Hello and welcome to the new section cyber
threat intelligence and dark web. This
is the section 4 in this video. We will talk about
the introduction to threat intelligence.
In this video, we will focus about the basics of
threat intelligence that challenges the benefits and
the tools that's being used the
nowadays for the Cyber threat
intelligence.
So let's start in three introductory. So cyber threat
intelligence is a data.
That is collected process and analyzed to understand a
threat actor motives targets and attack
behaviors threat intelligence
enable us to make faster intelligence enable
us to make faster more informed data
back security decisions and change
their behavior from reactive to
proactive in the fight against threat actors.
So cyber threat intelligence is a evidence-based knowledge
context mechanism indicators implications
action-oriented advice.
About existing or emerging Menace or hazards
to assess.
So basically the cyberpath intelligence.
We use it to conduct the security research and
to have the intelligence about the
threats. We currently studying.
It depends between company to
company or the client you have so
why we need threat intelligence. The
threat intelligence is needed because we can
study for our clients or to
the company that we own to help us
understand more the threats and how
to prevent it or to answer it as fast as possible an example
for threat intelligence. It can be monitoring for
the latest vulnerability latest TV is
malware's the techniques. It's being used by the
hackers. What are the latest malware's what
they are doing the group of hackers example, apt-21
what they are doing what bank
is being targeted. Am I gonna be the next
impact so we study that's present intelligence.
Basically, it's a study
About what's Happening Now what's happening next? That's all.
And that's why it's important. So the goal of the
city I is the to enable the organization to make informed decision
about their cybersecurity posture by
providing them with actionable intelligence that
can help them identify mitigate
potential threats before they can
cause harm.
Moving on with the types of threat intelligence. Basically,
we have two types main types of CTI.
Usually there's free but in
the introduction of certain intelligence and scores,
I will just focus on two types
because they are the main one the most
used ones in the city is so basically we
have tactical and strategic.
The Tactical City I focuses on everything Technical
and strategic focus on how
to conduct.
The technical thing we need to do.
So basically the Strategic it's like the Playbook and the
Tactical is the execution. Okay?
So tactical City I focus on immediate threat
facing on organizations such as weather infection
or phishing attacks and the Strategic
CTI on the other hand looks at
the bigger picture analyze trans and patterns and
cyber threat to identify potential future risk.
Both types of CTI are important for
organization to have a comprehensive understanding
of their cybersecurity landscape and
to be able to proactively defend against potential attacks.
Sources of cyber threat intelligence, which is
the most important thing when it
comes to the usage of cyber threat intelligence
platforms.
So usually in cyber threat intelligence.
We have platform that we use to conduct our research.
For example, the most used platforms nowadays as
crowdstrike falcon or recorded future or
Casper Skype cyber threat intelligence.
These three are the most popular
and the most used ones.
So how do they get their sources or the data?
CTI platforms come from a variety
of sources including open source intelligence.
Social media monitoring dark web monitoring and threat
intelligence feeds from vendors.
What's important here also and the key here,
especially for this course, we mentioned dark
web monitoring. Yes infinite intelligence.
We have data coming from dark web because it's being
automatized using AI that it's collect data
every day every second every
moment. So we have new data always.
So it's organization can also generate their own
City I through internal monitoring and Analysis of their
networks and systems as well as sharing information
with other organization in that industry
or sector.
Organization can automate this process they
can create their own monitoring.
We can create like a python script to monitor a specific
thing on the internet or we can create a
telegram bot or notify us with everything new and
what's happening in this world.
Let's say I need to monitor what credit
card are being sold on the dark web or I need
to monitor latest zero days from sources
that I only know.
So you created and the automated based on
organization of fasciate the process of the conductor
research for the thread intelligence in
your company or for a clients.
The challenges and cyber threat intelligence. One of
the big challenges in CTI is the data.
So the data we have is a lot. It's big.
