Embed Size (px)
Citation preview
Threat Intelligence 101
Getting SmarterSteve Lodin
Sallie Mae Bank
Director, Cyber Security Operations
Threat Intelligence 101
• Learn about Threat Intelligence• What/Why/How
• Technology
• Be able to evaluate your organization’s maturity
• Understand some of the Gotchas
Traffic Light Protocol
Before we begin…
https://www.us-cert.gov/tlpW
e ar
e:
Acronyms• CND – Cyber Network Defense
• CISA – Cyber Information Sharing Act
• CTI – Cyber Threat Intelligence
• CybOX – Cyber Observable eXpression
• CTIIC - Cyber Threat Intelligence Integration Center
• DGA – Domain Generation Algorithm
• IOA – Indicators of Attack
• IOC – Indicators of Compromise
• ISAC / ISAO – Information Sharing and Analysis Center / Organization
• MD5 – Message Digest v5
• MRTI – Machine Readable Threat Intelligence
• NCCIC - National Cybersecurity and Communications Integration Center
• OSINT – Open Source Intelligence
• OTX – Open Threat eXchange
• SHA1/SHA2 – Secure Hash Algorithm v1 and 2
• SIEM – Security Information and Event Management
• STIX – Structured Threat Information eXchange
• TAP – Threat Analytics Platform
• TAXII – Trusted Automated eXchange of Indicator Infomation
• TLP – Traffic Light Protocol
• TTP – Tactics, Techniques, and Procedures
Before we begin…
Example Threat Intelligence
Before we begin…
What/How
Who/Why/How
InvestigateImplement
Hunt
Share
What / Why / How
Gartner – May 2013
What is Threat Intelligence?
Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.
What / Why / How
Where are we?
What / Why / How
Audience Participation:Are you aware of CTI Sharing…?
Where are we?
What / Why / How
Audience Participation:Do you think it is valuable…?
Why should you care?
• Sobering Stats
• There were 38% more cyberattacks in 2015 than in 2014, along with a 56% rise in the theft of intellectual property
• In the U.S., a mind-boggling 169 million personal records were compromised, across the major sectors of financial, business, education, government and healthcare
• In 2015 ISACA survey, 86% of nearly 3500 organizations believed there is a shortage of skilled IT security professionals to handle these problems
What / Why / How
TechRepublic Article 3/15/2016
Why should you care?
• Tactical Perspective• Proactively detect or defend against attacks before they happen• Diagnose infected corporate systems• Breach Discovery • Discovery of an APT
• Strategic Enhancements• Track threats targeting your company or industry• Use of Analysis to Improve Risk Assessments• Change in Defenses
• Community Posture• Be a good neighbor – help support your sharing community
What / Why / How
How does a company use Threat Intelligence?
• Attack prevention/detection• Primary use case
• Forensics• Helping to investigate attacks and compromises
• Hunting• Using big data to discover anomalies
What / Why / How
What “data” do you see?
• Compromised Devices• Systems communicating with known bad sites and C&Cs
• Malware Indicators• IOAs and IOCs
• IP Reputation• Geolocation• Known bad Tor/Proxy/VPN providers• Watering Holes
• Command and Control Networks• Malware origination, botnet controllers
• Phishing Messages• Business Email Compromise and Email Attack Campaigns
What / Why / How
Soltra
Wh
at /
Wh
y /
Ho
w
Pain Level
David Bianco
What / Why / How
What does the team do?
What / Why / How
What’s coming at us
How we respond
What does the team do?
What / Why / How
Threat IntelligenceSources
Security Solutions
Distribute Indicators of Compromise
NothingFound
Investigate
Forrester Research + Steve
Here is how we handle threats!
What / Why / How
Sometimes that can backfire!
Sharing
• Threat intelligence sharing is considered the most effective in preventing attacks.• According to respondents, an average of 39% of all hacks can be thwarted
because the targeted organization engaged in the sharing of threat intelligence with its peers.
• Additionally, out of all technologies available, threat intelligence sharing was cited by 55% of respondents as the most likely to prevent or curtail successful attacks.
• Requires an excellent IT security infrastructure• The platform also must be part of a larger, global ecosystem that enables a
constant and near real time sharing of attack information that can be used immediately to apply protections to prevent other organizations in the ecosystem from falling victim to the same or similar attacks.
What / Why / How
Ponemon Report: Flipping the Economics of Attacks Jan 2016
Types of Sharing
• OSINT• Share with the world
• ISACs• Share your attacks and IOCs with your industry peers
• Anonymous• Share your attacks and IOCs with peers
under no attribution
• Cybersecurity Information Sharing Act• Share your data with the DHS and DOJ
What / Why / How
How can you succeed?
