Download as PDF, PPTX
Uploaded byDavid Sweigert
Cyber Threat Intelligence Integration Center -- ONDI
The Cyber Threat Framework (CTF), developed by the U.S. government, standardizes the characterization and categorization of cyber threat events to facilitate data-sharing and situational analysis. It encompasses a hierarchy with four layers that detail the adversary's life cycle, from preparation to the impact of their activities. The framework serves as a common reference point for analyzing cyber threats across various sectors and enables predictive analytics, trend analysis, and vulnerability assessments.
More Related Content
Similar to Cyber Threat Intelligence Integration Center -- ONDI
![[Bucharest] Attack is easy, let's talk defence](https://cdn.slidesharecdn.com/ss_thumbnails/attackiseasyletstalkdefencev3-151026104559-lva1-app6891-thumbnail.jpg?width=640&height=640&fit=bounds)
Cyber Threat Intelligence Integration Center -- ONDI
- 1. UNCLASSIFIED A Common CyberThreat Framework A Foundation for Communication This is a work of the U.S. Government and is not subject to copyright protection in the United States.
- 2. We both speakEnglish? • Apartment • French Fries • Elevator • Gasoline • Bin • Active • Flat • Chips • Lift • Petrol • Bin • Active 23/13/2017 UNCLASSIFIED
- 3. UNCLASSIFIED What You Needto Know • Define Cyber Threat Framework • Recognize the benefits of using standardized language to describe cyber activity and enable consistent categorization • Understand the Cyber Threat Framework hierarchy and its four layers of information • Understand how the Cyber Threat Framework can be used to support analysis 33/13/2017
- 4. UNCLASSIFIED Cyber Threat Framework(CTF) Overview The Cyber Threat Framework was developed by the US Government to enable consistent characterization and categorization of cyber threat events, and to identify trends or changes in the activities of cyber adversaries. The framework captures the adversary life cycle from (a) “PREPARATION” of capabilities and targeting to (b) initial “ENGAGEMENT” with the targets or temporary nonintrusive disruptions by the adversary to (c) establishing and expanding the “PRESENCE” on target networks, to (d) the creation of “EFFECTS and CONSEQUENCES” from theft, manipulation, or disruption. The framework categorizes the activity in increasing “layers” of detail (1- 4) as available in the intelligence reporting. 43/13/2017
- 5. UNCLASSIFIED There are manycyber threat models or frameworks – why build another? • Began as a construct to enhance data-sharing throughout the US Government • Facilitates efficient situational analysis based on objective (typically, sensor-derived) data • Provides a simple, yet flexible, collaborative way of characterizing and categorizing activity that supports analysis, senior-level decision making, and cybersecurity • Offers a common backbone (‘cyber Esperanto’); easier to map unique models to a common standard than to each other • Facilitates cyber threat trend and gap analysis, and assessment of collection posture 53/13/2017
- 6. UNCLASSIFIED Merging Disparate DataLayers into a Common Framework is a Standard Practice • Weather – overlaying satellite (clouds), doppler (rain), and thermometer (temperature) data atop a map yields a forecast: “take your umbrella and wear a light coat” • Air Traffic Control – integrating weather, regional/ground control radars, scheduling data, aircraft/ground handler status to control air traffic: “you are cleared to land” • In a similar fashion, a cyber threat framework based on measurable data facilitates visualization, analysis, and realization of a Common Operating Picture of threat activity • It can also be matched with other data layers (e.g., vulnerability, shared connections) to become more actionable 63/13/2017
- 7. UNCLASSIFIED Cyber Threat FrameworkEvolution 1) Created consensus around a foundation 2) Added context to validate linkages and demonstrate that you could move up and down the framework 3) Developed presentation models 4) Current focus – encompass analytics and automation Preparation Engagement Presence Effect/Consequence 3) Presentation 2) Context 1) Foundation 4) Analysis 73/13/2017
- 8. UNCLASSIFIED Resource development Maintain/expand Target access Deny AccessIntentExploitationReconnaissance Staging Delivery Target ID Detection avoidance Establish/modify Network infrastructure C2 Extract Data Manipulate Reconnaissance Installation Actions on ObjectiveDelivery C2Weaponization Exploitation Intent Staging EffectEngagement ManeuverDevelopment Reconnaissance Configure C2 Reconnaissance Exploitation EffectIntent Development Delivery ManeuverStaging C2Configure Preparation Engagement Presence Effect/Consequence Prepare Propagate EffectAdminister Engage Compromise EffectsAdministration Targeting Propagation ErrorEnvironmental threat MisuseHacking SocialMalware Physical threat Situational awareness Foot printing Enumeration Privilege escalation Scanning Covering tracks Gain access (exploitation) Creating Backdoors 83/13/2017 Deriving a ‘Best of Breed’ Common Framework STIXTM NSA 10 Step Lockheed Martin Kill Chain ® ALA CNE NSA VERIS Categories of Threat Actions JCAC Exploitation
