• Home

  • Documents

  • Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding...
29
Threat Intelligence Директор Центра экспертизы Автоматизация работы с данными : что, зачем и как? ВСЕСЛАВ СОЛЕНИК [email protected]

Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

  • Upload
    others

  • View
    0

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Threat Intelligence

Директор Центра экспертизы

Автоматизация работы с данными : что, зачем и как?

ВСЕСЛАВ СОЛЕНИК

[email protected]

Page 2: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Что такое Threat Intelligence?

Page 3: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

“The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

SANS Institute

“Cyber threat intelligence is knowledge about adversaries and their motivations, intentions, and methods that is collected, analysed, and disseminated in ways that help security and business staff at all levels protect the critical assets of the enterprise.”

Definitive Guide to Cyber Threat Intelligence

“Threat intelligence is evidence based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.”

Gartner, McMillan (2013)from Tactics, Techniques and Procedures (TTPs) to Augment Cyber Threat Intelligence (CTI): A Comprehensive Study

Классика: академический подход

Page 4: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Что такое Threat Intelligence?

Индикаторы компрометации

Контекст(ы)

Взаимосвязи и обогащение

+

+

Page 5: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Что такое Threat Intelligence?

Знания

Актуальные Своевременные Непротиворечивые Достоверные

Которые можно проанализировать и применить человеком и машиной

Page 6: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Threat Intelligence: пирамида «мудрости»

Page 7: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Уровни Threat Intelligence

Технический• Индикаторы• Блокировка

Тактический• Анализ и понимание нарушителей и источников угроз• Поведенческое предвидение атак на«мою» организацию

Стратегический• Отчеты менеджменту• Предвидение новых задач и

новых нужд (люди, процессы, инструменты)

Page 8: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Связь с другими процессами

Внутренние источники Внешние технические источники Антропогенные источники

Threat Intelligence

Incident response

Security operations

Vulnerability management

Risk analysis

Fraudmanagement

IT Operations

Page 9: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Cyber Intelligence и формула SOC

Data/Log Management

Corellation

BI (Metrics)

Reporting

Page 10: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Концепции принятия решений

Page 11: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Качество TI прямо влияет на скорость и качество принятия решений по ИБ: чем лучше выше будет качество TI, тем ниже время реагирования и разрешения инцидента в общем случае

Киберразведка похожа на обычную разведку, как с точки зрения данных, так и с точки зрения процесса: это сбор большого количества источников, ранжирование и оценка релевантности – все ради принятия ключевого решения

\

Это осведомленность специалистов по ИБ, что позволяет пониматьландшафт угроз, планировать, внедрять и реализовывать адекватные защитные меры и меры по реагированию на инциденты

\

ИТАК…Threat Intelligence

\

TI должен обеспечивать другие процессы ИБЦенность и эффективность TI напрямую измеряется через эффективность использующих его процессов

\

Внутренний TI – признак зрелости SOCЕсли организация не производит индикаторы, значит выявление реагирование на инциденты не работают должным образом

\

Page 12: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Почему TI мало кто пользуется?

cложно оценивать пользу от применения TI

cложно применятьcложно интерпретироватьcложно получать

Page 13: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Сбор и обработка

Page 14: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Сбор и обработка

Page 15: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Сбор и обработка

{"md5": "8D2A50C4ABE53C48BB85F1D708C4052D","sha1": "28E853985367C7FA7B9163DAEE01E63BA47B7421","sha256": "B7F638B47D5C44E69C2E63A0AB9F89357784B0658BE929D8E1E0216C09FE01F4","link": "https://metadefender.opswat.com/results#!/file/bzE3MDIyMUgxWUZ6MXk5WWxIeTRna3ptVWtuNw/regular?utm_medium=json&utm_source=www&utm_campaign=threat_feeds","total_avs": 15,"total_detected_avs": 1,"threat_name": "Trojan/Heur!vwtunw","file_type_category": "E","file_type_extension": "exe","published": "2019-05-17"

