Instructor: The security intelligence cycle. 2 2
Now, intelligence is a process. 3 3
It's not just about collecting data 4 4
but you have to collect that data, 5 5
you have to plan to collect that data 6 6
and you have to go through and process that data 7 7
and get it through. 8 8
So, when you look at the process, it's going to start out 9 9
with requirements, planning and direction. 10 10
This is where we're going to be focused 11 11
on what do we want to collect 12 12
and figure out how we can best do that. 13 13
Then we move into our second phase 14 14
which is collection and processing. 15 15
Now that we know what we want to collect, 16 16
we have to go about actually collecting it. 17 17
Third, we need to move into analysis 18 18
where we start taking all that data we got 19 19
and we start looking through it to try to make 20 20
some decisions based on it. 21 21
And then we move into our fourth phase, 22 22
which is dissemination. 23 23
This is how we take that information that we've analyzed 24 24
and present it to other people. 25 25
And then we move into our fifth phase, which is feedback. 26 26
This is how we look back through the cycle, 27 27
see what went right, what went wrong 28 28
and what we could do better 29 29
and then we started all over again. 30 30
Let's take a little bit more in-depth look 31 31
at each of these five phases 32 32
as we move through the security intelligence cycle. 33 33
First, we want to talk about the requirements phase. 34 34
Now requirements is also planning and direction. 35 35
The requirements phase is going to set out the goals 36 36
for the intelligence gathering effort. 37 37
At this point, we need to figure out what is it 38 38
that we want to collect. 39 39
That way we can figure out what are the things 40 40
we care about? 41 41
What do we want to spend the time, money 42 42
and resources to gather? 43 43
This is really important to have your goals set 44 44
because if you don't understand what your goals are 45 45
and you don't understand what your use case is 46 46
for this data, you're going to be spending 47 47
a lot of time and a lot of money collecting a lot of data 48 48
for no reason at all. 49 49
For example, if I worked for an auto manufacturer like Tesla 50 50
or Honda or Ford, I would probably want to make sure 51 51
that we are gathering intelligence 52 52
on any threats to automobile systems. 53 53
Especially if you're somebody like Tesla 54 54
that is trying to work towards self-driving cars, 55 55
there's a big cyber threat component to that. 56 56
And so we'd want to be looking out there 57 57
at the entire landscape to figure out what adversaries 58 58
are out there, what APTs are out there 59 59
and what type of malware and vulnerabilities are out there 60 60
for our type of systems that could affect the safety 61 61
of our systems. 62 62
Consequently, we might also look at any kind of things 63 63
that would affect our supply chain. 64 64
We have to buy those computers from somewhere, right? 65 65
And so we need to make sure we understand what 66 66
threats exist there and how we can mitigate those risks. 67 67
There's a lot of information out there 68 68
and what the idea here in requirements gathering 69 69
the planning and direction is figuring out what are 70 70
the things we want to measure? 71 71
That's what we have to deal with here. 72 72
Now, another thing we have to think 73 73
about here is thinking about any kind of special factors 74 74
or constraints we might have. 75 75
For example, if you work for the government, 76 76
there are certain things you can and cannot collect 77 77
on your citizens depending on what government 78 78
you are in the world. 79 79
For example, I'm in the United States. 80 80
The US has a policy that they cannot collect 81 81
information on US citizens. 82 82
So if you work for the NSA or the CIA, 83 83
they are not allowed to collect information on me 84 84
as a US citizen. 85 85
No matter if I'm sitting in the United States 86 86
or if I'm sitting abroad, if I'm a US citizen, 87 87
they can't collect on me. 88 88
That's part of the rules. 89 89
And so there are legal restrictions on what they can 90 90
and cannot do. 91 91
For instance, if they wanted to collect information on me, 92 92
they would have to go and get a warrant to do 93 93
that because as a US citizen, I am protected by 94 94
the fourth amendment against unlawful search and seizure. 95 95
Every country has different rules, 96 96
every location has different rules. 97 97
So your organization is going to have to consider that 98 98
as you're planning what your collection process is going to be. 99 99
So now that we've considered all of that 100 100
and we've figured out what we want a plan to do, 101 101
we now need to actually move into collection. 102 102
And the second phase is collection and processing. 103 103
The collection process is implemented by software tools 104 104
such as SIEMS and then it's processed for later analysis. 105 105
Now, when we collect things, 106 106
this is where we're gathering all the data. 107 107
So if I put a network sensor out there 108 108
that's collecting PCAP data, packet capture data, 109 109
it can collect all that information 110 110
and send it back to a centralized server. 111 111
I may collect logs from a router 112 112
from an intrusion detection system, 113 113
from a firewall, from servers, from endpoints. 114 114
All that data has to be collected and then sent someplace. 115 115
Generally, we'll put this into a SIEM 116 116
which is a security information and event management system 117 117
and then we can use that as our center point 118 118
of all the collection. 119 119
Now, the one challenge we have though is that all this data 120 120
is coming from different systems, right? 121 121
Well, when all this stuff is coming from different systems, 122 122
it might come in a different format. 123 123
So we need to normalize that data 124 124
and that is the processing part. 125 125
This is where we'll convert all the data 126 126
into a standard format that a single solution 127 127
like a single SIEM can actually use. 128 128
This means all the source IP addresses will be 129 129
in a certain column 130 130
all the destinations will be in another column, 131 131
all the timestamps will be in a third column. 132 132
And this way we can search and index all this information 133 133
and use it as we search for those things later on 134 134
in our analysis cycle. 135 135
Now, another consideration you have to think about is 136 136
how are you going to keep all this data secure? 137 137
So we just took all this data from across our network 138 138
and all of our sensors and put it in the SIEM. 139 139
Well, we need to make sure we protect that SIEM too. 140 140
