cti: cyber threat intelligence - oasis...2016/11/02 · • cyber threat intelligence in its real...

10

Ryusuke Masuoka Fujitsu System Integration Laboratories, Ltd. November 2016 CTI: Cyber Threat Intelligence - Enabling Predictive Defense by Reading Attackers’ Intent Copyright 2016 FUJITSU LIMITED

Upload: others

Post on 04-Jun-2020

3 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: CTI: Cyber Threat Intelligence - OASIS...2016/11/02 · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

Ryusuke Masuoka Fujitsu System Integration Laboratories, Ltd. November 2016

CTI: Cyber Threat Intelligence - Enabling Predictive Defense by Reading Attackers’ Intent

Copyright 2016 FUJITSU LIMITED

Page 2: CTI: Cyber Threat Intelligence - OASIS...2016/11/02 · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

Page 3: CTI: Cyber Threat Intelligence - OASIS...2016/11/02 · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

Page 4: CTI: Cyber Threat Intelligence - OASIS...2016/11/02 · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

Copyright 2016 FUJITSU LIMITED

https://en.wikipedia.org/wiki/Euthalia_aconthea

Page 5: CTI: Cyber Threat Intelligence - OASIS...2016/11/02 · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

Cyber Threat Intelligence (CTI)

Copyright 2016 FUJITSU LIMITED

Definition: Product of collecting, processing, integrating, analyzing, evaluating, interpreting data and information

Two Elements of Cyber Threat Intelligence (CTI) • Data/Information like IP addresses and malware hash values: CTI Level 1 (L1) – Observables • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI

5Ws1H of Cyber Attacks Lets you determine who the adversary is what their purpose is how serious it is

12

Page 6: CTI: Cyber Threat Intelligence - OASIS...2016/11/02 · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

C&C IP Address Malware Hash

TTP - Tactics, Techniques, Procedures

Watering Hole Phishing Email CVE2014-6324

Two Elements: CTI L1 and L2

Copyright 2016 FUJITSU LIMITED

New Indicators What

Who

Why

Where

How

Attack from Attacker’s Point of View

Target Region, Industry, Organization

Observables CTI L1 (Observables)

CTI L2 (Contextual CTI) Links between observables and information pieces

5

Page 7: CTI: Cyber Threat Intelligence - OASIS...2016/11/02 · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

CTI Analysis

Mitigation

Artifact

Analysis

Machine Learning

CTIM: CTI-Driven Platform for Proactive Defense

Copyright 2016 FUJITSU LIMITED

Analysis Environment Malware Analysis Memory Analysis Log Analysis Disk Forensics Attack Campaign Analysis

IDS/IPS

Sandbox

AntiVirus Servers

PCs

Logs

Firewall

Proxy

SIEM Incident Tracking Alerts

CTI Distribution → Detection → Block

(SOC) • Operator • 1st Tier Analyst

Senior Analyst (SIC)

Monitoring Incident Management

Triage Artifacts (Memory, Log, Disks, Malware, etc.)

CTI Registration Evaluation

Manual Artifact Analysis

CTI Matching

Escalation

Decoy System

Obs

erva

tion

Atta

ck L

og

Disconnecting from Network, Shutting down, Locking Accounts, etc.

External Network Analysis

C2 Analysis Services OSINT

CTI Store

Automation Engine

CTI Sharing CTI Gateway CTI

Sources Communities

Detection Analysis Response Artifacts Information

Web News, Blogs, SNS Security Reports Vulnerability information Communities

Information Collection

ICT Environment

Alert/Ticket Registration

Artifact Store

Art

ifact

s In

form

atio

n 6

Page 8: CTI: Cyber Threat Intelligence - OASIS...2016/11/02 · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

Sample Similarity Scoring System

Sharing Policy Enforcement

Automation Engine CTIM: CTI-Driven Platform for Proactive Defense

OASIS CTI Standardization

Bi-Directional CTI Sharing

CTI Graph Analytics and Editing

Private Translator

Page 9: CTI: Cyber Threat Intelligence - OASIS...2016/11/02 · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

Pushing the Boundaries – Phased Adoption Unlock the true potential of structured contextual CTI Phase 1 - Accumulate CTI in STIX Phase 2 + Consume External CTI Phase 3 + Share Observables/Indicators Phase 4 + Share Technical Context Phase 5 + Sharing Adversarial Context

