SlideShare a Scribd company logo

Cyber Threat Intelligence: Building and maturing an intelligence program that supports the business, not just the SOC

•Download as PPTX, PDF•
•
M
Mark Arena

Cyber Threat Intelligence: Building and maturing an intelligence program that supports the business, not just the SOC

Technology
1 of 33
Cyber Threat Intelligence Building and maturing an intelligence program that supports the business, not just the SOC By Mark Arena
Mark Arena • CEO of Intel 471 • Previously Chief Researcher at iSIGHT Partners (FireEye), Australian Federal Police
Intelligence formally definition… “… intelligence is information that has been analyzed and refined so that it is useful to policymakers in making decisions - specifically, decisions about potential threats …” • https://www.fbi.gov/about-us/intelligence/defined
Identify your intelligence customers • Executive • Corporate security • Fraud • Risk • SOC
What intelligence products do they get? • Executive • Corporate security • Fraud • Risk • SOC
Giving a tactical intelligence product to an executive
Intelligence cycle
Your intelligence program’s maturity is based on your ability to do each part of the intelligence cycle
Planning, Direction, Needs, Requirements Three requirements lists to build and maintain: • Production requirements – What will be delivered to the intelligence customer/consumer. • Intelligence requirements – What we need to collect to meet our production requirements. • Collection requirements – The observables/data inputs we need to answer our intelligence requirements.
Production requirements • What is needed to be delivered to the intelligence customer (the end consumer of the intelligence). Intelligence requirements • What we need to collect to be able to meet our production requirements.
Production requirement Intelligence requirements What vulnerabilities are being exploited in the world that we can't defend against or detect? - What vulnerabilities are currently being exploited in the wild? - What exploited vulnerabilities can my organization defend? - What exploited vulnerabilities can my organization detect? - What vulnerabilities are being researched by cyber threat actors?
Intelligence requirements • What we need to collect to be able to meet our production requirements. Collection requirements • The observables/data inputs we need to answer the intelligence requirement.
Intelligence requirements Collection requirements What vulnerabilities are currently being exploited in the wild? - Liaison with other organizations in the same market sector. - Liaison with other members of the information security industry. - Open source feeds of malicious URLs, exploit packs, etc mapped to vulnerability/vulnerabilities being exploited. - Online forum monitoring where exploitation of vulnerabilities are discussed/sold/etc.
Intelligence requirements Collection requirements What vulnerabilities are being researched by cyber threat actors? - Online forum monitoring. - Social network monitoring. - Blog monitoring.
Excel spreadsheet example
Requirements updates • Update your requirements at least bi-annually • Changing threat landscape • Changing internal security posture • Changing business needs • Ad hoc requirements should be a subset of an existing requirement • If it doesn’t fit, your original requirements are either not comprehensive enough or poorly written
An example: XYZ Online • XYZ Online is a US headquartered company (approx. 5000 employees) that sells numerous goods online that ship to most places worldwide • Has Chief Information Security Officer (CISO) • Has 4 person cyber threat intelligence team
PR # Production Requirement Intelligence Consumer 1 What vulnerabilities are in XYZ Online software or infrastructure are being actively exploited? IT Security and Vulnerability Management teams 2 What vulnerabilities are in XYZ Online software or infrastructure that we can’t defend against or detect? IT Security and Vulnerability Management teams 3 How do we stop or reduce XYZ Online being scammed through fraudulent transactions? Fraud
