Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series....

30
Building an intelligence-driven organization TLP:WHITE Anastasios Pingios 4 May 2020 FIRST Cyber Threat Intelligence Webinar Series

Transcript of Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series....

Page 1: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

Building an intelligence-driven organization

TLP:WHITE

Anastasios Pingios

4 May 2020FIRST Cyber Threat Intelligence Webinar Series

Page 2: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

All opinions expressed are my own, and do not represent my employer.

Disclaimer.

Page 3: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

About.

● Principal Security Engineer at Booking.com

● Contributor at MITRE ATT&CK framework

● @xorlgr

● SANS GCTI, RecordedFuture Geopolitical Analyst, Bellingcat OSINT, ISS OSINT, ...

Page 4: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Agenda.

● Definition

● Risk versus threat-based approach

● The 5 phases

Page 5: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Definition.

Threat intelligence

Page 6: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Definition.

Threat intelligence

● Intent● Opportunity● Capability

Page 7: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Definition.

Threat intelligence

● Product● Process

Page 8: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Definition.

Threat intelligence

● Product● Process

Page 9: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Definition.

If you know the enemy and know yourself, you need not fear the

result of a hundred battles.Sun Tzu, The Art of War

Page 10: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Definition.

If you know the enemy and know yourself, you need not fear the

result of a hundred battles.Sun Tzu, The Art of War

Page 11: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Risk vs threat-based approach.

Page 12: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Risk vs threat-based approach.

Risk = Impact x Likelihood

Page 13: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Risk vs threat-based approach.

Page 14: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Risk vs threat-based approach.

Threat = Opportunity +

In

tent + Capability

Page 15: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Risk vs threat-based approach.

● Covers all cases● Well known● Standardized

● Very specific● Applicable to all

levels● Proactive security

Risk-based Threat-based

Page 16: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Why?

Page 17: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Why?

Page 18: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Why?

The Sliding Scale of Cyber SecurityRobert M. Lee - September 2015

Page 19: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Phase 1: The beginning.

● Typically on spare-time ● No Intelligence Requirements? Start small

● Analysis on past incidents

● Build campaigns & threat actor profiles

● Develop simple products and get lots of feedback(WARNING: DO NOT MAKE THIS AN ECHO CHAMBER)

Page 20: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Phase 1: The beginning.

Cyber-security team(s)

TI “team”

Products

● Past campaigns● Past threat actor profiles

Customers

● Cyber-security team(s)● Cyber-security leadership

KPIs

● Consistency of products● Incidents analyzed

Page 21: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Phase 2: External threats.

● Map identified threat actors/groups to external ones

● Track their activities and proactively deploy controls

● Develop processes and focus on quality

● Start measuring key indicators

● Share success stories / develop good reputation

Page 22: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Phase 2: External threats.

Cyber-security team(s)

TI “team”

Products

● Actor/campaign tracking● External/internal mapping

Customers

● Cyber-security team(s)● Cyber-security leadership

KPIs

● Incident response from TI● False positive/negative rate

Page 23: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Phase 3: Formal CTI function.

● Clear mission, vision, and purpose

● Goal-driven intelligence - be a force multiplier

● Quality over quantity!

● Start offering intelligence products for all levels (strategic, tactical, and operational) based on PIRs

● Formal team KPIs

Page 24: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Phase 3: Formal CTI function.

Cyber-security team(s)

CTI team

Products

● Support for RFIs● Regular threat updates

Customers

● Cyber-security team(s)● Cyber-security leadership

KPIs

● Response time on RFIs● Quality of products

Page 25: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Phase 4: Intelligence-driven security.

● Expand beyond cyber

● Provide intelligence services to all security teams

● Find links between threats from different domains

● Holistic intelligence reporting

Page 26: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Phase 4: Intelligence-driven security.Products

● Analytical support● Multi-domain intelligence

Customers

● All security teams● Security leadership

KPIs

● Metrics of proactive actions● Teams utilizing TI resources

Fraud prevention

Security department

Physical security

Cyber-security team(s)

GRC

TI team

Page 27: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Phase 5: Intelligence-driven organization.

● Natural progression

● Build and train specialized intelligence teams

● Moving to the “left side of the boom” collectively

● Wider adoption of threat-based prioritization

● Create an internal intelligence community

Page 28: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Phase 5: Intelligence-driven organization.

KPIs

● Per domain KPIs● Deviations from standards

Company

Security

HR

TI teams

Legal

Finance

Product development

Customers

● All company teams● All company leadership

Products

● Analytical support● Domain specific RFIs

R&D

TI teams

TI teams

Sales

Page 29: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

Summary.Threat-based

Risk-based

Phase 1: Beginning

Phase 2: External threats

Phase 3: Formal CTI function

Phase 4: Intelligence-driven security

Phase 5: Intelligence-driven organization

Page 30: Building an intelligence-driven organization · FIRST Cyber Threat Intelligence Webinar Series. TLP:WHITE ... Risk vs threat-based approach. Covers all cases Well known Standardized

TLP:WHITE

References.

