In this lesson, we're going to discuss
Threat Intelligence Feeds.
Now, as we move through this lesson,
we're going to cover some basic concepts in the world
of Threat Intelligence and where we can gather
Threat Intelligence from
by using Open-Source Intelligence Feeds, Proprietary
or Third-Party Feeds,
Feeds from information sharing organizations
and information that we gather from the dark web.
Now, before we do that though, let's take a moment to define
what Threat Intelligence actually is.
Threat intelligence is a continual process used
to understand the threats faced by an organization.
Depending on your organization's business
and its missions, you're going to be facing
different kinds of threats.
So it's important to understand your own business
and the threat environment that it's going to be focused on.
For example, if you work in a nuclear power plant,
you're facing different threats
and attacks than somebody who works at a high school might.
By understanding your own organization
and then looking at the different threats
that are out there, you can better identify which threats
are more likely to affect you and therefore prepare yourself
to defend against those threats.
Now, Threat Intelligence is focused on analyzing
evidence-based knowledge about an existing
or emerging hazard to our asset.
Threat intelligence is going to combine data from a large
number of sources to provide us with the context,
mechanisms, indicators, implications,
and actionable information about a given threat.
Threat intelligence has become a big business as well
with companies like FireEye, providing subscription services
to help keep cybersecurity professionals up to date
on the latest attacks, vulnerabilities, threats,
mitigations against zero day attacks and much more.
Now, information technology changes quickly,
and so it's important that we understand that the types
of attacks that we're going to observe
are also going to change quickly too.
Back in the old days, threat actors focused their attacks
on server side attacks
because servers always had at least some ports and protocols
open by default.
After all, their job as a server is to have open services
that can be utilized by authorized clients,
but as administrators have done a better job
of protecting those servers, threat actors have moved on
to easier targets, which in this case is the clients.
Now client side attacks focus on targeting vulnerabilities
in the client applications.
Threat actors have found that many clients
are not well secured
because users don't maintain a hardened device
configuration, or they simply don't perform the proper
patching and updates when needed.
Also, users often install additional software
in their clients, which also opens up
additional vulnerabilities
that could be exploited by a threat actor.
Now on our enterprise networks,
we can implement things like network access control
or NAC to help scan client computers
before we allow them to connect to our network.
This can help minimize our risk
of spreading infections across our other clients
that are also connected to our network
because we're keeping those clients out
that haven't already passed our security test.
Because of this, a lot of clients
are becoming much more secure
because NAC can place them into isolation
until they're updated and properly configured,
and then give them access to the network.
But again, threat actors have been pivoting their attack
methods as our clients have become more secure.
Now, as users have begun moving more and more
into a mobile environment simultaneously,
the amount of malware for those devices like iOS
and Android devices have also risen in turn.
To help mitigate this new threat,
enterprises are using mobile device management
and mobile application management software
to better control the configurations
and use of their organization's mobile devices.
Also, threat actors have noticed a large move
by organizations into the cloud
and the widespread adoption of virtualization.
Because of this, many of the newest attacks
are being developed around exploiting
these technologies too.
So now that we have a better understanding
of Threat Intelligence, let's talk about
Threat Intelligence Feed.
Now, a Threat Intelligence Feed
is a continuous stream of data related to the potential
or current threats that an organization's security
might be facing.
Threat intelligence data is collected, analyzed,
and disseminated by security researchers, organizations,
or automated tools, and it's then used to provide realtime
or near realtime updates on various aspects
such as new malware signatures,
indicators of compromise, malicious IP addresses,
URLs, and much more.
There are many different kinds of feeds that can be used
by an organization, so they can stay abreast
of the latest security threats,
and that way they can proactively
enhance their security posture.
This Threat Intelligence can be received from various
sources, including Open-source Intelligence,
Proprietary or Third-Party Feeds,
Information-sharing Organizations, and the Dark Web.
So let's take a quick look at each of these four sources
of Threat Intelligence that we can be using
inside of our organization.
First, we have Open-Source Intelligence.
Now, Open-Source Intelligence, also known as OSINT,
is the intelligence that's being collected from publicly
available sources, including reports, forums, news articles,
blogs and social media posts.
Open-Source Intelligence feed can be a great source
of information, and they're usually available
at no cost to you.
Some popular Open-Source Intelligence feeds include
those provided by AlienVault Open Threat Exchange,
the SANS Internet Storm Center, and various forms
and blogs where security researchers share any new findings
that they've identified out in the wild.
By utilizing Open-Source Intelligence,
organizations can gain insights into the emerging threats
and vulnerabilities without having to invest heavily
in proprietary solutions.
Now, this brings us to our second option,
which is a Proprietary or Third-Party Feed.
Now Proprietary or Third-Party Feeds
are Threat Intelligence feeds that are being provided
by commercial vendors,
usually under a subscription service type of business model.
These proprietary feeds often offer more refined, analyzed,
and timely information than what you might find
in an Open-Source Intelligence Feed.
Some of the best known companies
that provide proprietary Threat Intelligence Feeds
are FireEye, McAfee, and Symantec.
Each of these companies allows their feeds
to be integrated into security information
and event management tools and other security tools
to provide our cybersecurity analysts
with actionable insights
and an automated threat response capability.
Third, we have information sharing organizations.
There are information sharing organizations
and alliances that have been formed
to share Threat Intelligence among their members.
For example, the information sharing and analysis centers
and the information sharing and analysis organizations
were created to foster collaboration
among businesses in similar industries
and sectors like all the companies working in finance
or healthcare or energy, to allow them to share
and receive information about the threats
and vulnerabilities that are specific
to their particular industries.
By joining an information sharing organization,
your business will learn from the collective experience
and insights of a community
that understands their unique challenges and threats,
and you'll also give your data into that collective
so they can learn from you too.
Fourth and finally, we have the dark web.
Now, the dark web is a part of the Internet
that is intentionally hidden
and inaccessible through standard web browsers.
While the dark web is most often associated
with illegal activities, it can also be a great source
of Threat Intelligence for security researchers.
Now, security researchers
and organizations will sometimes explore the dark web forums
and marketplaces to try
and uncover the information about new hacking techniques
and tools, stolen data and emerging threats
that are existing there on the dark web.
By understanding what is happening in the dark web,
your organization's security researchers will have a better
heads up on potential threats
before they become public knowledge too.
So as you can see,
Threat Intelligence Feeds are an essential tool
in a cybersecurity professionals toolkit.
By gathering information from various sources,
you can ensure that you remain up to date
on the latest threats and are well prepared
to defend your organization against those threats.
Regardless of whether you're relying on open source feeds,
subscribing to third party proprietary intelligence feeds,
participating in information sharing organizations
or exploring the dark web,
staying informed is going to be the key
to maintaining a stronger organizational security posture.
Since the threat landscape
and cybersecurity is always evolving
and changing, we have to remain up to date
and proactive by leveraging Threat Intelligence Feeds
so that we can stay ahead of the new threats
and we can avoid falling victim to them in the future.