1.
Click Here
CYB205-1
Evolving Threat Landscapes
Lec. 01

2.
COURSE LEARNING OUTCOMES
 Describe the evolving cybersecurity threat landscape.
 Explain cybersecurity mitigation and defense
strategies.
 Discuss modern-day cybersecurity trends.
 Define cyber security policy, enforcement and
compliance.
 Define Artificial Intelligence (AI).

3.
COURSE EVALUATION
 Discussion Forums & Debate: 30%
 Individual Assignment: 15%
 Group Project (Case Study): 25%
 Final quiz/exam: 30%

4.
Threat, Vulnerability, and Risk
Threat Actor
Threat intelligence types
Threat Intelligence Feeds
Threat intelligence sources
Traffic Light Protocol (TLP)
Agenda

5.
Threat, Vulnerability, and Risk
Threat
Any circumstance or event with the potential to adversely impact
organizational operations, assets, or individuals.
Vulnerability
Weakness in an information system, system security procedures,
internal controls, or implementation that could be exploited or
triggered.
Risk
A measure of the extent to which an entity is threatened by a potential
circumstance or event.

6.
Threat intelligence types
Strategic
High level info
on changing
risks
Tactical
Attacker Tools
Tactics,
Procedures
Operational
Incoming
attacks against
company or
industry
Technical
Indicators of
Compromise
High level Low level
Low Time-to-Live
High Time-to-Live

7.
• What?
• Threat intelligence is information about threats
and threat actors that helps mitigate harmful
events in cyberspace.
• Why?
• Help organizations to understand the threats that
have, will, or are currently targeting the
organization.
• How?
• Open-source intelligence
• Commercial intelligence
Threat Intelligence Feeds

8.
OSINT
Open Source Intelligence
• Derived from open sources (e.g. mainstream media, Internet forums, paste sites, etc.
• Pros: good for ‘context’ and ‘big picture’
• Cons: multiple languages, interpretation, noise
TECHINT
Technical Intelligence
• Technical indicators (e.g. IP addresses, hashes, domains, tools & techniques)
• Pros: easy to consume and drive automation
• Cons: difficult to ‘contextualize’
SIGINT
Signals Intelligence
• Derived from analysis of communications, often in one’s own environment
• Pros: low noise; if you’re seeing it, you’re experiencing it
• Cons: requires extensive apparatus
Threat intelligence sources

9.
• Canadian Center for cyber Security CCCS
• Department of Homeland Security: Automated Indicator Sharing
• FBI: InfraGard Portal
• @abuse.ch: Ransomware Tracker
• SANS: Internet Storm Center
• VirusTotal: VirusTotal
• Cisco: Talos Intelligence
• VirusShare: VirusShare Malware Repository
• Google: Safe Browsing
• National Council of ISACs: Member ISACs
• The Spamhaus Project: Spamhaus
Open-source Intelligence Feeds
Commercial Intelligence Feeds
 Recorded Future

10.
NIST 800-150 “Guide to Threat Information Sharing”
• Threat information that has been aggregated, transformed, analysed,
interpreted, or enriched to provide the necessary context for
decision-making processes.

11.
Thank You