Lecturer: Intelligence Sources. 2 2
Now, in addition to having our five phases of the lifecycle, 3 3
we have to dive a little bit deeper 4 4
into one particular phase: 5 5
The collection and processing phase. 6 6
This is important because we have to consider 7 7
the sources of our intelligence. 8 8
Now, there are lots of different sources 9 9
to our intelligence that we can get out there, 10 10
but not all are created equal. 11 11
And so we have to be able to identify some factors 12 12
to weigh the value of the intelligence that we're getting. 13 13
Now, there are several factors that we can use. 14 14
There is timeliness, relevancy, accuracy, 15 15
and confidence level. 16 16
When we talk about timeliness, 17 17
this is the property of an intelligence source 18 18
that ensures that it is up-to-date, because over time, 19 19
the information is not nearly as valuable. 20 20
If I know that somebody has been attacking 21 21
your network today and I don't tell you about it 22 22
for three years, it's not going to be very useful to you. 23 23
It'd be a lot more useful if I told you today. 24 24
And so that's the idea with timeliness, 25 25
because once an adversary understands 26 26
they've been identified, they're going to change tactics 27 27
and they're going to change the way they do things. 28 28
And that means your report that you wrote today 29 29
may not be valid in a week, three weeks, three months, 30 30
or three years from now because things change, 31 31
and so timeliness is important. 32 32
Our second factor is relevancy. 33 33
Now, this is the property of an intelligence source 34 34
that ensures it matches the use case it was intended for. 35 35
Let's go back to my example of working 36 36
for a large auto manufacturer. 37 37
If I start seeing that there's a lot of attacks 38 38
going against the Mac OS X operating system, 39 39
does that really apply to me as somebody 40 40
who is running a car company and is using Windows machines 41 41
or is using Linux in my embedded systems? 42 42
Probably not. 43 43
And so it's not nearly relevant to me 44 44
for the use case I have. 45 45
And so you need to consider that as you're looking 46 46
at all the different information out there 47 47
because it can be overwhelming. 48 48
And you have to think what affects me and my organization 49 49
so I can defend against it. 50 50
The third area is accuracy. 51 51
Now accuracy is the property of an intelligence source 52 52
that ensures that it produces effective results. 53 53
Now, this means that the information needs 54 54
to be valid and true. 55 55
If you tell me that I've been attacked 56 56
and I look and I can't find anything, 57 57
well, was I really attacked, or was your information bad? 58 58
We really don't know. 59 59
And so it's really important to make sure 60 60
the information we're getting is accurate. 61 61
This means we want to try to eliminate 62 62
as many false positives as possible, 63 63
especially when using automated software 64 64
and machine learning and artificial intelligence, 65 65
and make sure that we're getting the right information 66 66
so that we can do our analysis properly 67 67
on good information and create good decisions. 68 68
The fourth and final factor we have to consider 69 69
is confidence levels. 70 70
Now, this is the property of an intelligence source 71 71
that ensures it produces qualified statements 72 72
about reliability. 73 73
When an analyst publishes report, 74 74
they don't have a hundred percent of the facts. 75 75
It's just the way this works. 76 76
We're trying to guess our way through this 77 77
and we're getting lots of different pieces 78 78
of information and lots of different indicators 79 79
and we try to put together the best report we can. 80 80
Well, when we deal with this 81 81
and we start taking all these sources, 82 82
we have to look at these sources and figure out: 83 83
Are they reliable? 84 84
Are they accurate? 85 85
Are they relevant and are they timely? 86 86
And we start talking about confidence level. 87 87
We're going to actually put a grade on it 88 88
of how good we think that information is. 89 89
For example, the MISP Project codifies the use 90 90
of the admiralty scale 91 91
for grading data and estimative language. 92 92
Now, you can choose any scale you want, 93 93
but the admiralty scale is one of the more common ones. 94 94
The way this works is that it breaks it down into two areas. 95 95
It evaluates you based on source reliability 96 96
and information content. 97 97
If I look at the source reliability, 98 98
this is going to get a letter grade from A through F. 99 99
It tells you if it's reliable all the way down 100 100
to I can't judge the reliability. 101 101
For example, if I got this piece of data 102 102
from my own sensors and I trust them 103 103
and there's no doubt this is reliable, 104 104
give it a grade of A. 105 105
Next we have the information content, 106 106
and when we grade this, we do it on a scale of 1 to 6. 107 107
Now, when we grade this from 1 to 6, 108 108
we're going to say that this could be confirmed 109 109
or it cannot be judged. 110 110
When I confirmed it, 111 111
this means that I had multiple independent sources 112 112
that told me this information. 113 113
It's not just hearsay from one person. 114 114
Now, as I go down the scale, 115 115
I get less and less stringent 116 116
on how well I can confirm that information 117 117
all the way down to cannot be judged, 118 118
which means it's basically just a best guess. 119 119
Now, this is useful, especially when reporting 120 120
up to higher authorities or up to your bosses. 121 121
Because you can say, "Hey, I have this information. 122 122
I heard there's this threat, 123 123
but I'm not real confident about it. 124 124
It only has a grade letter of C." 125 125
And you going to take less actions against that 126 126
maybe than something that has a strength of A, 127 127
because A is much more certain. 128 128
And this is the idea when you deal 129 129
with the admiralty scale. 130 130
For the exam, you do not need to know the admiralty scale 131 131
in depth, but it is something I wanted to make you aware of 132 132
because you may see it out in the workplace. 133 133
Now, the next thing we need to talk about 134 134
