Hello and welcome to a new video in
the section 4 of cyber threat intelligence and Art
Club in this video. We will talk about the threat
intelligence use cases.
We will discuss four main use cases and Main
use case that it can be used on any case.
So let's get started. So just general
use case is used in
threat intelligence are Ai and threat intelligence dark
web monitoring.
Dump sites listing vulnerability intelligence
and apt monitoring. So let's
explain each and one of
them.
Ai and threat intelligence is the most discussed thing
in nowadays because AI is
the new trend
AI is controlling everything there's lots of
AI softwares lots of AI stuff.
But there's a huge link between it and threat intelligence. So
the huge use case here
is to let the AI analyze data for
us and process and filter
the data we have as we discuss in the
previous video we discussed about the main Challenge and
the future of cyber threat intelligence is
to let and to know how we can index
process and format our
data.
Using AI it can be way easier and we
can let the AI get more
data to us and index the entire internet and
the dark web so it can be a huge
and nice use case to be added
on the platform and to enhance it.
It doesn't mean we don't have it nowadays. Yes. We
have it a big example like recorded future
and
Casper sky and cross like they use AI
to collect and to filter the
data in the way. We need it.
And the Second Use case and the most important one for
this course is the dark web monitoring.
As you know the dark web and threat intelligence there is a huge
link between them because we can monitor everything
related to the dark web
using threat intelligence Fields. So the
fields or the data we have from the threat intelligence. We
can check if we have a dark web related stuff
like everything. It's coming from
the source not onion.
Okay, so we can check if we
have like a leaked data breach
for an X company we can check if
a credit card is being sold for a specific bank.
We can check individuals if an individual is being
targeted is being listed on
the dark web in a conversation. Let's say so this
is important. We can create alerts
and do the dark web monitoring
using the threat intelligence to facilitate this
process and make it easier and easier.
Another use case is the dump site listing basically
everything related to data breach
or a stuff that we don't
have the permission to view, but it's now available
to everyone.
Okay, it can be exposed credentials that
can be exposed license Keys. It can be.
It can be like account information geographic location.
It can be anything so dump sites. This thing are
for it can be to anything it can be even for
Netflix accounts.
And yes, so there's a lot of dumps like
this thing. It's being updated every day. And also
there's things related to that in telegram.
Also a telegram it's a huge topic and
we will discuss it separately and another video.
moving to the vulnerability intelligence threat intelligence
can prioritize and do the
intelligence of the vulnerability based on the tech stack
we have
So let's say we have a company.
Or our company or the client. They're using like a specific
text stack. They're using let's say Jenkins version
1.0. Let's
say or office 2016. They have also Windows Server
2019. Let's say so vulnerability intelligence
can be based on Tech stack for the
companies. So let's say we have a vulnerability for office
20 16. It's a critical
one, but also we have vulnerability for
the windows servers for the 2019 one.
Okay.
So basically it will prioritize the
vulnerability and will tell us what do we
have a new vulnerabilities for based on the tech stack
we have
So us as an engineer's or researcher, we can
identify and create report and to
patch as fast as we can based on the
rank and impact.
So the one with the huge impact we start with.
Okay, and so on and so on.
And lastly we have apt monitoring.
Or advanced persistent threat, which is the group of
hackers. We can monitor what the
hackers are doing what the technical tools that being using
the procedures the everything they're doing
what the next targets a previous targets everything
related to data that can help us
to identify what the group of hackers they're
doing.
So in this course, we will be mainly focusing
on the dark web monitoring the third
one since the sadarkwab course.
So in the dark web monitoring as we discussed
the main intelligence we need or
to study when it comes to dark web monitoring is
onion links exposed credentials.
Run some more dump sites apts
data breach leaked credit
cards or bin numbers and vulnerabilities. These
things are really important and these
we need to focus on them.
So a general use case or how can
we treat each use case and how we can conduct the
threat intelligence study.
So basically, we need to start by data collection.
The threat intelligence team
collects data from multiple sources, including social media platforms
search engines and dark web forms the second
step and the threat intelligence.
is to analyze
the team analyze the collected data to identify Potential Threat
and their impact on the influencers online presence this
analyze involves correlating data
from various sources to identify patterns and
Trends next. We have the dark web
intelligence. So the team leverage that our club intelligence
to identify emerging threats such as stolen credential personal
information Financial details being sold
on the dark web everything related to the
thing we're doing but on the Dark World
next in the fourth step. We must do the risk
assessment that team assess the risk post by each
Potential Threat to determine its severity and likelihood of
occurrence the risk assessments help to
prioritize the threats and allocate the
resource accordingly.