}

Page 16: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Сбор и обработка

{"indicator": "5bdf483279a4a816ed4f8a235e799d5068d14f64","description": "","title": "","content": "","type": "FileHash-SHA1","id": 1055

}

Page 17: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Сбор и обработка

<cybox:Observable id="ibm:Observable-36987423ad99834bf10eb2abfe88ee82"><cybox:Title>XFE Observable for 1E3A57CFF7CBA8732364C26F4BBDCBE2</cybox:Title><cybox:Description>XFE Observable for 1E3A57CFF7CBA8732364C26F4BBDCBE2</cybox:Description><cybox:Object id="ibm:Object-54e4b1bf-9bea-6fba-7d96-0f45f4f53ff1"><cybox:Properties xsi:type="FileObj:FileObjectType"><FileObj:Hashes><cyboxCommon:Hash><cyboxCommon:Type xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type><cyboxCommon:Simple_Hash_Value condition="Equals">1E3A57CFF7CBA8732364C26F4BBDCBE2</cyboxCommon:Simple_Hash_Value></cyboxCommon:Hash></FileObj:Hashes></cybox:Properties></cybox:Object></cybox:Observable>

Page 18: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Облегчает выявление скрытых угроз, обеспечивая автоматический мониторинг релевантных индикаторов в SIEM, syslog и DNS-запросах

Ускоряет процессы ИБ,за счет быстрого поиска информации в доступных источниках и автоматизации ключевых сценариев

Позволяет вовремя блокировать угрозы и минимизировать возможный ущерб, благодаря автоматической выгрузке обработанных данных напрямую на СЗИ

\

Упрощает работу с данными TI,осуществляя непрерывный сбор, нормализацию и хранение данных из различных источников в единой базе

\

Платформа Threat IntelligenceА

вто

мат

иза

ци

я

Page 19: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Подход R-Vision

Сбориз разных источников

Обнаружениеиндикаторов компрометациивнутри инфраструктуры

Распространениена средства защиты для мониторинга и блокировки

Автоматизациясценариев использования индикаторов

Обработканормализация, агрегация

Обогащениеесли данных недостаточно

Page 20: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Сбор индикаторов и нормализация

IBM X-Force Exchange

Group-IB Threat Intelligence

Alien Vault OTX

Page 21: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Обогащение

Бывает, что контекста нет

Или его не хватает для анализа и принятия решения

VirusTotal Hybrid Analysis OPSWAT Metadefender Shodan

RiskIQ MaxMind Sypex

ipgeolocation.io ThreatMiner ThreatCrowd

TotalHash Whois

Page 22: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Обнаружение

Затронута ли моя инфраструктура сейчас?

Была ли затронута моя инфраструктура в прошлом?

Ретроспективный и проактивный поиск релевантных индикаторов в инфраструктуре

• В DNS-запросах • В потоке syslog-сообщений • В событиях SIEM: QRadar, ArcSight

Page 23: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Распространение

Отправка индикаторов компрометации на средства защитыдля мониторинга или блокировки

Page 24: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Общая схема

Поставщики данных Threat Intelligence

R-VisionThreat Intelligence Platform

СенсорSIEM

Внешние сервисы

Кросс-проверка

Обнаружение индикаторов

Обогащение

СенсорSyslog

DNS-сенсор

РаспространениеСЗИ

Page 25: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Определить, нужно ли это вам в принципе

Ответьте себе на вопрос: какие задачи вы

планируете решать с помощью TI?КАК НАЧАТЬ

РАБОТАТЬ С TI ?

Использовать платформу для сбора TI

Руками — сложно и неэффективно!

