>> Hello. Welcome to the second module, data processing.
This is the second video about
common standards used in cyber threat intelligence.
Let me start introducing data standard.
Basically, a data standards defines how
particular information elements are
represented in files or in communications.
The use of common standards is
important for exchange of any information.
In cyber threat intelligence, particularly,
standards were created to
represent actionable information,
including their contacts to
facilitate their storage and sharing.
Using a standard format has
mainly three advantages over
use an ad hoc representations.
First, the use of existing processing tools,
both to support the standard.
Second, the interpretation of
the description should be less subject to
misinterpretation because the standard
defines of the semantics for information elements.
Third, the ease of sharing and integration.
In this lesson, we will discover
it together different standards,
used for cyber threat intelligence.
We will start with scoring standards.
Then we will see a threat description
or taxonomy standards.
Finally, we'll close with
transport senders or protocols.
One of the most known scoring systems is CVSS.
CVSS stands for
Common Vulnerability Scoring System and is
currently maintained by the forum of
incident response and security teams.
First, the current version of CVSS,
version 3.1 and was released in June 2090.
CVSS measures three areas of concerns.
Based metrics,
temporal metrics, and environmental metrics.
The base score has the most significant influence,
all the final score.
The base group represents
the intrinsic qualities of a vulnerability.
The temporal group reflects
the characteristics of a vulnerability
that change over the time.
The environmental group represents the correct,
The characteristics of a vulnerability
that are unique to users environment.
Scores range from 0-10, where 10
>> corresponds to the most critical vulnerability.
>> A CVSS score is also represented as a vector string,
a compressor textual representation of values,
used to derive the score.
The numerical score can also be translated
into a qualitative representations such as low,
medium, high and critical.
As an example, I took
the recently discovered vulnerability
called Bluekeep or CVE-2019-0708.
This is a remote Code Execution or CE,
vulnerability in a Remote Desktop Protocol, RDP,
where an unauthenticated remote attacker
can explore the flow via
a series of specially crafted requests
to execute arbitrary code.
I hear the vector string of
CVSS 3.1 is attack vector is network.
The attack complexity is low.
Privileges are required, none,
user interactions, none,
scope and changed, confidentiality,
high, integrity, high, and availability high.
The score here is 9.8, which is critical.
If we choose to add a temporal or environmental metric,
the score will change.
The second type of standards
is thread description or taxonomy standards.
The motivations for developing
taxonomies standards was to find
a common language to describe
malware infections and other cyber events.
Here we are going to start with
the first standards, which is openIOC.
OpenIOC stands for Open Indicators Of Compromise
and was introduced by Mandarin into 2011.
It is used in mundane products,
but has also been released as an open standard.
OpenIOC provides a standard format and terms for
describing the artifacts encountered
during course of an investigation.
OpenIOC is focused on describing
technical characteristics of threat.
Through an extensible XML schema.
You can produce or edit
openIOC files using the tools provided by fire eye.
These tools can be used for free.
Here is an example of threat or
presentation using openIOC standard.
This example can be found on
the Github repository mentioned on the slide and viewed
using the tool IOCE editor mentioned on
the previous slide or through
the online website IOCbucket.com.
The next standard from the same category is CybOX.
Cyber observable expression or CybOX,
is standardized language for representing observables.
It was introduced by a Miter on
2012 and now maintained by Oasis.
Now CybOX has been integrated into STIX to standard.
CybOX is used for defining details
regarding measurable events and stateful properties.
The object that can be the defined in CybOX
can be used in higher level schema like STIX.
Here is a basic example of CybOX or
presentation of IP address object.
The second centered from the same category is STIX.
STIX stands for
>> Structured Threat Information Expression.
>> It is a structured language for
describing cyber threats information.
It can be shared, stored,
and analyzed in a consistent manner.
STIX is also introduced
by Miter and now maintained by Oasis.
The current version of STIX is 2.0.
It uses a JSON Schema for the second version,
the structured nature off STIX architecture
allows it to define a relationship between constructs.
For example, a campaign can
be attributed to a threat actor.
As I tried several tools dedicated to
threat intelligence and some solutions,
STIX is being widely accepted by industry leaders.
STIX 2 defines 12 STIX domain objects.
STIX, objects categorize each piece of
information with specific attributes to be populated.
Chaining multiple objects together
through relationships allow for
easy or complex representations of threat intelligence.
STIX 2 domain objects include
>> campaign, course of action,
>> identity, malware, threat actor,
tool, vulnerability, and others.
STIX 2 also defines two STIX relationship objects.
The first is a relationship and the second is citing.
Here is a basic example of STIX representation where
the first STIX domain object is
a threat actor and
the second STIX domain object is identity.
There is a STIX relationship object linking
the first domain object to
the second domain object, which is relationship.