Upload File

cyber threat intelligence

32
CYBER THREAT INTELLIGENCE Mohamed NASRI Cyber Intelligence Analyst Securiday 2015 Big Data Security 1

Upload: mohamed-nasri

Post on 20-Jul-2015

131 views

Category:

Technology


0 download

Report

TRANSCRIPT

Page 1: Cyber Threat Intelligence

CYBER THREAT INTELLIGENCE

Mohamed NASRI

Cyber Intelligence Analyst

Securiday 2015 Big Data Security

1

Page 2: Cyber Threat Intelligence

BIG DATA SECURITY

2

Page 3: Cyber Threat Intelligence

CYBER THREAT INTELLIGENCE

3

Page 4: Cyber Threat Intelligence

CYBER THREAT INTELLIGENCE

4

Page 5: Cyber Threat Intelligence

5

Page 6: Cyber Threat Intelligence

CYBER THREAT INTELLIGENCE

6

Page 7: Cyber Threat Intelligence

2010

7

Page 8: Cyber Threat Intelligence

8

Guardian of Peace

2014

Page 9: Cyber Threat Intelligence

Securiday 2015 Big Data Security 9

08-09 April 2015

From 22h to 1h

Page 10: Cyber Threat Intelligence

THREAT-BASED

DEFENSE STRATEGY

10

# If you know your enemy and know yourself you need not fear the result of 100 battles Sun Tzu “The art of war”

Page 11: Cyber Threat Intelligence

Cyber-attack life cycle

Model « Kill Chain » Lockheed Martin’s 2010.

11

Page 12: Cyber Threat Intelligence

Courses of action Matrix

12

Page 13: Cyber Threat Intelligence

13

Page 14: Cyber Threat Intelligence

THREAT INTELLIGENCE

STANDARD AND TOOLS

Securiday 2015 Big Data Security 14

Page 15: Cyber Threat Intelligence

Structured Threat Information eXpression

• Language to represent structured cyber threat indicators

Page 16: Cyber Threat Intelligence

With What is Cyber Threat Intelligence? Consider these questions:

What activity are we seeing?

What threats should I look for on my networks

and systems and why?

Where has this threat been seen?

What does it do?

What weaknesses does this threat exploit?

Why does it do this?

Who is responsible for this threat?

What can I do about it?

Page 17: Cyber Threat Intelligence

Architecture

Page 18: Cyber Threat Intelligence

Use Cases

Page 19: Cyber Threat Intelligence

19

Page 20: Cyber Threat Intelligence

SHARE

20

# My detection becomes your prevention

Page 21: Cyber Threat Intelligence

21

Page 22: Cyber Threat Intelligence

Trusted Automated eXchange of Indicator Information

• Standardizes exchange of cyber threat information

Page 23: Cyber Threat Intelligence
Page 24: Cyber Threat Intelligence
Page 25: Cyber Threat Intelligence
Page 26: Cyber Threat Intelligence

SIEM

• « SIEM is Dead! » John Linkous 2012

• « Don’t Stretch SIEM Beyond its Capabilities for

Contextual Security Analytics »

Jody Ma Kissling 2015

26

Page 27: Cyber Threat Intelligence

Securiday 2015 Big Data Security 27

Vendor specific

intel

SIEM

Preventive Detective Fusion

Host Controls

IDS AV IPS

Network Controls

Web

Content

Gateway

IPS IDS

Automated defense threat intelligence to augment Security

Page 28: Cyber Threat Intelligence

Securiday 2015 Big Data Security 28

OS-Intelligence

Threat

Collector

Preventive Detective Fusion Contextuel

Host Controls

IDS AV IPS

Network Controls

Web

Content

Gateway

IPS IDS

SIEM

Contextuel Information

Vulnerability Scanner

Sandbox

Cyber Threat Analyst

Page 29: Cyber Threat Intelligence

Securiday 2015 Big Data Security 29

OS-Intelligence

Threat

Collector

Preventive Detective Fusion Contextuel Actuator

Host Controls

IDS AV IPS

Network Controls

Web

Content

Gateway

IPS IDS

SIEM

Contextuel Information

Vulnerability Scanner

Sandbox

Cyber Threat Analyst

Actuator

Network isolation

script

Ticketing System

Workflow

Page 30: Cyber Threat Intelligence

Polyglot Persistence Martin Fowler 2011

RDBMS

Horizontal scalability Data consistency

30

Page 31: Cyber Threat Intelligence

31

Public sources

Private sources

Collaborators

ETL

SOC/CERT

SIEM

Page 32: Cyber Threat Intelligence

Merci de votre attention

32


LookingGlass Cyber | Cybersecurity & Threat Intelligence€¦ · CYBER SOLUTIONS LookingGlass Cyber Solutions delivers unified threat protection against sophisticated cyber attacks

Cyber Threat Intelligence Enterprise & Cyber Security › global › Images › Chain-phishing-O365.pdf · Fujitsu Cyber Threat Intelligence have identified chain phishing attacks

The awakening of cyber threat hunting: Intelligence

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

Threat Intelligence - Amazon Web Services · Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence ... Goal of Intelligence Analysis. Cyber Kill Chain™ Model

Sans cyber-threat-intelligence-survey-2015

Cyber Threat Intelligence Report

Cyber Surveillance and Threat Intelligence Sharing€¦ · Session 5: Cyber Surveillance and Threat Intelligence Sharing DESCRIPTION: The paucity of data and information on threat

The Cyber Threat Intelligence Matrix

Bridging the Skills Gap with Cyber Threat Intelligence · intelligence • Analysis and reporting Crucial Academy. Cyber Threat Intelligence: Current Situation ... •Integrate tactical

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence White Paper

Threat Intelligence in Cyber Risk Programs

CYBER THREAT INTELLIGENCE€¦ · INTRODUCTION Optiv research has identified a key challenge to the impact of cyber threat intelligence: the heavily diluted term “threat ... as

Cyber Threat Intelligence Solution Demonstration

Cyber Threat Intelligence Overview - Europa

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

SecBI: Cyber Threat Intelligence

THE CYBER THREAT INTELLIGENCE - ENISA

Cyber risk landscape, cyber threat intelligence and …...2019/07/04  · RESTRICTED Cyber risk landscape, cyber threat intelligence and fostering inter-agency information sharing

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

2021 Cyber Threat Intelligence Report

Global Cyber Threat Intelligence

Rob Dartnall | Director methodologies in Cyber Threat ......Rob Dartnall Director –Cyber Intelligence Rob is a CREST Certified Threat Intelligence Managers (CCTIM) and Cyber Intelligence

Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

Standardizing Cyber Threat Intelligence Information … · Standardizing Cyber Threat Intelligence Information with the Structured Threat Information eXpression (STIX™) Table of

Cyber Security Intelligence & Threat Mitigation

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Cyber Threat Intelligence - KPMG...risk through cyber threat intelligence. 1 KPMG’s Cyber threat intelligence We begin by understanding the business goals and operations of our clients

Cyber threat intelligence: maturity and metrics

Cyber Security, Threat Intelligence: Defending the Digital

Cyber Threat Operations Tactical Intelligence Bulletin

Cyber Threat Intelligence Training Series · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series is a 5-days