>> Hello and welcome to the third part of the module,
data collection, dedicated to external data sources.
Threat intelligence market has
exploded over the past years.
Dozens of security vendors are introducing
cyber threat intelligence and
offering to help you collect,
aggregate, and analyze threat Intelligence.
But what products and services
can improve your security posture?
With a wide variety of options,
how can you choose
the most effective threat intelligence to your needs?
Another question that you need to ask, is about budget.
How much money do you need?
The answer is, of course,
that depends on the size of
your organization, and other factors.
Because most of threat intelligence
is sold on subscription basis.
Before moving to this lesson's main objectives,
I want you to learn
that if you are unable to keep up with
the basic best practices and
standard operating procedures such
as batch update cycles,
and if your IT environment is currently
not fully under your control, and monitoring,
at the same time you are trying to
add external threat intelligence on top of that,
you are just adding more work,
and your teams will only get overwhelmed.
Let's start with defining
our learning objectives for this video.
In this lesson, we will learn what
are the external data collection sources?
What's the right approach to select your data sources,
and what are the different types
of external data sources?
Keep in mind that
the following list is not meant to be exhaustive.
But I tried to give
a global overview of what you
can get from an external data source.
An external data source can be
security reports from vendors,
>> or cybersecurity experts.
>> Cybersecurity blogs or articles about trending threats.
You can give these from a subscription to an RSS feed.
Malware analysis results, indicators of compromise,
such as malware indicators,
compromised devices, IP repetition,
>> command-and-control indicators, etc.
>> "Open source" intelligence.
We will dig more into leveraging OSSIM
in cyber threat intelligence contexts
>> in a future video.
>> You can also get advisories about new vulnerabilities,
reports about new exploits, social media feeds,
Yara or IDS rules,
and you can also find
dumps of credentials that
are available in paste websites,
threat actor forums, or even in specific markets.
External sources can be pretty
varied with many degrees of trustworthiness.
These sources can provide indicators in
structured data reports such as STIX, CSV, JSON, XML,
etc, or unstructured reports such as PDF files,
word documents, emails from sharing groups, etc.
Some of these data, particularly from vendors,
maybe refined with contexts for a particular industry.
However, it's worth mentioning that you
will need someone from your security team or
someone with specific knowledge of
your organization's threat landscape
in order to determine its relevance.
What is the right approach on selecting your sources?
You will need to assess what's going to have
the greatest impact and the likelihood
of that against your organization.
For example, all organizations are
aware that a ransomware that gets in the right spot,
can shut down the business for weeks,
or permanently in some cases.
This is why being on top of it,
it is considered a priority.
No need to fully focus your efforts on
this trendy APT that's
not even interested in your industry.
In other words, if I work in
education or health care sector,
I should worry more about a ransomware that's
delivered through phishing emails
sent in spread for a campaign,
like the case of Ryuk net ransomware
that hit multiple health care facilities in 2019.
The first infection was through phishing email
containing a weaponized Microsoft document.
Instead of focusing my main efforts on
investigating and collecting indicators on APT 38,
the threat group that has been
mostly targeting financial institutions.
My recommendation here is you
should prioritize getting intelligence
based on their relevance at
that time and evolve as time goes on.
Another study case is an example of WannaCry.
Attackers took advantage of a vulnerability,
using an exploit that was leaked.
At the same time,
the flow was already patched by
Microsoft before the attack took place.
However, a lot of companies
>> didn't prioritize this patch,
>> which made the huge breakdown.
Here, effective threat intelligence role
is to keep defenders informed
of common threats by
providing up-to-date indicators of compromise,
such as a new public exploits indicators to
monitor and what patches should be prioritized,
etc., that allow companies to
respond quickly and proactively face threats.
Now, let's move to
the different types of external data sources.
Globally, there are three types
>> of external data sources.
>> We can start with public data sources,
community data sources, and
private or commercial data sources.
We will see each one of them in details,
on their corresponding videos.
That was all for today's lesson,
we tried to explain what are
the external data sources
and when they become a priority.
We also show what's the right approach to get
external threat intelligence and
the different types of external
>> data collection sources.
>> I hope you liked this video.
In the next video,
we'll discuss the first category
of external data sources,
which is private collection sources.
>> See you there.