Download as PDF, PPTX
![© 2015 Lancope, Inc. All rights reserved.
IP with context…
Attachment MD5s:
b4fe7224da594703e78d62d9cb85c5f4c3
a00c36ea51040c3a10c557154bc7b15b9
acbcd65555398a7e3fd0f0a389cf9582b7
5b4f8855dbe555bff080c57808aBe699ba
4855340adf5c9d7092e9df08b
Payload URLs:
hxxp://internetz1[.]com/03/39.exe
hxxp://gggrp[.]com/03/59.exe
hxxp://fefg[.]com/03/39.exe
hxxp://woofe[.]com/03/39.exe
hxxp://contestswin[.]net/03/39.exe
Payload MD5:
5e91af2e44c17de55134ff935c0f30f1
C2:
130.0.133[.]35
Malware: Dridex
Attachment File Name: RZZA3440.doc](https://image.slidesharecdn.com/threatintelligencepowerpoint08-150828163106-lva1-app6891/75/So-You-Want-a-Threat-Intelligence-Function-But-Were-Afraid-to-Ask-13-2048.jpg)
![© 2015 Lancope, Inc. All rights reserved.
IP with context…
Attachment MD5s:
b4fe7224da594703e78d62d9cb85c5f4c3
a00c36ea51040c3a10c557154bc7b15b9
acbcd65555398a7e3fd0f0a389cf9582b7
5b4f8855dbe555bff080c57808aBe699ba
4855340adf5c9d7092e9df08b
Payload URLs:
hxxp://internetz1[.]com/03/39.exe
hxxp://gggrp[.]com/03/59.exe
hxxp://fefg[.]com/03/39.exe
hxxp://woofe[.]com/03/39.exe
hxxp://contestswin[.]net/03/39.exe
Payload MD5:
5e91af2e44c17de55134ff935c0f30f1
C2:
130.0.133[.]35
Malware: Dridex
Attachment File Name: RZZA3440.doc](https://crownmelresort.com/image.slidesharecdn.com/threatintelligencepowerpoint08-150828163106-lva1-app6891/75/So-You-Want-a-Threat-Intelligence-Function-But-Were-Afraid-to-Ask-13-2048.jpg)
Uploaded byLancope, Inc.
So You Want a Threat Intelligence Function (But Were Afraid to Ask)
Gavin Reid, Vice President of Threat Intelligence at Lancope, shares insights on the state of cybersecurity in 2015, highlighting the importance of threat intelligence in identifying and responding to advanced threats. He emphasizes the role of indicators of compromise (IOCs) in tracing cyber attacks and understanding their impact. The document also discusses the need for context and operational strategies to effectively utilize threat intelligence data.
More Related Content
Similar to So You Want a Threat Intelligence Function (But Were Afraid to Ask)
![Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]](https://cdn.slidesharecdn.com/ss_thumbnails/agenticcommunityseries-day3-cfd-251120170304-ddef8112-thumbnail.jpg?width=640&height=640&fit=bounds)
So You Want a Threat Intelligence Function (But Were Afraid to Ask)
- 1. Threat Intelligence? Gavin Reid VPThreat Intelligence Lancope
- 2. © 2015 Lancope,Inc. All rights reserved. About the Presenter • Gavin Reid is Vice President of Threat Intelligence at Lancope, With over 25 years of experience in threat intelligence, Reid was a driving force behind the development of big data analytics and threat identification. • While serving at Cisco Systems as director of threat research for Security Intelligence Operations, he led a team that developed new data analytics technologies to detect and remediate advanced cybersecurity threats. • Reid also created and led Cisco’s Computer Security Incident Response Team (CSIRT), a global organization of information security professionals responsible for monitoring, investigating and responding to cybersecurity incidents. • In addition to his time at Cisco, Reid also served as the vice president of threat intelligence at Fidelity Investments and oversaw IT security at NASA’s Johnson Space Center.
- 3. © 2015 Lancope,Inc. All rights reserved. Where are we with security in 2015?
