Upload File

how threat intelligence affects business risk - · pdf filehow threat intelligence affects...

  • Home
  • Documents
  • How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat
15
ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary. ™ ePlus. Where Technology Means More.™ How Threat Intelligence affects Business Risk Tom Bowers Chief Security Strategist October 2015 1

Upload: dothu

Post on 15-Mar-2018

223 views

Category:

Documents


2 download

Report

TRANSCRIPT

Page 1: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

™

ePlus. Where Technology Means More.™

How Threat Intelligence affects

Business Risk Tom Bowers

Chief Security Strategist

October 2015 1

Page 2: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Security as Business Risk

+ Security is just another business risk similar to:

+ Market risk

+ Customer risk

+ Supply chain risk

+ Compliance risk

+ Legal risk…etc

Until now we’ve had no way to link business risks to actual threats

Page 3: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Business Risk is Why Threat Intelligence is so Important

“Gartner estimates this market will

reach almost $1.5 billion by 2018, from

more than $250 million in 2013”

Ruggero Contu, Rob McMillan

Competitive Landscape: Threat Intelligence Services, Worldwide, 2015

Published: 14 October 2014

Strategic Planning Assumption:

“By 2018, 60% of large enterprises

globally will utilize commercial threat

intelligence services to help inform their

security strategies.”

Rob McMillan & Khushbu Pratap Market Guide for Security Threat Intelligence Services

Published: 14 October 2014

“Many vendors can provide raw

information, but there are only a

comparative few that provide true

intelligence capabilities.”

Rob McMillan & Kelly Kavanagh

Technology Overview for Security Threat Intelligence Service Providers

Published: 16 October 2013

Slide content courtesy of iSight Partners

Page 4: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary. ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Commercial Threat Intelligence is changing Security Programs

Page 5: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Defining Threat Intelligence

Threat intelligence is evidence-based knowledge, including context,

mechanisms, indicators, implications and actionable advice, about an

existing or emerging menace or hazard to assets that can be used to

inform decisions regarding the subject's response to that menace or

hazard.

Gartner 16 May 2013 G00249251

Page 6: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Commercial Threat Intelligence Types

• Machine Real Time Intelligence (MRTI) fed through APIs

• Webroot

• Norse

• Analytical / Contextual (people driven)

• iSight

• Crowdstrike

~25 vendors in 2014, 75 in place today (and growing weekly)

Page 7: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary. ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Sensitive Data:

Defining the Business Risk

Page 8: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Sensitive Data Identification

• Business leadership discussions • C Level

• Board

• Regulatory

• Compliance Think big buckets, not detailed data classification

Could be business processes, positive/negative

intellectual property…

Page 9: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Sensitive Data Prioritization

+ Extinction Level Event (could go out of business)

+ VW ?

+ Cardsystems (payment card processor)

+ Major (stock price drop, reputational hit, C-Level job losses)

+ Target

+ OPM

+ Minor (PR hit but survivable)

+ TJ Maxx

+ JP Morgan Chase

Page 10: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

™

ePlus. Where Technology Means More.™

Utilizing Threat Intelligence

10

Page 11: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Implementing an Intelligence Led Security Program

1. Understand your threat reality

2. Create intelligence collection requirements

3. Implement a proactive threat intelligence capability to monitor the

relevant threat environment to your business

4. Integrate threat indicators delivered from intelligence provider(s) into your

security technology, operations, workflow, and communications.

5. Correlate incident and threat indicators to the associated threat context

to inform impact value and prioritization.

6. Train like you fight - Implement a custom training program that emulates

the adversaries that pose the greatest risk to your business and train as

a team.

Slide content courtesy of iSight Partners

Page 12: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Two years to fully operationalize this program

Page 13: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Shrink the Problem and Improve Prioritization

Threat Sources

Attack Surface

Customer Side People, process, and technology helps them determine possible risks.

Cyber Threat Intelligence Intelligence helps them determine which events pose the greatest risk

to their unique organization.