What vulnerabilities are in XYZ Online software or infrastructure are being actively exploited? Intelligence requirements examples: • What vulnerabilities are currently being exploited against Amazon Elastic Compute Cloud (EC2)? • What vulnerabilities are currently being exploited against Apache Cassandra?
What vulnerabilities are currently being exploited against Amazon Elastic Compute Cloud (EC2)? Collection requirements examples: • Liaison with other ecommerce companies • Liaison with Amazon’s EC2 security team • Open sources • Social media monitoring • Online cyber crime forum monitoring
Traceability Enables the business justification of: • Increased staff versus requirements asked of intel team • Vendor purchases/subscriptions
Once you have your collection requirements • Look at what is feasible. • Consider risk/cost/time of doing something in-house versus using an external provider • Task out individual collection requirements internally or to external providers as guidance. • Track internal team/capability and external provider ability to collect against the assigned guidance.
Collection • Characteristics of intelligence collection: • Source of collection or characterization of source provided • Source reliability and information credibility assessed • Some types of intelligence collection: • Open source intelligence (OSINT) • Human intelligence (HUMINT) • Liaison/outreach • Technical collection
NATO’s admiralty system • Used for evaluating intelligence collection Reliability of Source Accuracy of Data A - Completely reliable B - Usually reliable C - Fairly reliable D - Not usually reliable E – Unreliable F - Reliability cannot be judged 1 - Confirmed by other sources 2 - Probably True 3 - Possibly True 4 – Doubtful 5 – Improbable 6 - Truth cannot be judged
Processing / Exploitation • Is your intelligence collection easily consumable? • Standards • Centralized data/information (not 10 portals to use) • APIs • Language issues? • Threat intelligence platforms (TIPs) can help you here
Intelligence analysis • Analysts who are able to deal with incomplete information and predict what has likely occurred and what is likely to happen. • Understanding of threat model – what does your company look like?
Intelligence analysis • Intelligence style guide • Defines format and meanings of specific terms within your intelligence products
Words of estimative probability • Consistency in words used to estimate probability of things occurring or not occurring, i.e. 100% Certainty The General Area of Possibility 93% give or take about 6% Almost certain 75% give or take about 12% Probable 50% give or take about 10% Chances about even 30% give or take about 10% Probably not 7% give or take about 5% Almost certainly not 0% Impossibility
Not analysis • Dealing with facts only (intelligence analysts aren’t newspaper reporters) • Reporting on the past only, no predictive intelligence • Copy and pasting intelligence reports from vendors • You have outsourced your intelligence function
Dissemination • Intelligence products written with each piece of collection used graded and linked to source. • Intelligence products sent to consumers based on topic and requirements met. • What information gaps do we have?
Feedback loop • We need to receive information from our intelligence customers on: • Timeliness • Relevance • What requirements were met? • This will allow identification of intelligence (collection) sources that are supporting your requirements and which aren’t
Intelligence program KPIs • Quantity – How many intelligence reports produced? • Quality – Feedback from intelligence consumers • Timeliness, relevance and requirements met
Questions? https://intel471.com/threatintelprogramchecklist.pdf https://medium.com/@markarenaauMy blog on intelligence program strategy and tradecraft:

