Instructor: Security and threat intelligence. 2 2
These days, we have to use 3 3
our intelligence-driven defense 4 4
to create a solid defensive posture. 5 5
We can't rely on the way we've done things historically. 6 6
Now, historically, our focus was on configurations. 7 7
We would set up the right firewalls, 8 8
the right ACLs, install the right antivirus, 9 9
and then we would say, "Hey, we're protected." 10 10
But these days, that simply isn't enough. 11 11
While all these technologies are very important, 12 12
they don't by themself give you enough defense 13 13
against a thinking adversary that uses modern cyber attacks. 14 14
So instead, it's really important 15 15
for us to think about the idea 16 16
of security intelligence and cyber threat intelligence. 17 17
And that's what we're going to focus on in this lesson. 18 18
Now, security intelligence is the process 19 19
through which data is generated 20 20
in the ongoing use of the information system. 21 21
And that data is going to be collected, processed, analyzed 22 22
and disseminated to provide us 23 23
with insights into the security status of those systems. 24 24
So if you think of a standard system administrator, 25 25
they log things on their system and they review those logs. 26 26
That is a form of security intelligence. 27 27
It's for them to be able to understand 28 28
what is their system doing. 29 29
As they go through their firewall logs, 30 30
their intrusion detection alerts and other things like that, 31 31
you're understanding what your posture is internally 32 32
inside your network 33 33
and what your organization's security posture is now set at. 34 34
Now, on the other hand, 35 35
we have to consider our cyber threat intelligence as well. 36 36
Now, cyber threat intelligence is the process 37 37
of investigating, collecting, analyzing 38 38
and disseminating information about the emerging threats 39 39
and threat sources to provide data 40 40
about the external threat landscape. 41 41
So when we're talking about security intelligence, 42 42
we're thinking inward, how are our systems looking? 43 43
But when we think 44 44
about cyber threat intelligence, we're looking outward. 45 45
We're thinking about the attacker groups, 46 46
we're thinking about malware outbreaks. 47 47
We're thinking about zero-day exploits and things like that. 48 48
All those bad things that are out there that can attack us 49 49
and hurt us, that is what we're focused on 50 50
when we're doing cyber threat intelligence. 51 51
And we need both of these. 52 52
We need to know our posture 53 53
with security intelligence, but we also have to know 54 54
what can attack us using cyber threat intelligence. 55 55
Now, when we look at cyber threat intelligence, 56 56
it really does come to us in two forms. 57 57
It can come in the form 58 58
of a narrative report or a data feed. 59 59
Now, when we're dealing with a narrative report, 60 60
this is going to give us the analysis 61 61
of a certain adversary group or a certain type of malware, 62 62
and we're going to get a written report based on that. 63 63
There are a lot of places you can buy these from, 64 64
and these come in a format that is really manually created 65 65
by some threat analyst. 66 66
And so if you get a job as an intelligence analyst 67 67
or a threat analyst, you may spend all day going 68 68
through different packet captures, 69 69
and going through honeypots, 70 70
and learning about some kind of adversary 71 71
or malware, and then writing a report on it. 72 72
And these reports are then sold to all the different SOCs 73 73
around the world who use that in their defense 74 74
of their networks. 75 75
Now, this is very useful at a strategic level. 76 76
This gives you intelligence about what the bad guys 77 77
are doing, and that can help us decide 78 78
where we want to put money 79 79
and which security controls we want to have 80 80
to be able able to defend ourself 81 81
from these bad guys and their types of attacks. 82 82
Now, on the other hand, we also have data feeds. 83 83
And data feeds can be a list of known bad indicators, 84 84
things like indicators of compromises, domain names, 85 85
IP addresses, it might be something 86 86
like hashes of exploit malware code. 87 87
All of these type of things are tactical level information. 88 88
This gives us something that is very operational. 89 89
It's something we can do something with. 90 90
If you tell me that this IP address is a known bad IP, 91 91
I can block it in my firewall 92 92
so no connections can go to it, right? 93 93
That's the idea with a data feed. 94 94
Now, which one is better? 95 95
Do we want data feeds or narrative reports? 96 96
Well, we want both. 97 97
We don't want to use just one or the other. 98 98
We have to use both to get the best security 99 99
for our networks. 100 100
We're going to use those narrative reports 101 101
to get the big picture of what the landscape looks like 102 102
and then we're going to use the data feeds 103 103
to get those specific tactical things 104 104
that we can program our sensors 105 105
and our defenses against to be able to protect ourselves. 106 106
Now, the combination of both of these is very useful to us 107 107
and it allows us to have a better security posture 108 108
for our organization. 109 109
Now, if you want to be able to sign up 110 110
for some of these data feeds or these narrative reports, 111 111
your organization can do that. 112 112
And most of this is done 113 113
as a monthly subscription or a yearly subscription. 114 114
There are a lot of companies out there that do this, 115 115
like McAfee, FireEye, Red Canary, and many, many other ones. 116 116
For example, if you want to learn more 117 117
about a specific adversary or a certain tactic, 118 118
you could search for that on Google 119 119
or use your subscription to one of these services. 120 120
In one of my previous organizations, 121 121
we had a subscription to FireEye service. 122 122
And so if I wanted to learn more about APT28, 123 123
which happens to be a group of Russian hackers, 124 124
I could learn more about them and the techniques they use. 125 125
And in that report, 126 126
it tells me what type of targets they're going after. 127 127
Are they going after military or commercial targets? 128 128
Are they going after the banking sector 129 129
or the film industry? 130 130
And then we can see how that affects me 131 131
and my industry and how we can better defend against it. 132 132
If you want to see an example of one of these reports, 133 133
if you go to Google and type in APT28 FireEye PDF, 134 134
this report will come up 135 135
and you can see what these look like. 136 136
They're generally around 20 to 30 pages 137 137
and they give you a lot 138 138
of great information about a particular adversary group 139 139
or a specific malware type.