The CISO Platform Decision Summit, held in New Delhi, focused on the growing field of threat intelligence, projected to reach $1.5 billion in 2018. The discussions included key elements of actionable intelligence, types of intelligence, and a structured five-stage process for threat intelligence management. Prominent vendors were analyzed across various categories, and the document emphasized the importance of sharing and integration in building effective threat intelligence programs.

1. CISO Platform
Decision Summit
June 4-5, New Delhi

2. Threat Intelligence
Bikash Barai

3. Threat Intelligence Drivers

4. Overview
• Growing field. Expected to be 1.5 Billion in
2018
• Top buzzword for last 3 years
• High adoption in mature organizations

5. Threat Intelligence Basics

6. Key Elements of Threat Intel

7. What is actionable intelligence?
• Accurate
• Relevant
• Timely
• Aligned
• Predictive
• Integrated

8. Types of Intel
• Strategic Intel
• Operational Intel
• Tactical Intel
• Technical Intel

9. What is pyramid of pain?

10. Intel 101
• Data vs Intelligence
– Context, Intent, Capability
• Tactical vs Strategic
– How and what?
– Who and why?
• Atomic vs Composite
– IP, packet string, hash
– Combine multiple things
• TTP- Tactics, Techniques and Procedures

11. People

12. Organization Chart
CISO
SOC
VM
Planning Collection Analysis
Technical Strategic
Presentation IR

13. Process

14. Planning
• What issues to be addressed?
• What info to be gathered?
• What is the leadership and business priority?

15. 5 stage process
• Planning
– What are you looking for?
• Collection
– OSINT/HUMINT
– Logs/Data points inside the org
– Honeypots/nets/docs, social networks
– FM-5
• Processing
– Synthesis so that intelligence analysts can use
• Analysis
– Finished Intel- Top of the pyramid of pain
• Dissemination
– Customize and present to the right audience

16. Technology

17. Taxonomy for Threat Intelligence
Threat
intelligence
Threat
Intelligence
Platform
Threat
Intelligence
Enrichment
Threat
Intelligence
Integration
Open Source
Intel Human Intel
Technical
Intel
Adversary
Intel
Vulnerability
Intel
Strategic
Intel

18. Critical Technological capabilities
Key Critical Technologies Capabilities
Host Based Collection
Network Based Collection
External Threat Collection
Threat Intelligence Ingestion
Threat Intelligence Analysis
Threat Intelligence Enrichment
Threat Intelligence
Internal Threat Intelligence Collaboration and sharing
External Threat Intelligence Collaboration and sharing

19. Vendor Landscape
• Total Vendors studied: 23
• Prominent Vendors
– Open Source Intel: Recorded Future, Digital Shadows, Cyveillance
– Human Intel: Booz Allen Hamilton, CrowdStrike, iSIGHT Partners,
Verisign iDefence, Cyveillance
– Technical Intel: Norse Corporation , Anubis Networks, Emerging
Threats
– Adversary Intel: Booz Allen Hamilton, CrowdStrike, iSIGHT Partners,
Verisign iDefence, Symantec Deepsight
– Vulnerability Intel: iSIGHT Partners, Verisign iDefence
– Strategic Intel: , Surfwatch labs, Cytegic

20. Vendor Landscape
• Threat Intelligence Platform: Lookingglass ScoutPlatform, Threat Stream
Optic, ThreatQuotient ThreatQ, ThreatConnect Threat Intelligence
Platorm, Vorstack Automated and Collaborated threat Intelligence.
• Threat Intelligence Enrichment: Passive DNS( Farsight Security), GeoIP
(MaxMind), WhoisData(Domain Tools)
• Threat Intelligence Integration: Centripetal Networks, Lookingglass
CloudShield

21. Vendor Analysis

22. Integrating Threat Intel

23. STIX
• STIX provides a common language for
describing cyber threat information so it can
be shared, stored, and otherwise used in a
consistent manner that facilitates automation.

24. TAXII
• Trusted Automated eXchange of Indicator
Information (TAXII™) is a U.S. Department of
Homeland Security (DHS)-led, community-
driven effort to standardize the trusted,
automated exchange of cyber threat
information.

25. How to build a program?

26. Let’s do it next time…

27. But what can we do today?

28. Let’s start sharing- CISO Platform ISG

29. Thank You