Recommended

Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat IntelligenceNTT Innovation Institute Inc.
 
The ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT PlaybookThe ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT PlaybookMITRE ATT&CK
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat IntelligenceSirius
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsMark Arena
 
SIEM and Threat Hunting
SIEM and Threat HuntingSIEM and Threat Hunting
SIEM and Threat Huntingn|u - The Open Security Community
 
ATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKMITRE ATT&CK
 

Recommended

Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat IntelligenceNTT Innovation Institute Inc.
 
The ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT PlaybookThe ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT PlaybookMITRE ATT&CK
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat IntelligenceSirius
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsMark Arena
 
SIEM and Threat Hunting
SIEM and Threat HuntingSIEM and Threat Hunting
SIEM and Threat Huntingn|u - The Open Security Community
 
ATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKMITRE ATT&CK
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence WorkshopPriyanka Aash
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmPriyanka Aash
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKMITRE ATT&CK
 
Endpoint Detection and Response for Dummies
Endpoint Detection and Response for DummiesEndpoint Detection and Response for Dummies
Endpoint Detection and Response for DummiesLiberteks
 
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...Chris Gates
 
OSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceOSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceDeep Shankar Yadav
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 
Tenable_One_Sales_Presentation_for_Customers.pptx
Tenable_One_Sales_Presentation_for_Customers.pptxTenable_One_Sales_Presentation_for_Customers.pptx
Tenable_One_Sales_Presentation_for_Customers.pptxalex hincapie
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghOWASP Delhi
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Sqrrl
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingDhruv Majumdar
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)Ahmed Ayman
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonBen Boyd
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Osint presentation nov 2019
Osint presentation nov 2019Osint presentation nov 2019
Osint presentation nov 2019Priyanka Aash
 
Cyber Threat Intelligence.pptx
Cyber Threat Intelligence.pptxCyber Threat Intelligence.pptx
Cyber Threat Intelligence.pptxAbimbolaFisher1
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeamDan Vasile
 
Osint
OsintOsint
OsintKamal Rathaur
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework👀 Joe Gray
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence programMark Arena
 
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...Denim Group
 

More Related Content

What's hot

Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence WorkshopPriyanka Aash
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmPriyanka Aash
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKMITRE ATT&CK
 
Endpoint Detection and Response for Dummies
Endpoint Detection and Response for DummiesEndpoint Detection and Response for Dummies
Endpoint Detection and Response for DummiesLiberteks
 
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...Chris Gates
 
OSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceOSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceDeep Shankar Yadav
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 
Tenable_One_Sales_Presentation_for_Customers.pptx
Tenable_One_Sales_Presentation_for_Customers.pptxTenable_One_Sales_Presentation_for_Customers.pptx
Tenable_One_Sales_Presentation_for_Customers.pptxalex hincapie
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghOWASP Delhi
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Sqrrl
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingDhruv Majumdar
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)Ahmed Ayman
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonBen Boyd
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Osint presentation nov 2019
Osint presentation nov 2019Osint presentation nov 2019
Osint presentation nov 2019Priyanka Aash
 
Cyber Threat Intelligence.pptx
Cyber Threat Intelligence.pptxCyber Threat Intelligence.pptx
Cyber Threat Intelligence.pptxAbimbolaFisher1
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeamDan Vasile
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 

What's hot (20)

Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
 
Endpoint Detection and Response for Dummies
Endpoint Detection and Response for DummiesEndpoint Detection and Response for Dummies
Endpoint Detection and Response for Dummies
 
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
 
OSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceOSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligence
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
 
Tenable_One_Sales_Presentation_for_Customers.pptx
Tenable_One_Sales_Presentation_for_Customers.pptxTenable_One_Sales_Presentation_for_Customers.pptx
Tenable_One_Sales_Presentation_for_Customers.pptx
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
Osint presentation nov 2019
Osint presentation nov 2019Osint presentation nov 2019
Osint presentation nov 2019
 
Cyber Threat Intelligence.pptx
Cyber Threat Intelligence.pptxCyber Threat Intelligence.pptx
Cyber Threat Intelligence.pptx
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeam
 
Osint
OsintOsint
Osint
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 

Similar to Cyber Threat Intelligence: Building and maturing an intelligence program that supports the business, not just the SOC

How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence programMark Arena
 
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...Denim Group
 
Cybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect MatchCybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect MatchMcKonly & Asbury, LLP
 
CyberSecurity Portfolio Management
CyberSecurity Portfolio ManagementCyberSecurity Portfolio Management
CyberSecurity Portfolio ManagementPriyanka Aash
 
What Suppliers Don't Tell You About Security?
What Suppliers Don't Tell You About Security?What Suppliers Don't Tell You About Security?
What Suppliers Don't Tell You About Security?PECB
 
Application Security Done Right
Application Security Done RightApplication Security Done Right
Application Security Done Rightpvanwoud
 
Vendors, and Risk, and Tigers, and Bears, Oh My: How to Create a Vendor Revie...
Vendors, and Risk, and Tigers, and Bears, Oh My: How to Create a Vendor Revie...Vendors, and Risk, and Tigers, and Bears, Oh My: How to Create a Vendor Revie...
Vendors, and Risk, and Tigers, and Bears, Oh My: How to Create a Vendor Revie...Wendy Knox Everette
 