And so we might be using things like encryption on the SIEM, 141 141
we might be using things like access control in the SIEM 142 142
and we might be using things for integrity like hashing 143 143
on the SIEM. 144 144
All that data needs to be protected as well, because 145 145
if it's useful to us, it could also be useful to an attack. 146 146
The third step we're going to have is going into 147 147
the analysis process. 148 148
Now, the analysis phase is performed 149 149
against the giving use cases that we had 150 150
from our planning phase 151 151
and we can utilize things like automated analysis, 152 152
artificial intelligence, and machine learning. 153 153
Now, this is really important 154 154
because there is so much data that we are collecting 155 155
at this point that a single person cannot read it 156 156
and analyze it fast enough. 157 157
So we have to use some sort of way to automate this. 158 158
So these days one of the most common ways of attacking this 159 159
problem is by separating our data first into three buckets. 160 160
First, what do we know is good? 161 161
Second, what do we know is bad? 162 162
And third, what we're really concerned with 163 163
is what we're not sure of because again, 164 164
if it's known good, we're going to allow it, 165 165
if it's known bad, we're going to block it, 166 166
if we're not sure, that's where further analysis 167 167
needs to be done. 168 168
Now, because of there's so much data at this point, 169 169
we have to use things like machine learning 170 170
and artificial intelligence to help our humans 171 171
go through this data data because there is just 172 172
so much stuff going over our networks. 173 173
This allows us, again, because of our processing, 174 174
we've normalized it, 175 175
and now in our analysis, we can filter it, 176 176
we can organize it into a useful form 177 177
and we can start doing our analysis on it. 178 178
Now, all of the analysis we do should be done 179 179
in the context of a use case. 180 180
And these use cases are something that we developed 181 181
all the way back in our planning phase. 182 182
This says, I'm interested in this type of information 183 183
for this reason 184 184
because there might be some interesting information 185 185
but if it doesn't impact business decisions 186 186
for you and your organization, why do you even care? 187 187
And that's the idea here. 188 188
Our job here is to go through these large data sets 189 189
and we want to start figuring out what doesn't look right, 190 190
what looks funky, what is not going to be good 191 191
for our organization 192 192
and we want to start building our models against that. 193 193
For example, if I start looking through the domain 194 194
authentications that are occurring in your organization, 195 195
and I know what good looks like 196 196
and I know what bad looks like, 197 197
there may be some things there that are suspect 198 198
and it may be the indication of an insider threat. 199 199
And so if I'm looking at that 200 200
through the lens of an insider threat use case, 201 201
that will help me do my analysis better 202 202
and use the right filters and query strings 203 203
to extract the relevant data that I need. 204 204
Now, the fourth phase is dissemination. 205 205
And the dissemination phase refers to publishing 206 206
the information produced by an analyst to a consumer 207 207
who needs to act on the insights developed. 208 208
Now, this can take a lot of different forms, and it depends 209 209
on your organization and what the intended audience is. 210 210
You may have oral reports, you may have written reports, 211 211
you may have a PowerPoint presentation, 212 212
you may have an email. 213 213
It really does depend on your organization. 214 214
Now, three of the most common ways we'd like to break 215 215
up this dissemination is into the level of intelligence. 216 216
It can be strategic, operational, or tactical. 217 217
When strategic intelligence, 218 218
this is going to address broad themes and objectives 219 219
and these usually affect projects 220 220
and business priorities over weeks, months, and years. 221 221
Most often I see this done as a report to an executive 222 222
or a PowerPoint presentation in a large group. 223 223
The second one we have is operational intelligence. 224 224
Now, operational intelligence is going to address 225 225
the day-to-day priorities of managers and specialists. 226 226
Oftentimes, I'll see this put out as a checklist of 227 227
these are the things you should be worried about today 228 228
and these are the things we need to focus on today. 229 229
The third type we have is tactical intelligence. 230 230
And tactical intelligence informs real-time decisions 231 231
made by staff as they encounter different alerts 232 232
and system indications. 233 233
So if you're sitting there on the SOC watch floor 234 234
and you see an alert pop up on your screen 235 235
that is considered tactical intelligence. 236 236
It needs to be dealt with right now, and it is real time. 237 237
Our fifth and final phase of the cycle is feedback 238 238
and review. 239 239
Now, this phase is going to aim to clarify the requirements 240 240
and improve the collection, analysis, and dissemination 241 241
of information by reviewing the current inputs and outputs. 242 242
Basically, how can we do things better? 243 243
That's our goal. 244 244
We always want to improve the implementation 245 245
of our requirements, our collection, our analysis 246 246
and dissemination, and how we can improve over time 247 247
and get better at what we do. 248 248
For example, you might be doing things 249 249
like lessons learned by figuring out what incidents occurred 250 250
during the intelligence gathering this cycle 251 251
so we can avoid those problems next cycle. 252 252
We might want to figure out how we're going to measure success, 253 253
what metrics are going to show us success or failure 254 254
of the intelligence gathering. 255 255
We also want to think about evolving threat issues. 256 256
Maybe we've been looking a lot for phishing 257 257
but now we're seeing that phishing isn't popular. 258 258
Instead, people are going against bring your own devices 259 259
and so we want to start shifting our intelligence collection 260 260
towards that threat vector. 261 261
These are the kind of things you want to think about as 262 262
you move through the intelligence lifecycle. 263 263
So one more time, as a quick review, the five phases 264 264
of the intelligence lifecycle are: 265 265
one, requirements planning and direction, 266 266
two, collection and processing 267 267
three, analysis, four, dissemination, and five, feedback.