Регулярно оценивать качество источников TI

Фолсящие и бесполезные — выкидывать

Автоматизировать рутинные операции

Обогащение, мониторинг, блокирование

Page 26: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

И даже если без платных фидов

180+ свободно-распространяемых фидов в подборке: https://github.com/like-a-freedom/Intelligent-harvester/blob/master/config/settings.yaml

ФинЦЕРТ — доступен всем

IBM X-Force Exchange

AT&T Cybersecurity (ex Alien Vault OTX)

https://github.com/like-a-freedom/Intelligent-harvester/blob/master/config/settings.yaml
Page 27: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Open source - тоже вариант

MISP — коммьюнити-решение от Люксембургского CERT

(при наличии разработчиков и компетенций в команде)

OpenCTI— молодой проект, подающий

надежды, заложены правильные идеи

https://www.misp-project.org/download/
https://www.opencti.io/en/
Page 28: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Точки развития

Унификация и стандартизацияНе изобретение и принятие новых стандартов и форматов, а повсеместное их принятие и использование, типовые решения под отрасли и классы задач

End-to-end автоматизация процессаЗакрытие полного цикла сценариев работы с threat intelligence

1

2Развитие культуры обмена подходами к TI и коммьюнити в целомЗрелых и выстроенных процессов на рынке очень мало – давайте создавать российское коммьюнити, обмениваться опытом и подходом3

4Появление большего количества локальных источников TIКаждая организация — это источник TI. Централизация знаний в отраслевых центрах обмена данными киберразведки: государственных и коммерческих

Page 29: Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

БЛАГОДАРЮЗА ВНИМАНИЕ!

Подписывайтесь на наш бесплатный дайджест ИБ: rvision.pro/blog

[email protected] (800) 350 77 57


Exploits - from zero day to ongoing threat

Exploits - from zero day to ongoing threat

Technology
Conducting Computer Security Assessments at …compromise (e.g. cyber-attack, manipulation or falsification) consistent with the threat assessment or design basis threat.” (Ref

Conducting Computer Security Assessments at …compromise (e.g. cyber-attack, manipulation or falsification) consistent with the threat assessment or design basis threat.” (Ref

Documents
Threat Prevention Indicators of Compromise Management

Threat Prevention Indicators of Compromise Management

Documents
Common Exploits

Common Exploits

Documents
Les exploits

Les exploits

Documents
Using Honeyclients for Detection and Response Against New ... · Client-side exploits are a growing threat – Lots of client-side vulnerabilities Microsoft Internet Explorer has

Using Honeyclients for Detection and Response Against New ... · Client-side exploits are a growing threat – Lots of client-side vulnerabilities Microsoft Internet Explorer has

Documents
Deep-dive: MikroTik exploits - a security analysis · secure against outside exploitation * ... •In effect, someone could compromise your PC when you connected to a router seeding

Deep-dive: MikroTik exploits - a security analysis · secure against outside exploitation * ... •In effect, someone could compromise your PC when you connected to a router seeding

Documents
SECURE PROGRAMMING Chapter 1. Overview What is the problem Cost? Threat? Software Security Concepts Policy Flaws Vulnerabilities Exploits Mitigations

SECURE PROGRAMMING Chapter 1. Overview What is the problem Cost? Threat? Software Security Concepts Policy Flaws Vulnerabilities Exploits Mitigations

Documents
Frontal attacks: from basic compromise to Advanced ... · from basic compromise to Advanced Persistent Threat ... Presentation in French ... Web Hacking activities have

Frontal attacks: from basic compromise to Advanced ... · from basic compromise to Advanced Persistent Threat ... Presentation in French ... Web Hacking activities have

Documents
Solution Brief Core Threat Intelligence - · PDF fileCore’s Threat Intelligence, ... + Correlate with threat intelligence to provide context to a ... C&C Indicators of Compromise

Solution Brief Core Threat Intelligence - · PDF fileCore’s Threat Intelligence, ... + Correlate with threat intelligence to provide context to a ... C&C Indicators of Compromise

Documents
Monthly Cyber Threat Briefing - HITRUST...Indicators of Compromise (IOCs) for an Advanced Cyber Threat • Collaborative effort between DHS/NCCIC/US-CERT and the FBI. • Based on

Monthly Cyber Threat Briefing - HITRUST...Indicators of Compromise (IOCs) for an Advanced Cyber Threat • Collaborative effort between DHS/NCCIC/US-CERT and the FBI. • Based on

Documents
Low Level Exploits

Low Level Exploits

Technology
Trends in Global Cybersecurity - info.microsoft.com...threat landscape of exploits, vulnerabilities, and malware. We’ve used data gathered from more than 600 million computers worldwide