- 4. © 2015 Lancope,Inc. All rights reserved. The state of the industry…
- 5. © 2015 Lancope,Inc. All rights reserved. The state of the industry…
- 6. © 2015 Lancope,Inc. All rights reserved. The state of the industry…
- 7. © 2015 Lancope,Inc. All rights reserved. What we need to do differently…
- 8. © 2015 Lancope,Inc. All rights reserved. What is threat? What is intelligence?
- 9. © 2015 Lancope,Inc. All rights reserved. What can threat intelligence help you with? Are we part of x new hack? If the hackers reuse infra will notice and be able to take advantage of that? Is this file malicious? What has this IP done in the past? How did we get infected? Are we compromised? How do we know if we are completely clean of compromise?
- 10. © 2015 Lancope,Inc. All rights reserved. Indicators of Compromise… Site C CLOUD Internet Data Center Site B Site A • Observables • Measurable events • Stateful properties “An IOC is an observable artifact of an intrusion on a host or network. Analysts can use it to trace the steps of an attack and identify what was affected, how long it was active or if there are any persisting elements of the intrusion.”
- 11. © 2015 Lancope,Inc. All rights reserved. What is an indicator? * Full list at http://openioc.org/terms/Current.iocterms
- 12. © 2015 Lancope,Inc. All rights reserved. IP with no (or invalid) context… 8.8.8.8
- 13. © 2015 Lancope,Inc. All rights reserved. IP with context… Attachment MD5s: b4fe7224da594703e78d62d9cb85c5f4c3 a00c36ea51040c3a10c557154bc7b15b9 acbcd65555398a7e3fd0f0a389cf9582b7 5b4f8855dbe555bff080c57808aBe699ba 4855340adf5c9d7092e9df08b Payload URLs: hxxp://internetz1[.]com/03/39.exe hxxp://gggrp[.]com/03/59.exe hxxp://fefg[.]com/03/39.exe hxxp://woofe[.]com/03/39.exe hxxp://contestswin[.]net/03/39.exe Payload MD5: 5e91af2e44c17de55134ff935c0f30f1 C2: 130.0.133[.]35 Malware: Dridex Attachment File Name: RZZA3440.doc
- 14. © 2015 Lancope,Inc. All rights reserved. Feeds…
- 15. © 2015 Lancope,Inc. All rights reserved. Sources… Industry Orgs Secret Groups Vendor Threat Intel First Party Data Government Orgs Peer Groups Open Source CIRTS ISACS
- 16. © 2015 Lancope,Inc. All rights reserved. What IS context? Start time? End time? Impact? Data restriction? Who found it? (contact) How was it found? Related activity? Description? Confidence?
- 17. © 2015 Lancope,Inc. All rights reserved. Data Enrichment… Whois GeoLocation Reputation History Hash PDNS VirusTotal Sandboxing Confidence
- 18. © 2015 Lancope,Inc. All rights reserved. Types of ingestion… STIX Email lists Machine Manual TAXI PDF alerts Phone call from other IRT CSV JASON
- 19. © 2015 Lancope,Inc. All rights reserved. Operationalizing… Data Source Feed Manager Comparison Engine Internal Data
- 20. © 2015 Lancope,Inc. All rights reserved. Decision Is there a match? IDS/IPS HIDS NetFlow … Splice/Splunk SIM, Logger Soltra ThreatConnect Crits Internet Identity iSight Partners ZuesTracker CriticalStack Operationalizing… Data Source Feed Manager Comparison Engine Internal Data Subscribed Feeds
- 21. © 2015 Lancope,Inc. All rights reserved. Data Jockey… Getting data ready vs. Working on data
- 22. © 2015 Lancope,Inc. All rights reserved. 01010 10010 11 01010 10010 11 01010 10010 11 01010 10010 11 Can you protect what you can’t see?