is the three places you can get information from. 135 135
You can find information that's proprietary, closed-source, 136 136
or open-source. 137 137
The first source we have is what's known as proprietary. 138 138
Proprietary is threat intelligence 139 139
that comes as a commercial service offering, 140 140
where you're going to pay for access to these updates 141 141
and research based on a subscription fee. 142 142
Now, some of these commercial services are really 143 143
just repackaging information that's available 144 144
in free public registries without providing 145 145
of any of their own data inside of it, 146 146
and these aren't nearly as useful. 147 147
This brings us to the second type 148 148
which is closed-source data. 149 149
Now, closed-source data is data that's derived 150 150
from the provider's own research and analysis efforts, 151 151
such as data from honeynets as they operate, 152 152
plus information that's mined 153 153
from their other customer systems and suitably anonymized. 154 154
So for example, if you and a hundred thousand other people 155 155
all subscribe to a certain service 156 156
and they're monitoring your networks, 157 157
they can collect all that data 158 158
from the 100,000 users 159 159
and then be able to make analysis 160 160
and reports based off of that in an anonymized fashion 161 161
back to those 100,000 users 162 162
so you all can share the information. 163 163
Now, a good example of this is Mandiant. 164 164
Mandiant is a proprietary information source 165 165
that is closed-source. 166 166
They provide their own data, and you can subscribe using 167 167
their threat intelligence subscription service 168 168
to get data and updates from them. 169 169
Now, the third type we have is what's known as open-source. 170 170
Open sources data that's available for use 171 171
without a subscription, 172 172
and this may include threat feeds similar 173 173
to commercial providers, and it can contain reputation list 174 174
and malware signature databases too. 175 175
There are a lot of great sources 176 176
of open-source intelligence out there. 177 177
And so if your organization is a little weary 178 178
about spending a lot of money 179 179
on commercial source information, 180 180
they can start out with open-source information 181 181
and then upgrade from there later on. 182 182
Now, when you talk about open-source intelligence, 183 183
there are lots of different sources. 184 184
First, we have the US-CERT, which is the United States 185 185
Computer Emergency Readiness Team. 186 186
This provides you with feeds of current activity 187 187
and alert news, plus regular bulletins and analysis reports. 188 188
They also have a bidirectional threat feed 189 189
called the Automated Indicator Service that you can use. 190 190
The next one we have 191 191
is the UK's National Cyber Security Centre, 192 192
which provides similar services to the US-CERT. 193 193
There are some other ones out there as well, though. 194 194
We have AT&T Security, which was actually 195 195
AlienVault Open Threat Exchange previously, 196 196
but was bought out by AT&T. 197 197
After that, we have MISP, which we talked about before. 198 198
This is the Malware Information Sharing Project. 199 199
And again, it's an open-source intelligence feed 200 200
that you can use. 201 201
We also have VirusTotal, which is a great place 202 202
to upload any file you're not sure of. 203 203
If you upload this file, 204 204
it will check across 40 to 50 different antivirus products 205 205
to see if any of them know if it's a virus or not, 206 206
and it's a public repository for malware. 207 207
Another one we have is Spamhaus, 208 208
which is very focused on spam and email. 209 209
And finally, we have SANS ISC Suspicious Domains, 210 210
which, as the name implies, is focused on providing a feed 211 211
of suspicious domains that they think might be malicious. 212 212
Now, all of these feeds are really great 213 213
and they provide you with what's known 214 214
as explicit knowledge, 215 215
which is knowledge you can write down, see, feel, and touch. 216 216
But, there's another great source of knowledge out there too 217 217
and it's known as implicit knowledge. 218 218
Implicit knowledge is really useful, but you can only get it 219 219
from experienced practitioners in the field. 220 220
This is kind of that sense that they have, 221 221
that they just go, "Ah, I know something is wrong here 222 222
because of my 20 years of experience." 223 223
Now, they may not always have the latest trends 224 224
in cybersecurity, although most of the time they do, 225 225
but they also have the ability to give you that attitude 226 226
and instinct because of their career 227 227
as a cybersecurity professional. 228 228
Overtime, you're going to develop this 229 229
as you become a senior cybersecurity analyst, 230 230
where you just know this is wrong 231 231
because you've seen it a hundred times before 232 232
and you start getting this feeling 233 233
of what is going to come next based on your experience. 234 234
And that is something that we call implicit knowledge, 235 235
because you can't write it down, 236 236
you can't codify it in a procedure. 237 237
It's just something you know 238 238
based on your years of experience. 239 239
Now, the last thing I want to mention here 240 240
is what's known as OSINT. 241 241
Now, open-source intelligence or OSINT 242 242
is a very popular thing these days. 243 243
This is a method of obtaining information 244 244
about a person or organization 245 245
through public records, websites, and social media. 246 246
We're going to talk about this later on 247 247
as we talk about pen testing and other parts of the course. 248 248
But as you go out and you look at your organization 249 249
from the outside looking in, 250 250
anything people can find out about you on Google, 251 251
on Facebook, by doing enumeration scans, 252 252
that is all considered OSINT. 253 253
It's ways for you to get information from public records, 254 254
websites, and social media. 255 255
So we'll talk more about that later on, 256 256
but I just wanted to introduce that concept now 257 257
because it is a form of open-source intelligence 258 258
that a lot of people consider.