- 9. UNCLASSIFIED Cyber Threat FrameworkLayer 1 Preparation Engagement Presence Effect/Consequence Layer 2 Layer 1 External actions Internal actions “Left of Intrusion” “Right of Intrusion” Stages The progression of cyber threat actions over time to achieve objectives Pre-execution actions Operational actions • Threat activity based on measurable/observable actions • Every victim and all reported activity accounted for • Layered data hierarchy providing activity traceability 93/13/2017
- 10. CTF Layer 1Definition – Preparation Preparation • Activities undertaken by a threat actor, their leadership and/or sponsor to prepare for conducting malicious cyber activities, e.g., establish governance and articulating intent, objectives, and strategy; identify potential victims and attack vectors; securing resources and develop capabilities; assess intended victim's cyber environment; and define measures for evaluating the success or failure of threat activities. 103/13/2017 UNCLASSIFIED
- 11. CTF Layer 1Definition – Engagement Engagement • Threat actor activities taken prior to gaining but with the intent to gain unauthorized access to the intended victim's physical or virtual computer or information system(s), network(s), and/or data stores. 113/13/2017 UNCLASSIFIED
- 12. CTF Layer 1Definition – Presence Presence • Actions taken by the threat actor once unauthorized access to victim(s)' physical or virtual computer or information system has been achieved that establishes and maintains conditions or allows the threat actor to perform intended actions or operate at will against the host physical or virtual computer or information system, network and/or data stores. 123/13/2017 UNCLASSIFIED
- 13. CTF Layer 1Definition – Effect/Consequence Effect/Consequence • Outcomes of threat actor actions on a victim's physical or virtual computer or information system(s), network(s), and/or data stores. 133/13/2017 UNCLASSIFIED
- 14. UNCLASSIFIED Cyber Threat Framework(v4)Layer 2 Details 143/13/2017 The purpose of conducting an action or a series of actions The progression of cyber threat actions over time to achieve objectives Actions and associated resources used by an threat actor to satisfy an objective Plan activity Complete preparations Acquire victim specific knowledge Conduct research & analysis Develop resources & capabilities Deliver malicious capability Deploy capability Exploit vulnerabilities Establish controlled access Establish persistence Expand presence Hide Enable other operations Extract data Alter data and/or computer, network or system behavior Deny access Preparation Engagement Presence Effect/Consequence External actions Internal actions “Left of Intrusion” “Right of Intrusion” Stages Interact with intended victim Destroy HW/SW/data Refine focus of activity Pre-execution actions Operational actions Objectives Actions Layer 2 Layer 1 Layer 3 Layer 4 Discrete cyber threat intelligence data Indicators
- 15. UNCLASSIFIED Cyber Threat Framework(v4)Layer 3 Exemplars 153/13/2017 The purpose of conducting an action or a series of actions The progression of cyber threat actions over time to achieve objectives Actions and associated resources used by an threat actor to satisfy an objective Plan activity Complete preparations Acquire victim specific knowledge Conduct research & analysis Develop resources & capabilities Deliver malicious capability Deploy capability Exploit vulnerabilities Establish controlled access Establish persistence Expand presence Hide Enable other operations Extract data Alter data and/or computer, network or system behavior Deny access Preparation Engagement Presence Effect/ConsequenceStages Interact with intended victim Destroy HW/SW/data Refine focus of activity Pre-execution actions Operational actions Objectives Actions Layer 2 Layer 1 Layer 3 • Dedicate resources • Create capabilities • Establish partnerships • Persuade people to act on the threat actors behalf (e.g., conduct social engineering) • Obtain a legitimate user account • Increase user privileges • Move laterally • Establish command and control node • Establish hop point • Add victim system capabilities to botnet • Exfiltrate passwords, credentials
- 16. UNCLASSIFIED Cyber Threat Framework(v4) Layer 4 Exemplar 163/13/2017 The purpose of conducting an action or a series of actions The progression of cyber threat actions over time to achieve objectives Actions and associated resources used by an threat actor to satisfy an objective Plan activity Complete preparations Acquire victim specific knowledge Conduct research & analysis Develop resources & capabilities Deliver malicious capability Deploy capability Exploit vulnerabilities Establish controlled access Establish persistence Expand presence Hide Enable other operations Extract data Alter data and/or computer, network or system behavior Deny access Preparation Engagement Presence Effect/Consequence External actions Internal actions “Left of Intrusion” “Right of Intrusion” Stages Interact with intended victim Destroy HW/SW/data Refine focus of activity Pre-execution actions Operational actions Objectives Actions Layer 2 Layer 1 Layer 3 Layer 4 Discrete cyber threat intelligence data Indicators • Dedicate resources • Create capabilities • Establish partnerships Company XXX reported to have created Malware QQ These are representative Actions that can contribute to achieving the Layer 2 Objectives. This is a simple example of the multitude of potential Indicators of threat actor Actions.