- 23. © 2015 Lancope,Inc. All rights reserved. Concerns… False Positives No or Poor context Time Inability to Operationalize Only gives a 48hr head start Issue with Sharing
- 24. © 2015 Lancope,Inc. All rights reserved. IOC Lifecycle… Create IOCs Deploy IOCs Identify Affected Systems Collect Data Analyze Data
- 25. © 2015 Lancope,Inc. All rights reserved. Make sure you have deliverables… Beyond needle and haystack Prove the negative Deliver daily, weekly, monthly Lead the organizations perspective on threat
- 26. © 2015 Lancope,Inc. All rights reserved. Bringing it Together Investigator finds new malware in word doc used in spearphish – hashes file 7c47ff87c0frca93e135c9acffee48d3f – Sandboxes and Finds c2 Query TI dbase (Intel 471) finds that same file/C2 has been used before by a specific hacker group X Group X uses various hacker forums, IRC, samples , URLS and C2’s Check nF for IRC connections to server. Runs the new IOCS into comparison engine and finds other infections – helping organization completely understand and fix the problem
- 27. © 2015 Lancope,Inc. All rights reserved. Thanks!
Editor's Notes
- #4 We are not possibly where we want to be Even though we have had first conferences, IDS&SIMS, 2015 is shaping up to be the worst ever for Cybercrime (and no site of the summit yet) we are all at risk from adversaries both criminal and state controlled, both foreign and domestic, in ways that were unthinkable before the Information Age. 2014 Target Home Depot & Sony (synomus with consumer sales) 2015 Anthem BlueCross IRS and Office of personal management
- #5 We have a bunch of orgs who are part of the problem – with an ostrich like approach to security they do only what is mandated and have not invested appropriately to protect their organizations Its really not hard - find out what you MUST protect, protect the living daylights out of that, don’t make it easy to access, make it hard and log the living daylights out of all access. This ISN’T new Here is an irish tower from the middle ages. They spent a fair bit of the community resources(and years) in building, they put the cool shit up in the top and pulled the ladders up when not in use. Ok- I am over stating this – we have got really really good and scaling current security solutions over huge enterprises (right?)
- #6 We have a bunch of orgs who are part of the problem – with an ostrich like approach to security they do only what is mandated and have not invested appropriately to protect their organizations Its really not hard - find out what you MUST protect, protect the living daylights out of that, don’t make it easy to access, make it hard and log the living daylights out of all access. This ISN’T new Here is an irish tower from the middle ages. They spent a fair bit of the community resources(and years) in building, they put the cool shit up in the top and pulled the ladders up when not in use. Ok- I am over stating this – we have got really really good and scaling current security solutions over huge enterprises (right?)
- #8 So what do we need to do differently Protect what needs protection and really protect no ½ asses Log the living daylights out of access to above Resource this appropriately People People People
- #9 Threat intelligence – like Cyber has come to mean everything and nothing, what is it really?’ Hackers are lazy like most people they will reuse techniques and infrastructure if they can Originally the purview of the military @ .gov’s orgs are now starting to implement - Starting to understand that its only due diligence to check for TTP and infra reuse Savy companies are paying attention to what the threat actors are doing / how they are doing it / what infra they are using - to use reuse of TTP/OICs as a detection method -- Even smarter orgs are basing their security arch on actual / not theoretical attacks – an amazing way to prioritize resources Attribution – right level – difference between advanced and scripted
- #12 You could give most organizations the goose that lays the golden threat intelligence egg – wouldn’t help them – you have to be instrumented to be able to quickly and completely take advantage indicators, most orgs are not. If you can’t use the data you get with a lifecycle managed approach – it won’t do you much good – The big problem organizations have with threat intelligence today is how to easily manage the huge amounts data they have internally to compare - with intelligence they receive. First comparing all to all, then anything new, then expiring the indicators on predefined schedules
- #13 How it it done? As well as mailing lists and community organizational sharing (like FIRST) Often takes the form of feeds – open, private and all over the map in efficacy When talking to your feed vendors ask 3 questions How much of your feed is new? How much is expired How much is uniquely created content Then its up to you to track that yourself – super important
- #14 How much time do you want to spend on getting the data available/ready for comparisons vs actually working on the data No perfect solutions – dependencies hell with cifs, crits getting better and a very smooth solera/splice/splunk combo Mostly it will be 90/10 or 70/30 or maybe if your really luck 50/50 – work on moving the needle to 10% data jockey and 90% analysis – it won’t start that way
- #15 often good TI only gives you a 48 HR head start inherent issue with sharing public/private feeds are not meant for your org - meant for all customers So what do you do to fix this??? Create your own 1st party research (pulling malware samples, searching the internet for bad sites, ways you can get exposure to unique attacks)