Your cyber security webinar
Your cyber security webinarYour cyber security webinar
Your cyber security webinarIntergen
 
Owasp Summit - Wednesday evening briefing master
Owasp Summit - Wednesday evening briefing masterOwasp Summit - Wednesday evening briefing master
Owasp Summit - Wednesday evening briefing masterDinis Cruz
 
Your cyber security webinar
Your cyber security webinarYour cyber security webinar
Your cyber security webinarEmpired
 
Cyber Security and Healthcare
Cyber Security and HealthcareCyber Security and Healthcare
Cyber Security and HealthcareJonathon Coulter
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security RoadmapElliott Franklin
 
SIEM-plifying security monitoring: A different approach to security visibility
SIEM-plifying security monitoring: A different approach to security visibilitySIEM-plifying security monitoring: A different approach to security visibility
SIEM-plifying security monitoring: A different approach to security visibilityAlienVault
 
Security Outsourcing - Couples Counseling - Atif Ghauri
Security Outsourcing - Couples Counseling - Atif GhauriSecurity Outsourcing - Couples Counseling - Atif Ghauri
Security Outsourcing - Couples Counseling - Atif GhauriAtif Ghauri
 
Top Security Challenges Facing Credit Unions Today
Top Security Challenges Facing Credit Unions TodayTop Security Challenges Facing Credit Unions Today
Top Security Challenges Facing Credit Unions TodayChris Gates
 
Security metrics 2
Security metrics 2Security metrics 2
Security metrics 2Manish Kumar
 
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptx
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptxColorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptx
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptxAkramAlqadasi1
 
Cyber 101 for smb execs v1
Cyber 101 for smb execs v1Cyber 101 for smb execs v1
Cyber 101 for smb execs v1NetWatcher
 
Using Threat Intelligence to Address Your Growing Digital Risk
Using Threat Intelligence to Address Your Growing Digital RiskUsing Threat Intelligence to Address Your Growing Digital Risk
Using Threat Intelligence to Address Your Growing Digital RiskSurfWatch Labs
 
“Responsible AI: Tools and Frameworks for Developing AI Solutions,” a Present...
“Responsible AI: Tools and Frameworks for Developing AI Solutions,” a Present...“Responsible AI: Tools and Frameworks for Developing AI Solutions,” a Present...
“Responsible AI: Tools and Frameworks for Developing AI Solutions,” a Present...Edge AI and Vision Alliance
 

Similar to Cyber Threat Intelligence: Building and maturing an intelligence program that supports the business, not just the SOC (20)

How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence program
 
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
Giving your AppSec program the edge - using OpenSAMM for benchmarking and sof...
 
Cybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect MatchCybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect Match
 
CyberSecurity Portfolio Management
CyberSecurity Portfolio ManagementCyberSecurity Portfolio Management
CyberSecurity Portfolio Management
 
What Suppliers Don't Tell You About Security?
What Suppliers Don't Tell You About Security?What Suppliers Don't Tell You About Security?
What Suppliers Don't Tell You About Security?
 
Application Security Done Right
Application Security Done RightApplication Security Done Right
Application Security Done Right
 
Vendors, and Risk, and Tigers, and Bears, Oh My: How to Create a Vendor Revie...
Vendors, and Risk, and Tigers, and Bears, Oh My: How to Create a Vendor Revie...Vendors, and Risk, and Tigers, and Bears, Oh My: How to Create a Vendor Revie...
Vendors, and Risk, and Tigers, and Bears, Oh My: How to Create a Vendor Revie...
 