13

VERIFIED THREAT INDICATORS

PRE-PROCESSED ANALYSIS

RAW OBSERVATIONS

INCIDENT INDICATORS

CORRELATED EVENTS

ATTACK ALERTS

Noise to Signal (10,000 Events/Day**)

**Source: Damballa’s Q1 2014 State of Infections Report

Page 14: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

Benefits to Threat Intelligence

• Focused security spending on actual threats to your

business • Versus the current perceived threat model

• Instantaneously reactive and improving predictive

business risk threat response

• Improved business risk threat mitigation metrics (is

your security program effective?)

Page 15: How Threat Intelligence affects Business Risk - · PDF fileHow Threat Intelligence affects Business Risk Tom Bowers ... Correlate incident and threat indicators to the associated threat

ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary. ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary.

[email protected]


HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

SMARTER Threat Intelligence · Our threat intelligence is derived from the Webroot® Threat Intelligence Platform, our proprietary cloud-based security analysis architecture designed

Cyber Threat Intelligence

Kaspersky Threat Intelligence Portal...Threat Intelligence Resource Subscribers to Kaspersky’s Threat Intelligence Portal enjoy a single point of entry to: Kaspersky Threat Data

Threat Intelligence Solution Demonstration

THREAT INTELLIGENCE - CrowdStrike

NETSCOUT THREAT INTELLIGENCE REPORT · NETSCOUT Threat Intelligence LETTER FROM NETSCOUT THREAT INTELLIGENCE Today, attackers can release enormous terabit-per second-scale DDoS attacks

Introduction to Threat Intelligence

THREAT INTELLIGENCE PLATFORMSdocs.media.bitpipe.com/io_12x/io_128188/item_1253423/ThreatCon… · Effective threat intelligence management is an ongoing effort. The threat landscape

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Nokia Threat Intelligence Report

Threat Intelligence - NCC Group · Introduction Threat intelligence: a maturing defence differentiator Understanding the types of threat intelligence: from the generic to the specific

Threat intelligence platforms

group-ib.com Threat Detection System Group−IB THREAT ... · group-ib.com How Threat Intelligence Works • Your security systems continuously detect threats. • Threat Intelligence

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Threat intelligence platform explained

Threat Intelligence Briefing

Cyber Threat Intelligence Enterprise & Cyber … Threat Intelligence Enterprise & Cyber Security August 2017 Copyright Fujitsu Limited 2017 Global Impact Fujitsu Cyber Threat Intelligence

ADVANCED THREAT INTELLIGENCE - Bitdefender · Advanced Threat Intelligence Architecture Advanced Threat Intelligence resolves a long-standing blind spot for SOC managers and analysts,

Shellshock Threat Intelligence Report

Threat Intelligence Defined

Threat Intelligence: Collecting, Analysing, EvaluatingThreat Intelligence: Collecting, Analysing, Evaluating mwrinfosecurity.com CPNI.gov.uk cert.gov.uk 4/36 Threat intelligence is

Global Threat Intelligence Center (GTIC) 2017 … Security Q2 2017... · Global Threat Intelligence Center (GTIC) Quarterly Threat Intelligence Report Q2 2017. ... In previous editions

Certified Threat Intelligence Analyst...04 Certified Threat Intelligence Analyst Why Organizations Need A Threat Intelligence Team Traditional approaches to malicious attacks are slowly

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Threat monitor Threat Intelligence Report Q1 2020

State of Threat Intelligence Studyf6ce14d4647f05e937f4-4d6abce208e5e17c2085b466b98c2083.r3.cf1.rackcdn.c…Operationalizing Threat Intelligence .....11 2016 Threat Intelligence Agenda

Counter Threat Unit™ Threat Intelligence

Threat Intelligence

Certified Threat Intelligence Analyst - Koenig Solutions · Certified Threat Intelligence Analyst Course Outline Module 01: Introduction to Threat Intelligence Understanding Intelligence

Crowd-Sourced Threat Intelligence

Operational Cyber Threat Intelligence: