Upload File

cyber threat intelligence - heanet · cyber threat intelligence (cti) is the analysis of an...

  • Home
  • Documents
  • CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence
23
CYBER THREAT INTELLIGENCE JULIE MURPHY

Upload: others

Post on 12-Jul-2020

13 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

C Y B E R T H R E AT I N T E L L I G E N C EJ U L I E M U R P H Y

Page 2: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

W H AT I S C Y B E R T H R E AT I N T E L L I G E N C E ?

Page 3: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently,

“intelligence is not a data feed or something that comes from a tool” but actionable information that answers a knowledge gap

SANS, 2018

Page 4: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

I N F O R M AT I O N V I N T E L L I G E N C E

Raw Processed

Unevaluated Evaluated And Interpreted

All Sources Reliable Sources

Unknown Data IntegrityComplete, Accurate, Relevant,

Timely

Not Actionable Actionable

Enisa, 2016

Page 5: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

C AT E G O R I S I N G C Y B E R T H R E AT I N T E L L I G E N C E

• IP’s, signatures, logs, URL’s

• Tactics, techniques and procedures

• Financial implications / Business impact

Page 6: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

T H R E AT S

Page 7: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

What We Know

What We Know We Don’t Know

What We Don’t Know We Don’t Know

Bromiley, 2016

K N O W L E D G E

Page 8: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence
Page 9: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

‘Intelligence’ is described as information and knowledge acquired about an adversary through means of observation, followed by investigation, analysis and understanding.

Waltz, 1998

Page 10: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

E M E R G I N G T H R E AT S

Page 11: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

: https://www.accessnow.org/doubleswitch-attack/

Page 12: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

B R E X I T

https://www.independent.co.uk/news/uk/home-news/brexit-nhs-350m-a-week-eu-change-britain-gisela-stuart-referendum-bus-a7236706.html

https://news.sky.com/story/ministers-forced-to-publish-leaked-brexit-impact-study-11230715

https://www.independent.co.uk/news/uk/politics/brexit-latest-live-updates-finances-money-worse-off-

article-50-a7468411.html

Page 13: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

T R U M P

http://uk.businessinsider.com/donald-trump-trademarked-make-america-great-again-2015-5?r=US&IR=T

Page 14: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence
Page 15: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

Y O U C A N ’ T ‘ U N S E E ’ S O M E T H I N G

Page 16: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

• Hashtag poisoning

• Positive, negative and neutral posts

• Targeting individuals

• Trolling and harassment

• Multiple channels

• False reports of malicious accounts

S A M P L E TA C T I C S

Page 17: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

I T TA K E S A V I L L A G E T O R A I S E A C H I L D

Page 18: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence
Page 19: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence is not a data feed or something that comes from a tool” but actionable information that answers a knowledge gap

‘Intelligence’ is described as information and knowledge acquired about an adversary through means of observation, followed by investigation, analysis and understanding.

Page 20: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

Communication Multi-disciplinary

From the top Intelligence led

Security Maturity = Key Selling Point

Page 21: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

Intelligence requires context and anticipation of future situations to inform decisions by identifying an available course of action

http://www.jcs.mil/Portals/36/Documents/Doctrine/pubs/jp2_0.pdf

Page 22: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

T H E R E S P O N S E D E T E R M I N E S T H E I M PA C T

Page 23: CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

?


Cyber Threat Intelligence Solution Demonstration

The Cyber Threat Intelligence Matrix

Cyber threat intelligence: maturity and metrics

CYBER THREAT INTELLIGENCE€¦ · INTRODUCTION Optiv research has identified a key challenge to the impact of cyber threat intelligence: the heavily diluted term “threat ... as

THE CYBER THREAT INTELLIGENCE - ENISA

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Cyber Threat Intelligence White Paper

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

Global Cyber Threat Intelligence

The awakening of cyber threat hunting: Intelligence

LookingGlass Cyber | Cybersecurity & Threat Intelligence€¦ · CYBER SOLUTIONS LookingGlass Cyber Solutions delivers unified threat protection against sophisticated cyber attacks

Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

Standardizing Cyber Threat Intelligence Information … · Standardizing Cyber Threat Intelligence Information with the Structured Threat Information eXpression (STIX™) Table of

Cyber Surveillance and Threat Intelligence Sharing€¦ · Session 5: Cyber Surveillance and Threat Intelligence Sharing DESCRIPTION: The paucity of data and information on threat

Cyber Threat Intelligence - KPMG...risk through cyber threat intelligence. 1 KPMG’s Cyber threat intelligence We begin by understanding the business goals and operations of our clients

Rob Dartnall | Director methodologies in Cyber Threat ......Rob Dartnall Director –Cyber Intelligence Rob is a CREST Certified Threat Intelligence Managers (CCTIM) and Cyber Intelligence

Threat Intelligence in Cyber Risk Programs

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Enterprise & Cyber … Threat Intelligence Enterprise & Cyber Security August 2017 Copyright Fujitsu Limited 2017 Global Impact Fujitsu Cyber Threat Intelligence

Cyber Security, Threat Intelligence: Defending the Digital

Cyber Threat Intelligence Overview - Europa

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

Cyber Threat Intelligence faculteit/Afdelingen... · Page 1 of 40 Cyber Threat Intelligence From confusion to clarity; An investigation into Cyber Threat Intelligence Daan Planqué

Threat Intelligence - Amazon Web Services · Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence ... Goal of Intelligence Analysis. Cyber Kill Chain™ Model

The Evolution of Cyber Threats and Cyber Threat Intelligence

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

Cyber Security Intelligence & Threat Mitigation

Cyber Threat Intelligence Sharing Platforms: A

SecBI: Cyber Threat Intelligence

Sans cyber-threat-intelligence-survey-2015

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Cyber Threat Intelligence