Your cyber security webinar
Your cyber security webinarYour cyber security webinar
Your cyber security webinar
 
Owasp Summit - Wednesday evening briefing master
Owasp Summit - Wednesday evening briefing masterOwasp Summit - Wednesday evening briefing master
Owasp Summit - Wednesday evening briefing master
 
Your cyber security webinar
Your cyber security webinarYour cyber security webinar
Your cyber security webinar
 
Cyber Security and Healthcare
Cyber Security and HealthcareCyber Security and Healthcare
Cyber Security and Healthcare
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security Roadmap
 
SIEM-plifying security monitoring: A different approach to security visibility
SIEM-plifying security monitoring: A different approach to security visibilitySIEM-plifying security monitoring: A different approach to security visibility
SIEM-plifying security monitoring: A different approach to security visibility
 
Security Outsourcing - Couples Counseling - Atif Ghauri
Security Outsourcing - Couples Counseling - Atif GhauriSecurity Outsourcing - Couples Counseling - Atif Ghauri
Security Outsourcing - Couples Counseling - Atif Ghauri
 
Top Security Challenges Facing Credit Unions Today
Top Security Challenges Facing Credit Unions TodayTop Security Challenges Facing Credit Unions Today
Top Security Challenges Facing Credit Unions Today
 
Security metrics 2
Security metrics 2Security metrics 2
Security metrics 2
 
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptx
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptxColorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptx
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptx
 
Cyber 101 for smb execs v1
Cyber 101 for smb execs v1Cyber 101 for smb execs v1
Cyber 101 for smb execs v1
 
Using Threat Intelligence to Address Your Growing Digital Risk
Using Threat Intelligence to Address Your Growing Digital RiskUsing Threat Intelligence to Address Your Growing Digital Risk
Using Threat Intelligence to Address Your Growing Digital Risk
 
“Responsible AI: Tools and Frameworks for Developing AI Solutions,” a Present...
“Responsible AI: Tools and Frameworks for Developing AI Solutions,” a Present...“Responsible AI: Tools and Frameworks for Developing AI Solutions,” a Present...
“Responsible AI: Tools and Frameworks for Developing AI Solutions,” a Present...
 

Recently uploaded

Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University
 
APIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGAPIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGMarianaLemus7
 
costume and set research powerpoint presentation
costume and set research powerpoint presentationcostume and set research powerpoint presentation
costume and set research powerpoint presentationphoebematthew05
 
My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024The Digital Insurer
 
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024BookNet Canada
 
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)Wonjun Hwang
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar
 
Artificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning eraArtificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning eraDeakin University
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr LapshynFwdays
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024Lorenzo Miniero
 
Connect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationConnect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationSlibray Presentation
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebUiPathCommunity
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machinePadma Pradeep
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 3652toLead Limited
 
Science&tech:THE INFORMATION AGE STS.pdf
Science&tech:THE INFORMATION AGE STS.pdfScience&tech:THE INFORMATION AGE STS.pdf
Science&tech:THE INFORMATION AGE STS.pdfjimielynbastida
 

Recently uploaded (20)

Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!
 
APIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGAPIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDG
 
costume and set research powerpoint presentation
costume and set research powerpoint presentationcostume and set research powerpoint presentation
costume and set research powerpoint presentation
 
My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024
 
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
 
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
 
Artificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning eraArtificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning era
 
DMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special EditionDMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special Edition
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024
 
Connect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationConnect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck Presentation
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio Web
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
 
Science&tech:THE INFORMATION AGE STS.pdf
Science&tech:THE INFORMATION AGE STS.pdfScience&tech:THE INFORMATION AGE STS.pdf
Science&tech:THE INFORMATION AGE STS.pdf
 

Cyber Threat Intelligence: Building and maturing an intelligence program that supports the business, not just the SOC