Trends in Global Cybersecurity - info.microsoft.com...threat landscape of exploits, vulnerabilities, and malware. We’ve used data gathered from more than 600 million computers worldwide

Documents
Customizing Public Exploits

Customizing Public Exploits

Documents
Ed Rowley - People Make the Best Exploits: Roadmapping your security investment in line with the emerging threat landscape (#ExecLN Event)

Ed Rowley - People Make the Best Exploits: Roadmapping your security investment in line with the emerging threat landscape (#ExecLN Event)

Technology
Invasaocom exploits

Invasaocom exploits

Technology
BGP Security Techniques - APRICOT · both discuss BGP security techniques ... • Miscreants often patch exploitable code once they compromise ... Japan APRICOT 2005 8 Exploits Forwarding

BGP Security Techniques - APRICOT · both discuss BGP security techniques ... • Miscreants often patch exploitable code once they compromise ... Japan APRICOT 2005 8 Exploits Forwarding

Documents
Title: Ransomware: How consumers and businesses value ...... · latest threat trends including vulnerabilities, exploits, active attacks, viruses and other malware, spam, phishing,

Title: Ransomware: How consumers and businesses value ...... · latest threat trends including vulnerabilities, exploits, active attacks, viruses and other malware, spam, phishing,

Documents
SECURITY REIMAGINED FireEye Network Threat...The FireEye ® Network Threat Prevention Platform identifies and blocks zero-day Web exploits, droppers (binaries), and multi-protocol

SECURITY REIMAGINED FireEye Network Threat...The FireEye ® Network Threat Prevention Platform identifies and blocks zero-day Web exploits, droppers (binaries), and multi-protocol

Documents
TCP Exploits

TCP Exploits

Documents
iDefense Threat Indicators Service | Accenture...The iDefense Threat Indicators Service provides a list of vetted indicators of compromise, allowing customers to divert and block traffic

iDefense Threat Indicators Service | Accenture...The iDefense Threat Indicators Service provides a list of vetted indicators of compromise, allowing customers to divert and block traffic

Documents
Lecture 3, Monday September 17: Slavery’s Westward Threat Regional Tensions develop over Politics & Economics of Slavery Missouri Compromise –1820 Tallmadge

Lecture 3, Monday September 17: Slavery’s Westward Threat Regional Tensions develop over Politics & Economics of Slavery Missouri Compromise –1820 Tallmadge

Documents
Writing exploits

Writing exploits

Technology
Client Side Exploits

Client Side Exploits

Documents
The Constitutional Convention (1787) Compromise, Compromise, Compromise!!!

The Constitutional Convention (1787) Compromise, Compromise, Compromise!!!

Documents
SolarWinds and Active Directory/M365 Compromise: Detecting … · 2021. 4. 15. · SolarWinds and Active Directory/M365 Compromise: Detecting Advanced Persistent Threat Activity from

SolarWinds and Active Directory/M365 Compromise: Detecting … · 2021. 4. 15. · SolarWinds and Active Directory/M365 Compromise: Detecting Advanced Persistent Threat Activity from

Documents
Anoiting for Exploits

Anoiting for Exploits

Documents
Buffer Overflow Exploits

Buffer Overflow Exploits

Documents
Frontal attacks: from basic compromise to Advanced ... · Frontal attacks: from basic compromise to Advanced Persistent Threat 15 september 2011 Frédéric BOURLA Head of Ethical

Frontal attacks: from basic compromise to Advanced ... · Frontal attacks: from basic compromise to Advanced Persistent Threat 15 september 2011 Frédéric BOURLA Head of Ethical

Documents
Indicators of Compromise per Cyber Threat Intelligence e ... of Compromise per la... · •Creazione di IoC •Arricchimento di informazioni di contesto ... Data Warehouse 41 1. Logs

Indicators of Compromise per Cyber Threat Intelligence e ... of Compromise per la... · •Creazione di IoC •Arricchimento di informazioni di contesto ... Data Warehouse 41 1. Logs

Documents