1. Understand Threat Intelligence
2. Achieve Organizational / Leadership / Board Buy-in• Requires approval for People / Process / Technology
3. Determine Necessary Skills and Staffing• Options are internal, outsourced, MSSP
4. Buy Appropriate Technology Solutions• RFI/RFP and PoC
5. Choose the Right Feeds
6. “A Cyber Hunting We Will Go”
What / Why / How
Technology
Threat Intelligence Feeds
• Internal (+$0-$$$, +Info, +Private)• Security logs and network data, including DNS logs, email logs, web proxy logs, etc…
• OSINT and Open Source Data ($0, +Info, +Work)• Open source intelligence (OSINT) providers comb through a multitude of information
sources, looking for intelligence about possible threats against your company.• OSINT feeds give you needed intelligence to prevent attacks before they happen.
• ISACs (+$, ++Industry, +Info)• Information sharing and analysis centers (ISAC) provide threat intelligence to specific
industries. Examples FS-ISAC, MS-ISAC, NH-ISAC and HITRUST Cyber Threat XChange
• Commercial (++$$, ++Info)• Threat intelligence feeds from commercial companies contain proprietary research
determined by how the company detects threats.• Some companies focus mainly on threat intelligence streams. Other companies offer
threat intelligence streams as part of an integrated suite of security services.
Technology
Audience Participation:Who has a team using…?
automaterPacketmailPacketmail
OSINT Feed Examples
Technology
OSINT & Commercial Feed Example
Technology
Commercial Feed Example
Technology
Anonymous Data Sharing
Technology
The Big Picture
Technology
Soltra
Platforms
• These are threat intelligence aggregation, analysis, and collaboration environments.
• Provides visibility across feed sources, threat classifications, network, applications, host elements and many other threat observables.
Technology
Platform Functions
• Ingest threat intelligence and normalize it
• Rate intelligence sources (over time)
• Provide an analyst workspace
• Provide visualization and pivoting
• Provide enrichment
• Enable internal and external collaboration/sharing
Technology
ThreatConnect
Level 4 – Well-defined Threat Intelligence Program
Operational and StrategicOperational Playbooks, C-level Alignment,
Integration with Biz, IT, SecLeading Industry and/or Technology TI
Community
Level 3 – Threat Intelligence Platform in Place
Dedicated Personnel, Multi-tier People/Process/Tech Bi-directional Sharing, Participation in ISAC
Level 2 – Expanding Threat Intelligence Capabilities
Team and SOC Threat Intelligence Platform Hunt and Respond, Internal and External
Level 1 – Warming up to Threat Intelligence
Small Team Some Automation Internal Focus
Level 0 - Unclear where to start
No Team Manual, incident based efforts Internal Focus
Mat
uri
ty
Hunting Maturity Model
Maturity
David Bianco – Oct 2015
Gotchas
Overloading the team
• To say that the threat landscape is overwhelming is the understatement of the year. Targeted attacks are on the rise with increasing sophistication, and our detection and response capabilities are woefully inadequate. Advanced persistent threats, espionage, spear phishing, and disrupted denial of service attacks dominate the headlines.
Gotchas
Got Intelligence? Now what?
• When the incoming sources start adding up, how do you manage that efficiently?• Need to scale up to a platform
• Wouldn’t it be easier to have high confidence threat indicators loaded into your security systems for detection and immediately take action?• Orchestration
• Easier said than done
Gotchas
Things are not always as they seem
• Location, Reputation, and Confidence Conflicts
• Indicators can age
Gotchas
Things are not always as they seem
• Over compensating for every threat that may not impact your company
Gotchas
There is no silver bullet
• Quality matters more than quantity when choosing feeds
• It's Not What You Know, It's What You Do With It• It’s not so much the collection or processing of intelligence.
• It's the communication of intelligence between different areas of the organization. Red teams, security operations centers (SOCs), incident response (IR), vulnerability management…
Gotchas
Closing
Threat intelligence cannot be bought
Rather, the threat intelligence journey is a multistep road map
1) lays a solid foundation of essential capabilities
2) establishes buy-in
3) identifies required staffing and skill levels
4) establishes your intelligence sources
5) drives actionnable intelligence
Closing
Possible Solution Providers
Closing
Forrester Research 2015
Research
Closing
https://www.mindmeister.com/de/137280416/information-security-technologies-markets
Why (or Why Not)?
Closing
Audience Participation:
Do you feel stronger now about using TI than when we started today...?
Is TI more valuable now?
Why?
The power of threat intelligence is it allows
somebody else's detection to be your prevention.
Orchestration and bi-directional participation
signals growing in maturity.
Closing
Median Days to Breach DetectionFireEye/Mandiant
Questions?
Closing
