurity-domain-map-ver-30-henry-jiang/

44. BUILDING THE CYBER DEFENDERS
Image from heritage-history.com

47. https://correlatedsecurity.com/cyber-security-analyst-maturity-curve/

48. KEEPING UP TO
DATE -
SITUATIONAL
AWARENESS
RSS Aggregator (e.g., Feedly)
Twitter
Cyber News Websites
Reddit
Podcasts (e.g., CyberWire)
Newsletter Team (e.g.,TC Dragon News Bytes)
Strategic Sources (e.g., Economist, CFR, etc.)
Weekly Summaries (e.g.This Week in 4n6)
Threat Intelligence Reports
ISACs
Trust Groups (e.g., Slack channels, mailing lists)
Threat Intelligence Vendors

49. CONTINUOUS
EDUCATION
MINDSET
Self-initiated
CTFs
Academic programs
Certifications
Online training material
Conferences
Books
Audiobooks

52. DON’T UNDERESTIMATE CORE SKILLS
▪Communication
▪Teamwork
▪Emotional Intelligence
▪Business acumen
▪Ethics

53. FINAL REMARKS
Image from elladocomicodedonquijote.wordpress.com

54. RECAP
▪Evolving cyber threat landscape
▪Organisations with different threat profiles, business
priorities, and “cyber shields”
▪New generation of cyber defenders and tomorrow’s
leaders

56. THANK YOU!
Andreas Sfakianakis
@asfakian
threatintel.eu