The huge challenge is how to process how to
analyze such a big chunk of data.
With so much information available. It can be difficult for
organization to identify the most relevant and
actionable intelligence. So that's why mostly we
use platforms and we rely on it like the
recorded future or Cloud strike Orchestra Sky,
we rely on them because they do all
of this difficult stuff and make it easier for us
as Engineers or researchers to conduct the
threat intelligence easier and easier for our
main purpose
another challenge can is the constantly evolving nature
of cyber threat.
Which requires organization to stay up to
date with the latest trends and techniques used by the
attackers?
The benefits of cyber threat intelligence is that
CPI provide numerous benefits organization,
including improved situation situational awareness
more effective incident response
better risk management having a
comprehensive understanding of their cyber security landscape organization
can make it informed and
their decision about how to allocate resource and
prioritize their security efforts ultimately reducing
the risk of successful cyber attacks.
Let's say example. So using the
platforms. Let's say I'm using
recorded future so you can like
create an alert and Automotive. What
do you want to monitor?
Since recorded future have a lot
of data through their AI you can
have access to millions of millions of data that's
being updated every moment and help
you what you want to monitor. So let's say I need
to monitor for one of my
banking clients. I want to monitor their
bin number. So as you know, Ben is
the bank identification number.
And every bank has their own bins. Okay. So
the bin is basically the
sixth digit numbers first from the
first of the credit card or the debit card.
So we can monitor.
For let's say we have X Bank
our client. So we monitor the X Bank.
And let's say the bin was one two, three, four five
six. So we monitored this and we tell recorded
future if you find this in any
source that you have as a bin notify
us so that we know it's being sold online
on the dark web or anywhere on the internet and
we can like notify the customer you
have this this what do
you want to do?
Okay. So basically that's one of the
importance of the Cyber threat intelligence
that you can monitor as something
specific you can automate you can create your own
intelligence feed. You can export your
intelligence to other tools. Let's say
you have
collected the new iOS
from let's say recorded future or Casper Sky
you have like the daily iocs or the malicious IPS
hashes that identify hackers.
So you can use them in your
Sim in your or on the
whole sock environment to make sure that your
monitor and you update your repository
of the demolition stuff
to eliminate false positive. So also cyber threat
intelligence and AIDS the the team
of soc and IR team and
the third team and many many more in
the cyber security operations that's
happening in the companies.
Also, what's good and cyber stress intelligence that you
can receive or you can do
a daily threat.
Threat reports like latest trends latest
IPS latest hashes domains
technical procedure used
by hackers. Like what's the new tactics
that's being used by hackers the new tools
and to know what to do and how to conduct the
research. So it helps you also in your
everyday it helps you you're being
up to date with the latest trends.
So that's how important a threat intelligence and 3D must
be taken into consideration with every company
and the whole world the concept of threat
intelligence.
So the future of cyber threat intelligence as
the Cyber threat continue to evolve and become more sophisticated the
need for Effective City. I will increase will
only increase organization will need to invest in
advance technology such as machine learning artificial
intelligence to help them process and analyze the
vast Amendments of data involved in CTI additionally
collaboration and information sharing between
organization will become even more important our cybercriminals
increasingly Target entire Industries
or sectors rather than individual organizations.
So here's some tools that I want to show cyber threat
intelligence platform. We have crowdstrike that we mentioned before
we have recorded future the sky Q 0
Forks Mandy and Palo Alto digital Shadows. Anomali
Flashpoint IBM, all of these platforms are really
good. But my favorites are crowdstrike recorded
future and Casper Sky because they are the king
of the market in CTI.
So I really recommend them but
unfortunately and this course I won't
be able to show a lot of them on them because they
are licensed tools. So in this
section, we will focus more on the open source or
and the free tools but I will show some screenshot in
crowdstrike and it got it future how it looks like the
alerts the data and to
get an idea how they work.
And I will see you in the next video the threat
intelligence use cases.