All right, cyber threat intelligence.
Defined as the collection and analysis of information about threats and adversaries,
drawing patterns that provide the ability to make knowledgeable decisions for
preparedness, prevention, and response actions to various attacks.
Helps to identify and mitigate various
business risks by converting unknown threats into known threats
and implementing various advanced and proactive defense strategies.
The types of threat intelligence.
We have four different categories and the
consumer is going to vary from category to category.
The strategic is high level information on
changing risksconsumed by high level executives and management.
This will generally not be very technical in nature.
Summaryistic to degree.tactical,
information on the attackers tactics, techniques, and proceduresconsumed by IT
service and SOC managers and administrators.
Operational, information on a specific
incoming attack that would be consumed by security managers and network defenders.
Then finally, technical will be consumed
by SOC staff and IR teams, information on specific indicators of compromise.
Now, as far as exam goes, I would
definitely know the consumer for each of these different four categories.
Layers of threat intelligence.
The various providers are sources.
We're going to have a slide for each one of these.
Threat intelligence feeds platforms and professional services.
The intelligence provider can be open
source community or movement or private or commercial body providing threat
intelligence as sources, feeds, platforms or professional services.
Threat intelligence feeds.
Continuous streams of packaged data
related to potential or current threats in the organization.
Any feed is an ongoing feed of information constantly being updated.
The different sources you have publicly available feeds, for example, Shodin,
Threat Connect, Virus Total, Ali en Vault, Zeus tracker, etc.
And then commercial feeds,
which typically with commercial, that's going to involve some licensing.
An organization must purchase these feeds, government commercial vendors, etc.
Examples, Microsoft Cyber Trust Blog,
Kospersky, X Force Exchange, FierEye, Recorded Future, etc.
Generally speaking, we'll see probably a little bit more polished commercial feeds.
Anything publicly available or open source is definitely great functionality.
But usually there's a reason you're paying for commercial product.
Typically gives you a pretty good return on that investment.
Not to say that the publicly available feeds aren't great.
But in general, we're going to talk about this with vulnerability scanners as well.
I want to add to this.
But in general, what's publicly available
or free to use is less likely to be updated on a continuous basis.
And I'm not saying this across the board.
But if you take, for example, Nessus or some other free and licensed version of
software, you have an eval version that is free to use, limited number of IPS,
whatever the case may be, but the updating of those plug ins doesn't happen as
frequently as it would for the license or the commercial feed.
So a couple of different levels of detail
updates and current signature databases, that thing.
Threat intelligence sources.
You also have open source intelligence, which the very definition of open source
intelligence is gathered from publicly available sources.
So media, internet, public government
data, corporate academic publishing or literature.
Anything that is freely available to the public.
Human intelligence,
information is collected from interpersonal contacts,
foreign defense personnel, accredited diplomats, NGOs, prisoners of war,
refugees, traveler, interviewer debriefing.
So you're getting this from specific human sources.
Signals intelligence.
Okay, threefold definition collected by
intercepting signals, which could be communication signals,
electronic intelligence from radars and LIDAR, and then foreign instrumentation
signals from nonhuman communication systems.
Technical intelligence,
information collected from an adversary's equipment or captured enemy material, CEM.
Tech and sources, foreign equipment,
foreign weapon systems, satellites, technical research papers, etc.
Social media intelligence.
You probably see where this one is going.
Collected from social media sources, open
source like Facebook, LinkedIn, Twitter, WhatsApp, Instagram, Telegram.
Cyber counterintelligence.
Collecting from specific various threat
manipulation techniques to lure and trap threats.
Great example of that, honey pots, passive DNA monitors,
online web trackers, fake profiling, publishing false reports, etc.
Indicators of compromise.
Information collected from network
security threats and breaches, also from the alerts generated by the
security infrastructure, which will likely indicate an intrusion.
Various IDOC sources, commercial and
industrial, free IDOC, online security related, social media, IDOC buckets.
Our industry association and vertical
communities collected from various threat intelligence sharing communities where the
organizations share intelligence information among each other.
Vertical community sources. Examples would be FSI SAC, Financial
Services Information Sharing and Analysis Center.
