Instructor: Threat intelligence sharing. 2 2
Now, in addition to being part of an ISAC, 3 3
if that's part of one of your industries, 4 4
you also need to think about threat intelligence sharing 5 5
within your organization. 6 6
As we start identifying this timely, 7 7
relevant and accurate sources of threat intelligence 8 8
we need to think about how do we make that data actionable? 9 9
And one of the ways we do that 10 10
is by disseminating this information 11 11
to different people within our organization, 12 12
or even outside our organization. 13 13
That's the idea that we're going to talk about in this lesson. 14 14
We're going to talk about 15 15
how we can use this through risk management 16 16
and security engineering, incident response, 17 17
vulnerability management and detection and monitoring. 18 18
First, risk management. 19 19
What is risk management? 20 20
Well, risk management is the process of identifying, 21 21
evaluating and prioritizing different threats 22 22
and vulnerabilities 23 23
in order for us to reduce their negative impact. 24 24
Now, the reason that threat intelligence 25 25
is important to risk management 26 26
is it tells us how risky a certain thing is 27 27
based on outside threats, 28 28
because we know our own vulnerabilities 29 29
through our vulnerability management and our scanning, 30 30
but if we don't know what attackers are coming after us 31 31
we can't really think about the threat. 32 32
And so putting those two together is really important. 33 33
Now, the reason why we put risk management 34 34
and security engineering together 35 35
is because by putting them together 36 36
we can start designing the architecture of the hardware, 37 37
the software, and the network platforms 38 38
to respond to these different threats 39 39
and reduce our attack surface. 40 40
This way we can start figuring out 41 41
what attacks we're vulnerable to 42 42
and what controls we can put in place. 43 43
For instance, 44 44
if we're looking at strategic threat intelligence 45 45
and we start seeing 46 46
that people are going after Linux systems 47 47
more than Mac or Windows systems for instance 48 48
that may mean that if we're running a lot of Linux servers 49 49
we need to make sure we're prepared 50 50
for those additional attacks. 51 51
This is the idea of thinking strategically 52 52
of what changes we can make inside our organization 53 53
for the long term to try to outsmart 54 54
or out-maneuver the different bad actors that are out there. 55 55
Now, the second area we have to use threat intelligence for 56 56
is incident response. 57 57
Incident response is an organized approach 58 58
to addressing and managing 59 59
the aftermath of a cybersecurity breach or attack. 60 60
So if somebody has been successful 61 61
in penetrating our network, 62 62
we need intelligence to help keep them out. 63 63
Now, the best type of intelligence here 64 64
is going to be tactical-level intelligence though, 65 65
because we need to know where they are in our networks, 66 66
what IP address are they coming from, 67 67
what are they doing once they're in our network, 68 68
and all those tactical pieces of threat intelligence 69 69
will help us identify where they are 70 70
and how we can get them out of our network 71 71
and prevent them from coming back. 72 72
Then we can start using those strategic insights 73 73
to prevent them from coming back over and over again 74 74
in the future. 75 75
But right now, we're really focused 76 76
on the tactical threat intelligence 77 77
to get this incident response resolved. 78 78
The third one we have is vulnerability management. 79 79
Now, when we deal with vulnerability management 80 80
this is the practice of identifying, classifying, 81 81
prioritizing, remediating, 82 82
and mitigating software vulnerabilities. 83 83
Now, as we start thinking about vulnerability management 84 84
at a strategic level 85 85
we're going to use our threat intelligence 86 86
to identify unrecognized sources of vulnerabilities 87 87
that we may not have thought of. 88 88
For instance, do we have a WiFi enabled thermostat? 89 89
That's an IoT device, an internet of things 90 90
and that's something we have to consider. 91 91
And many people don't think about that 92 92
inside their organizations. 93 93
What about the concept of deepfakes? 94 94
That is a big issue these days. 95 95
What about AI facilitated fuzzing 96 96
to discover zero day vulnerabilities? 97 97
There are lots of different things out there 98 98
and if we think about them from a strategic level 99 99
we can make sure 100 100
that we're doing a good vulnerability management program 101 101
that addresses those concerns. 102 102
Also, we can be thinking about things 103 103
at a more tactical level, 104 104
like we know that a certain piece of malware 105 105
is now in the market. 106 106
Are we vulnerable to it? 107 107
And so we can do a scan, 108 108
specifically looking for that one thing. 109 109
This is very popular 110 110
once there's a big well-known malware attack 111 111
that goes out there. 112 112
For instance, when WannaCry came out 113 113
that was something you'd want to do a vulnerability management 114 114
of your own network 115 115
and see if you were vulnerable to it 116 116
and what mitigations you could put in place 117 117
before you were attacked. 118 118
And using threat intelligence allows you to do that. 119 119
Finally, we have detection and monitoring. 120 120
This is the practice of observing activity 121 121
to identify anomalous patterns for further analysis. 122 122
Now, as we think about detection and monitoring 123 123
we need to also use threat intelligence here too, 124 124
because as we know what threats are out there 125 125
we can then tune our sensors better. 126 126
This will allow us to add more rules and definitions 127 127
based on different observed incidences 128 128
that have happened either to our organization 129 129
or partner organizations, 130 130
or one of those commercial data feeds 131 131
that we're subscribed to. 132 132
By getting that information, we can tune our sensors better 133 133
and we can have a lot more true positives 134 134
and a lot less false positives. 135 135
So this is why it's a good idea to make sure 136 136
you're on the dissemination chain for threat intelligence 137 137
if you work in detection and monitoring. 138 138
Overall, our goal here is to share our threat intelligence 139 139
within our organization 140 140
so we can improve our organizational capabilities 141 141
and protect ourselves from additional threats.