- 17. UNCLASSIFIED Consumer Needs DictatePerspective and Content • The foundation, based on empirical data, is the common reference point for all subsequent views – The consumer provides the focus by defining the view and/or adjusting the type of content (actor, activity, targeted sector, and victim) – The consumer defines the required granularity in each view but can “drill down” to see the underlying detail as desired • The framework is applicable to a range of threat actors, activity, targeted sectors, and victims 173/13/2017
- 18. UNCLASSIFIED Analysis • Depending onthe information selected and its presentation, one can begin to conduct a variety of analysis: – Trends – change over time • What caused the change – Predictive – what’s next – Environmental • Was the threat different than expected • What vulnerabilities were missed • How to optimize remedial action – Vulnerability – risk analysis – Defensive posture 183/13/2017
- 19. UNCLASSIFIED Preparation Engagement PresenceEffect/Consequence Threat Actor Threat actor 0 1 2 3 4 5 6 7 8 9 Preparation 0 2 4 6 8 10 Engagement 0 2 4 6 8 10 Presence 0 1 2 3 4 5 6 Effect/Consequence Threat Actor A Threat Actor B Threat Actor C Threat Actor D Threat Actor E Threat Actor F Threat Actor G Threat Actor H Cyber Threat Activity – CTF Layer 1 Stages Exemplar Reporting Period: January – March 2016 193/13/2017
- 20. UNCLASSIFIED Layer 2 Incidents Chemical,Pharmaceutical Commercial Facilities Communications, Media Critical Manufacturing Dams Defense Industy Emergency Services Energy Finance, Investment, Trade Food, Agriculture Government Facilities Healthcare, Public Health Information Technology Nuclear Reactors, Material, Waste Other Domestic Other Government (include DoD) Transportation Systems Water & Wastewater CTF Layer 2 Exemplar Threat Events by Sector 203/13/2017 Chemical, Pharmaceutical 7 Commercial Facilities 1 Communications, Media 15 Critical Manufacturing 2 Dams 1 Defense Industy 20 Emergency Services 1 Energy 5 Finance, Investment, Trade 10 Food, Agriculture 2 Government Facilities 1 Healthcare, Public Health 3 Information Technology 15 Nuclear Reactors, Material, Waste 1 Other Domestic 2 Other Government (include DoD) 10 Transportation Systems 2 Water & Wastewater 1 Defense Industry Communications, Media Finance Other Govt (Includes DoD) Information Technology
- 21. UNCLASSIFIED CTF(v4) Layer 2Objectives Exemplar Threat actor Plan activity Conduct research & analysis Develop resources & capabilities Acquire victim specific knowledge Complete preparations Develop capability Interact with intended victim Exploit vulnerabilities Deliver malicious capability Establish controlled access Hide Expand presence Refine focus of activity Establish persistence Destroy HW/SW/data Extract data Alter data and/or computer, network or system behavior Deny Access Enable other operations 213/13/2017 Threat Actor A Threat Actor B Threat Actor C Threat Actor D Threat Actor E Threat Actor F Threat Actor G Threat Actor H PreparationEngagementPresenceEffect/Consequence Layer 1 Stages Layer 2 Objectives
- 22. UNCLASSIFIED Summary • The CyberThreat Framework supports the characterization and categorization of cyber threat information through the use of standardized language. • The Cyber Threat Framework categorizes the activity in increasing “layers” of detail (1- 4) as available in the intelligence reporting. • The Cyber Threat Framework can be used to support analysis 223/13/2017
- 23.