The fifth step we have is mitigation that team
develops a mitigation strategy as we said before
we have a technical threat intelligence.
Strategic one and we have the tactic one.
In this case. It's being strategic. We're creating a strategy
based on the risk assessment findings. This strategies
may include implementing security controls
changing password enabled to factor authentication and
monitoring for suspicious activity.
So when we do this implementation now, we're
talking tactical. So this is a huge example
for our previous video.
Lastly we have the reporting that team prepares a
report that provides insights into potential threats their impact
on the influencers online presence or
anything. We're doing we start online
influencers online presence has just an example and the
mitigation strategy implemented. These reports
are shared with the influencers relevance stakeholders,
including management it and security teams.
Again here I mentioned influencers online multiple
times because it's an example. It doesn't
mean it's it's the same every time.
so let's move to a real use case use case
1
banking sector and dark web
one of the most important use cases when
it's come to dark web and cyber threat intelligence.
Threat intelligence is crucial for the banking sector to protect
their customers' data and finances. The dark
web is breeding ground for cyber criminals who
are constantly looking for ways to exploit vulnerabilities
in the banking sector therefore incorporating dark
web intelligence into threat intelligence program
can provide valuable insights into Potential
Threat and enable proactive measures to be taken.
example leaked C7 and domain fishing
Also, we have type of squatting for the
domain also.
So leak C7 as I told you the example
before in the last video that we
monitor for our clients a
bins So based on that we can
find the leaked CC number.
And we can monitor many stuff for
the banking sector. It's not only CC it
can be vulnerability stack. The technology is
being used.
The APT is that only targets the
banking sector?
An example like apt-21 so all
of that it can be a huge link.
So use the threat intelligence and the
help of dark web to find data to
do the intelligence study and have the necessary data and
to know what to take steps the
next steps and to answer such a huge
threats.
So when it comes to banking sector, it's a
critical sector. It's really important. This must
be taken serious.
because every day we have leak CC and Bin
numbers and in this course, I will teach you how to find them
and we will do automation on it all so
in the next use case developers and
Art Club another important use
case because you know developers use
a lot of apis.
So apis are Essentials for modern application enabling
seamless integration with
third party service and systems. However, they also
post significant security risk with vulnerabilities
that can be exploited by cyber criminals the
other club as I prime source
for this governing and selling exploits that can be used to
Target apis. Therefore incorporating dark
web intelligence to threaten test program can provide a
valuable insights into potential API vulnerabilities and
proactive measures to be taken. So monitoring
apis API Keys
monitoring GitHub monitoring gitlab
monitoring everything related that is being used by
the developers in X company monitoring them
and
Linking dark web and threat intelligence we
can get valuable insights as we said and we
can identify threat and answer them and
we quickly make changes for developers because
these kind of stuff are really critical, especially
when we have a leaked
API key.
So as you know some libraries when you
write a program or a script that asks you that I
need an API key. So if this is
exposed it's a huge problem for the company and
they will be a huge blame on
the developer because he didn't know how
to encrypt or not
to publish size this API key.
The third use case is social media influencers and
dark web.
Social media influencers affluencers have
become a prime target for cybercriminals looking
to steal personal information and credentials and
financial details. The dark
web is a prime source for discovering and selling such
data making it essential for social media influencers
to incorporate dark web intelligence into
their intelligence programs. This can provide valuable
insights into Potential Threat and enabled for
all active measures to be taken.
Lastly we have the four the fourth use
case companies Tech stack and dark web which is a huge
example. I did give it multiple times and especially
earlier in this video. As I
said the tech stack we need to monitor the tech stack
for the company to know the vulnerabilities.
The example that I give the office and the Windows Server
2019. So companies use a
lot of software and Technologies either on the cloud or on-premise
and sometimes Engineers forgot to
update the software to be the to the latest
update which leads to vulnerability in some
cases.
It might be zero days at impacts the
entire organization and
jeopardizes the business. That's why
such complex scenarios company must do
vulnerability intelligence and monitored the whole
technology stack. And so that the organization can track
vulnerabilities and Patch them to be safe.
So that's why it's really important to do vulnerability intelligence
based on your stack. So you
have your cyber threat intelligence platform. You set
all the stack stack you have and you monitor
each one of them and you will get emails
or you will get a text
SMS and you will be notified if there's
something new or critical or medium vulnerability for
this software.
Thank you, and I will see you in the next video where we
will do a demo about the threat intelligence
tools.