  • 1. Cyber Threat Intelligence Building and maturing an intelligence program that supports the business, not just the SOC By Mark Arena
  • 2. Mark Arena • CEO of Intel 471 • Previously Chief Researcher at iSIGHT Partners (FireEye), Australian Federal Police
  • 3. Intelligence formally definition… “… intelligence is information that has been analyzed and refined so that it is useful to policymakers in making decisions - specifically, decisions about potential threats …” • https://www.fbi.gov/about-us/intelligence/defined
  • 4. Identify your intelligence customers • Executive • Corporate security • Fraud • Risk • SOC
  • 5. What intelligence products do they get? • Executive • Corporate security • Fraud • Risk • SOC
  • 6. Giving a tactical intelligence product to an executive
  • 8. Your intelligence program’s maturity is based on your ability to do each part of the intelligence cycle
  • 9. Planning, Direction, Needs, Requirements Three requirements lists to build and maintain: • Production requirements – What will be delivered to the intelligence customer/consumer. • Intelligence requirements – What we need to collect to meet our production requirements. • Collection requirements – The observables/data inputs we need to answer our intelligence requirements.
  • 10. Production requirements • What is needed to be delivered to the intelligence customer (the end consumer of the intelligence). Intelligence requirements • What we need to collect to be able to meet our production requirements.
  • 11. Production requirement Intelligence requirements What vulnerabilities are being exploited in the world that we can't defend against or detect? - What vulnerabilities are currently being exploited in the wild? - What exploited vulnerabilities can my organization defend? - What exploited vulnerabilities can my organization detect? - What vulnerabilities are being researched by cyber threat actors?
  • 12. Intelligence requirements • What we need to collect to be able to meet our production requirements. Collection requirements • The observables/data inputs we need to answer the intelligence requirement.
  • 13. Intelligence requirements Collection requirements What vulnerabilities are currently being exploited in the wild? - Liaison with other organizations in the same market sector. - Liaison with other members of the information security industry. - Open source feeds of malicious URLs, exploit packs, etc mapped to vulnerability/vulnerabilities being exploited. - Online forum monitoring where exploitation of vulnerabilities are discussed/sold/etc.
  • 14. Intelligence requirements Collection requirements What vulnerabilities are being researched by cyber threat actors? - Online forum monitoring. - Social network monitoring. - Blog monitoring.
  • 16. Requirements updates • Update your requirements at least bi-annually • Changing threat landscape • Changing internal security posture • Changing business needs • Ad hoc requirements should be a subset of an existing requirement • If it doesn’t fit, your original requirements are either not comprehensive enough or poorly written
  • 17. An example: XYZ Online • XYZ Online is a US headquartered company (approx. 5000 employees) that sells numerous goods online that ship to most places worldwide • Has Chief Information Security Officer (CISO) • Has 4 person cyber threat intelligence team
  • 18. PR # Production Requirement Intelligence Consumer 1 What vulnerabilities are in XYZ Online software or infrastructure are being actively exploited? IT Security and Vulnerability Management teams 2 What vulnerabilities are in XYZ Online software or infrastructure that we can’t defend against or detect? IT Security and Vulnerability Management teams 3 How do we stop or reduce XYZ Online being scammed through fraudulent transactions? Fraud
  • 19. What vulnerabilities are in XYZ Online software or infrastructure are being actively exploited? Intelligence requirements examples: • What vulnerabilities are currently being exploited against Amazon Elastic Compute Cloud (EC2)? • What vulnerabilities are currently being exploited against Apache Cassandra?
  • 20. What vulnerabilities are currently being exploited against Amazon Elastic Compute Cloud (EC2)? Collection requirements examples: • Liaison with other ecommerce companies • Liaison with Amazon’s EC2 security team • Open sources • Social media monitoring • Online cyber crime forum monitoring
  • 21. Traceability Enables the business justification of: • Increased staff versus requirements asked of intel team • Vendor purchases/subscriptions
  • 22. Once you have your collection requirements • Look at what is feasible. • Consider risk/cost/time of doing something in-house versus using an external provider • Task out individual collection requirements internally or to external providers as guidance. • Track internal team/capability and external provider ability to collect against the assigned guidance.
  • 23. Collection • Characteristics of intelligence collection: • Source of collection or characterization of source provided • Source reliability and information credibility assessed • Some types of intelligence collection: • Open source intelligence (OSINT) • Human intelligence (HUMINT) • Liaison/outreach • Technical collection
  • 24. NATO’s admiralty system • Used for evaluating intelligence collection Reliability of Source Accuracy of Data A - Completely reliable B - Usually reliable C - Fairly reliable D - Not usually reliable E – Unreliable F - Reliability cannot be judged 1 - Confirmed by other sources 2 - Probably True 3 - Possibly True 4 – Doubtful 5 – Improbable 6 - Truth cannot be judged
  • 25. Processing / Exploitation • Is your intelligence collection easily consumable? • Standards • Centralized data/information (not 10 portals to use) • APIs • Language issues? • Threat intelligence platforms (TIPs) can help you here
  • 26. Intelligence analysis • Analysts who are able to deal with incomplete information and predict what has likely occurred and what is likely to happen. • Understanding of threat model – what does your company look like?
  • 27. Intelligence analysis • Intelligence style guide • Defines format and meanings of specific terms within your intelligence products
  • 28. Words of estimative probability • Consistency in words used to estimate probability of things occurring or not occurring, i.e. 100% Certainty The General Area of Possibility 93% give or take about 6% Almost certain 75% give or take about 12% Probable 50% give or take about 10% Chances about even 30% give or take about 10% Probably not 7% give or take about 5% Almost certainly not 0% Impossibility
  • 29. Not analysis • Dealing with facts only (intelligence analysts aren’t newspaper reporters) • Reporting on the past only, no predictive intelligence • Copy and pasting intelligence reports from vendors • You have outsourced your intelligence function
  • 30. Dissemination • Intelligence products written with each piece of collection used graded and linked to source. • Intelligence products sent to consumers based on topic and requirements met. • What information gaps do we have?
  • 31. Feedback loop • We need to receive information from our intelligence customers on: • Timeliness • Relevance • What requirements were met? • This will allow identification of intelligence (collection) sources that are supporting your requirements and which aren’t
  • 32. Intelligence program KPIs • Quantity – How many intelligence reports produced? • Quality – Feedback from intelligence consumers • Timeliness, relevance and requirements met