@xorlgr

Anastasios Pingios

● Conducting Risk Assessments, NIST 800-30

● MITRE ATT&CK framework

● The Sliding Scale of Cyber Security, Robert M. Lee - September 2015

● Left of boom: Do we actually do this?, Anastasios (xorl) Pingios - December 2019


Solution Brief Core Threat Intelligence - · PDF fileCore’s Threat Intelligence, ... + Correlate with threat intelligence to provide context to a ... C&C Indicators of Compromise

Solution Brief Core Threat Intelligence - · PDF fileCore’s Threat Intelligence, ... + Correlate with threat intelligence to provide context to a ... C&C Indicators of Compromise

Threat intelligence platforms

Threat intelligence platforms

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

SMARTER Threat Intelligence · Our threat intelligence is derived from the Webroot® Threat Intelligence Platform, our proprietary cloud-based security analysis architecture designed

SMARTER Threat Intelligence · Our threat intelligence is derived from the Webroot® Threat Intelligence Platform, our proprietary cloud-based security analysis architecture designed

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Certified Threat Intelligence Analyst - Koenig Solutions · Certified Threat Intelligence Analyst Course Outline Module 01: Introduction to Threat Intelligence Understanding Intelligence

Certified Threat Intelligence Analyst - Koenig Solutions · Certified Threat Intelligence Analyst Course Outline Module 01: Introduction to Threat Intelligence Understanding Intelligence

TLP:WHITE HELP! TLP:WHITE Ransomware

TLP:WHITE HELP! TLP:WHITE Ransomware

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

NETSCOUT THREAT INTELLIGENCE REPORT · NETSCOUT Threat Intelligence LETTER FROM NETSCOUT THREAT INTELLIGENCE Today, attackers can release enormous terabit-per second-scale DDoS attacks

NETSCOUT THREAT INTELLIGENCE REPORT · NETSCOUT Threat Intelligence LETTER FROM NETSCOUT THREAT INTELLIGENCE Today, attackers can release enormous terabit-per second-scale DDoS attacks

Threat Intelligence - NCC Group · Introduction Threat intelligence: a maturing defence differentiator Understanding the types of threat intelligence: from the generic to the specific

Threat Intelligence - NCC Group · Introduction Threat intelligence: a maturing defence differentiator Understanding the types of threat intelligence: from the generic to the specific

THREAT INTELLIGENCE PLATFORMSdocs.media.bitpipe.com/io_12x/io_128188/item_1253423/ThreatCon… · Effective threat intelligence management is an ongoing effort. The threat landscape

THREAT INTELLIGENCE PLATFORMSdocs.media.bitpipe.com/io_12x/io_128188/item_1253423/ThreatCon… · Effective threat intelligence management is an ongoing effort. The threat landscape

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

State of Threat Intelligence Studyf6ce14d4647f05e937f4-4d6abce208e5e17c2085b466b98c2083.r3.cf1.rackcdn.c…Operationalizing Threat Intelligence .....11 2016 Threat Intelligence Agenda

State of Threat Intelligence Studyf6ce14d4647f05e937f4-4d6abce208e5e17c2085b466b98c2083.r3.cf1.rackcdn.c…Operationalizing Threat Intelligence .....11 2016 Threat Intelligence Agenda

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

MACHINE READABLE THREAT INTELLIGENCE - CRNi.crn.com/custom/LookingGlass_MRTI Feeds_Final_Nov_2016.pdf · machine readable threat intelligence collecting internet intelligence for

MACHINE READABLE THREAT INTELLIGENCE - CRNi.crn.com/custom/LookingGlass_MRTI Feeds_Final_Nov_2016.pdf · machine readable threat intelligence collecting internet intelligence for

Threat Intelligence - Amazon Web Services · Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence ... Goal of Intelligence Analysis. Cyber Kill Chain™ Model ...

Threat Intelligence - Amazon Web Services · Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence ... Goal of Intelligence Analysis. Cyber Kill Chain™ Model ...

Threat monitor Threat Intelligence Report Q1 2020

Threat monitor Threat Intelligence Report Q1 2020

Cyber Threat Intelligence Enterprise & Cyber … Threat Intelligence Enterprise & Cyber Security August 2017 Copyright Fujitsu Limited 2017 Global Impact Fujitsu Cyber Threat Intelligence

Cyber Threat Intelligence Enterprise & Cyber … Threat Intelligence Enterprise & Cyber Security August 2017 Copyright Fujitsu Limited 2017 Global Impact Fujitsu Cyber Threat Intelligence