It's a mouthful.
Malware information sharing platform and information sharing and analysis, ITISAC.
Commercial sources.
Again, collected from commercial entities, various security vendors that provide
threat information, Kospersky, McAfee, Avast, FortiGuard, etc.
Government and law enforcement sources.
These go way back, especially the Certs.
Collected from government law enforcement
sources, for example, the US computer emergency readiness team or response team,
European Union Agency for network information, FBI Cyber crime, Stop Think
Connect, and Sirius. All right, deep and dark web searching.
The internet is a interconnected network of computers.
The Worldwide Web is all the resources that reside on the internet.
But when we think of the web, we've got
the surface web, we've got the deep web, and we've got the dark web.
The surface web is what we're meant to
find as an average human here on planet Earth.
The surface layer of online cyberspace allows users to find the web pages and
content using normal web browsers, pretty key.
It can be accessed by simple browsers,
Google Chrome, MoZilla, FireF ox, and Opera.
So anybody and everybody with a standard browser can access the surface web.
What hides under the surface web, though, is the deep or the dark.
The deep web consists of web pages and content that are hidden and unindexed,
cannot be located using traditional web browser and search engines.
They have to be accessed by special search
engineslike Deeper Web and surf wax, so they are not indexable.
You're not going to find them through
normal online searches with normal browsers.
The Dark Web or the Dark Net is even further down a subset of Deep Web
where it enables anyone to navigate anonymously without being traced.
Now you're adding in anonymization Tor proxies for a high degree of stealth.
It can be accessed by browsers like the
Tor browser, Freenet, Nuneet, 1 2P, 1 Swarm, and Retro share.
The Tor browser will also typically connect through the Tor routersthe onion
routersthat is a series of proxies in a dynamic circuit, encrypt the data
connection to mask your identity, keep you anonymous.
Deep and Dark Web Searching Tools, just to
expand on the previous slide, the Tor browser is the standard default
deep and dark web searching tool used to access the deep and dark web, or
it acts like a default VPN for the user, bounces the network IP address through
several servers before interacting with the web.
I just got done talking about that in the previous slide.
The whole deal with proxy chains is that
the last proxy in the chain is the only IP that the target website knows about.
Tracing back from proxy to proxy to proxy, you have to go from each proxy.
We talked a little bit about that in
transparent, non transparent, and anonymous or non anonymous proxies.
But the idea there is it's difficult to
trace back to the origin of your IP address.
Also, AI and predictive analysis for threat hunting.
Ai and machine learning, we've touched on this before, is going to take us a long
way in detecting unknown variants of attacks.
Remember that the issue with
signature based detection is you have to have seen the attack first.
You have to assimilate a definitive signature.
You have to program the software to look for the definitive signature.
Heuristics, anomaly detection, AI and
machine learning, figure this stuff out on their own, more or less.
Now, again, things like anomaly detection, high degree of false positives.
But with AI and machine learning, it
learns as it goes, and it learns to detect other variants, other similar attacks.
The idea there is it trains itself more or less.
Now, there's a lot of additional detail to that, but AI and machine learning will go
a long way in improving threat hunting, without a doubt.
A couple of examples of threat intelligence frameworks.
Misp, open source threat intelligence platform used for sharing, storing and
correlating indicators of compromise, and again, targeted tax, threat intelligence,
financial fraud information, vulnerability information, etc.
So the TC Identify Yeti threat stream, IV of X force Exchange, change.
Couple of examples of threat intelligence frameworks.
All right, standards and formats for sharing threat intelligence.
So we're seeing a lot more
formatting, definitions, security content, automation protocol, and
notations, and configuration, and so forth.
So these standards and formats give us
universal compatibility for the various engines that are utilizing these feeds.
Sibox, STIX, and Taxi are three to take note of.
Language or Serialization Format, Application Letter Protocol, and language
or serialization formats, application theory protocol, and language
for coding and communicating high fidelity information about cyber observables.
It's all about standardization and making
it universally understood by multiple applications following the same standard,
which I guess this is the definition of why we have standardization.