Editor's Notes

  1. Analyzed and refined (by a person, i.e. an analyst) “Policymakers” in this example means customized your intelligence consumers within your organization
  2. Mark slide
  3. Mark slide Can be a case of garbage in, garbage out
  4. Mark slide Traceability between each part is very important so you can map things back to the business need and intelligence customer you are supporting Poll the audience for who has the following documented: Production requirements Intelligence requirements Collection requirements
  5. Ryan slide
  6. Mark slide Liaison with other ecommerce companies – Communication with other companies that use EC2. Liaison with Amazon’s EC2 security team. Conferences – This is to collect information from conferences which may cover or focus on Amazon EC2 vulnerabilities and exploitation. Open sources – Examples include news articles. This is to identify articles or coverage Amazon EC2 vulnerabilities and/or exploitation. Social media monitoring – This is to identify discussions around Amazon EC2 vulnerabilities and/or exploitation. Online forum monitoring – This is to identify hacker discussions on Amazon EC2 vulnerabilities and/or exploitation. Will include coverage of criminal marketplaces where vulnerabilities and exploits are bought and sold.
  7. Mark slide
  8. Mark slide Human intelligence is when you talk to the bad guy to obtain information. Human intelligence isn’t a person analysing information
  9. Poor visbility and collection typically = bad or creative analysis
  10. Any good analyst can recognise good intelligence when they see it Take good intelligence, corraborate it and take advantage of it. Don’t reinvent the wheel or waste cycles re-creating it.
  11. Feedback loop almost as important as the requirements part of the intel cycle
  12. Good to tie profitability or profit loss to actions taken as a result of intelligence lead decision making
  13. Mark slide