8 Copyright 2016 FUJITSU LIMITED

Adversarial Context

Technical Context

Indicators Observables

Page 10: CTI: Cyber Threat Intelligence - OASIS...2016/11/02 · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

Copyright 2016 FUJITSU LIMITED

Wittaya Janmayka 8 December 2016 - Enterprise IT Pro Cyber Threat... · 2016 Cyber Threat Observations. Cyber Threat Predictions Tipping Point For Cybersecurity in 2017 . 4 Cyber

Cyber threat intelligence report cyber 5.pdfdata and technology such as threat intelligence feeds or intelligence platforms. CTI must be integrated into security and business processes,

LookingGlass Cyber | Cybersecurity & Threat Intelligence€¦ · CYBER SOLUTIONS LookingGlass Cyber Solutions delivers unified threat protection against sophisticated cyber attacks

Cyber Threat Intelligence

CYBER THREAT BULLETIN

Cyber Threat Landscape

Cyber Security Conference - Rethinking cyber-threat

Compendium on Cyber Security of Election Technology · 2018. 7. 24. · Cyber Threat Intelligence (CTI) is based on the collection of intelligence on cyber security from various sources

Introducing Cyber Threat Monitoring - StarHub€¦ · Introducing Cyber Threat Monitoring A unique, telco-centric cyber defence solution for enterprise Cyber Threat Monitoring (CTM)

CTI Capability Maturity Model | Marco Lourenco 1 · European Union Agency for Network and Information Security CTI Capability Maturity Model Cyber Threat Intelligence Course NIS Summer

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

Overview Cyber Threat Intelligence Training Series · Cyber Threat Intelligence (CTI) Training Series is a 5-days training, which is divided into ... The Diamond Model ... into log

Cyber Threat Metrics

CYBER THREAT ASSESSMENT

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

The Business Use Case for Cyber Threat Intelligence (CTI) 201… · Attach risk scores to threat indicators, ... alerts as high priority • Allow SIEM or analyst to query the threat

2021 SANS Cyber Threat Intelligence (CTI) Survey

Le service de Cyber Threat Intelligence du Cert-IST · Computer Emergency Response Team Industrie Services & Tertiaire Forum 2016 page 2 Sommaire 1. La Cyber Threat Intelligence (CTI)

THREAT MANAGEMENT AND OUR TECHNICAL LEARNINGS IMPLEMENTING CTI · PDF fileTHREAT MANAGEMENT AND OUR TECHNICAL LEARNINGS IMPLEMENTING CTI ... threat indicators and intel ... correlate,

Compendium on Cyber Security of Election Technologyec.europa.eu/information_society/newsroom/image/document/... · 2018-07-24 · Cyber Threat Intelligence (CTI) is based on the collection

The Evolution of Cyber Threat Intelligence (CTI): 2019 ...wow.intsights.com/rs/071-ZWD-900/images/The Evolution of Cyber Threat... · SANS Analyst Program | The Evolution of Cyber

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

Cyber threat intelligence - afcea.org · By infusing CTI during the threat categorization phase of threat modeling, ... work assignment, business travel, or other external environmental

Cyber, Physical or Insider Threat? - ASIS Europe 2018 · Cyber, Physical or Insider Threat? ... navigating a complex risk landscape? physical threat cyber threat insider threat

HEALTH CARE AND PUBLIC HEALTH CYBER THREAT … · In an effort to determine the needs for cybersecurity threat information (CTI) sharing in the Healthcare and Public Healthcaresector

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

TOWARDS A MATURE CTI PRACTICE - OASISTowards a Mature CTI Practice – Borderless Cyber. threat indicators monitor (SIEM, IDS) block (firewall, ACL) hunt (data lake) production of

Cyber Threat Intelligence Training Series · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series is a 5-days

National Cyber Security Centre Unclassified Cyber Threat ... · National Cyber Security Centre Unclassified Cyber Threat ... It also produces threat prevention and ... can however

Cyber Threat Framework (Version 4) Translating Cyber into ...€¦ · Cyber Threat Framework (CTF) Overview The Cyber Threat Framework was developed by the US Government to enable