Download as PDF, PPTX
Uploaded byF-Secure Corporation
How do you predict the threat landscape?
The document discusses the importance of proactive threat intelligence and predictive capabilities in cybersecurity, emphasizing the need for organizations to understand their risk and asset vulnerabilities. It outlines different levels of threat intelligence, from strategic to technical, and highlights the need for effective processes to act on the intelligence gathered. The closing notes stress that understanding one’s own environment is crucial for enhancing security posture, with both commercial and free options available for threat intelligence solutions.
More Related Content
Similar to How do you predict the threat landscape?
![[Bucharest] Attack is easy, let's talk defence](https://cdn.slidesharecdn.com/ss_thumbnails/attackiseasyletstalkdefencev3-151026104559-lva1-app6891-thumbnail.jpg?width=640&height=640&fit=bounds)
How do you predict the threat landscape?
- 1. HOWDOYOUPREDICT THETHREAT LANDSCAPE? Janne Pirttilahti Director,New Services, F-Secure Cyber Security Services
- 2. 2 Holistic cybersecurity Definitions Why predictive capabilities matter Predictive approach to cyber threats Threat intelligence Recommendations AGENDA
- 3. CYBERSECURITYISAPROCESS 3 Understand your risk, knowyour attack surface, uncover weak spots React to breaches, mitigate the damage, analyze and learn Minimize attack surface, prevent incidents Recognize incidents and threats, isolate and contain them
- 4. CYBERSECURITYISAPROCESS 4 Understand your risk, knowyour attack surface, uncover weak spots React to breaches, mitigate the damage, analyze and learn Minimize attack surface, prevent incidents Recognize incidents and threats, isolate and contain them
- 5. PREDICT Pri-`dikt To declare orindicate in advance; especially : foretell on the basis of observation, experience, or scientific reason Source: Merriam Webster 5
- 6. 6 Top threebehaviors that impact us? What do future attacks look like? Where to invest next? How to train our people? How to prepare oneself and for what? PREDICTIVECAPABILITIESARENEEDED TOANSWERMANYQUESTIONS
- 7.
- 8.
- 9.
- 10.
- 11.
- 12.
- 13.
- 14.
- 15. PREDICTIVEAPPROACH TOCYBERTHREATS 15 2) ACTIONABLE THREAT INTELLIGENCE PROACTIVELYANTICIPATE NEW ATTACKS 1) ASSET & VULNERABILITY MANAGEMENT UNDERSTAND THE CURRENT STATE OF YOUR SYSTEMS
- 16.
- 17.
- 18. 18 “Threat intelligence isevidence-based knowledge (e.g. context, mechanisms, indicators, implications and action-oriented advice) about existing or emerging menaces or hazards to assets. CISOs should plan for current threats, as well as those that could emerge in the long term (e.g. in three years).” Gartner, February 2016
- 19. 19 CDN STIXTAXII OSINT HUMINT TLP IOC CTI IOA DGA MD5 MRTI ISAC ISAO CTIIC NCCIC TTP TAP SHA1 OTX SIEM CISA IODEFOPENIOC CYBOX YARA Technical Intel Adversary Intel Vulnerability Intel Breach Monitoring TIP Strategic Intel Data Enrichment
- 20. 20 STRATEGIC / EXECUTIVELEVEL THEDIFFERENT LEVELSOF THREATINTELLIGENCE – Strategic, high level information of changing risk – Geopolitics, Foreign Markets, Cultural Background – Vision timeframe: years
- 21. 21 OPERATIONAL / TACTICAL STRATEGIC/ EXECUTIVE LEVEL THEDIFFERENT LEVELSOF THREATINTELLIGENCE – Strategic, high level information of changing risk – Geopolitics, Foreign Markets, Cultural Background – Vision timeframe: years – Details of specific incoming risk: who, what, when? – Attacker’s methods, tools and tactics, their modus operandi – Early warnings of incoming attacks – Vision timeframe: months, weeks, hours
- 22. 22 OPERATIONAL / TACTICAL STRATEGIC/ EXECUTIVE LEVEL TECHNICAL THEDIFFERENT LEVELSOF THREATINTELLIGENCE – Strategic, high level information of changing risk – Geopolitics, Foreign Markets, Cultural Background – Vision timeframe: years – Details of specific incoming risk: who, what, when? – Attacker’s methods, tools and tactics, their modus operandi – Early warnings of incoming attacks – Vision timeframe: months, weeks, hours – Specific IOCs (for SIEM, FW, etc. integration) – More data, less intel – Automated processing is paramount – Vision timeframe: hours, minutes (but also long lasting)
- 23.
- 24.
- 25.
- 26.
- 27.
- 28. STRATEGICALLYRELEVANTDATAIS UNIQUETOEACHCOMPANY 28 All threat data: Vulnerabilityfeeds Exploit kit feeds Malicious software feeds Indicators of compromise feeds Bad IP address feeds Botnet activities feeds DNS changes feeds Reputation feeds (URL & content) Known threat actor behavior data All ”breadcrumb” data from company personnel … Global landscape Business area landscape Possibly relevant data Strategically important data
- 29. EVENACTIONABLE INTELLIGENCE IS ONLYWORTH ITWITH PROCESSESINPLACE TO EFFECTIVELY ACTONIT. 29
- 30. CYBERSECURITYISAPROCESS 30 Understand your risk, knowyour attack surface, uncover weak spots React to breaches, mitigate the damage, analyze and learn Minimize attack surface, prevent incidents Recognize incidents and threats, isolate and contain them
- 31. Understanding yourown environment is the foundation 31 CLOSINGWORDS
- 32. Understanding yourown environment is the foundation There are both commercial and free options available 32 CLOSINGWORDS
- 33. Understanding yourown environment is the foundation There are both commercial and free options available Start from figuring out what benefits you the most 33 CLOSINGWORDS
- 34. Understanding yourown environment is the foundation There are both commercial and free options available Start from figuring out what benefits you the most Threat Intelligence can strengthen your security posture 34 CLOSINGWORDS
- 35.
- 36.