Upload File

leveraging threat intelligence for cyber security in · pdf fileleveraging threat intelligence...

  • Home
  • Documents
  • Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated
19
ePlus. Where Technology Means More.™ © 2015 ePlus inc. Confidential and Proprietary. ™ ePlus. Where Technology Means More.™ Leveraging Threat Intelligence for Cyber Security in Education Lee Waskevich CCIE 7764, CISSP Sr Director - Architecture August 2016 1

Upload: lamnhan

Post on 15-Mar-2018

244 views

Category:

Documents


6 download

Report

TRANSCRIPT

Page 1: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

™

ePlus.WhereTechnologyMeansMore.™

Leveraging Threat Intelligence for Cyber Security in Education

LeeWaskevich

CCIE7764,CISSP

Sr Director- Architecture

August2016 1

Page 2: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

Security as Organizational Risk

+ Securityisjustanotheroperationalrisksimilarto:

+ Continuityrisk+ Consumerrisk+ Supplychainrisk+ Compliancerisk+ Legalrisk…etc

Untilnowwe’vehadnowaytolinkbusinessriskstoactualthreats

Page 3: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

Business & Organizational Risk is Why Threat Intelligence is so Important

“Gartner estimates this market will reach almost $1.5 billion

by 2018, from more than $250 million in 2013”

Ruggero Contu, Rob McMillanCompetitive Landscape: Threat Intelligence Services, Worldwide,

2015Published: 14 October 2014

Strategic Planning Assumption:“By 2018, 60% of large

enterprises globally will utilize commercial threat intelligence services to help inform their

security strategies.”Rob McMillan & Khushbu Pratap

Market Guide for Security Threat Intelligence ServicesPublished: 14 October 2014

“Many vendors can provide raw information, but there are only a comparative few that

provide true intelligence capabilities.”

Rob McMillan & Kelly KavanaghTechnology Overview for Security Threat Intelligence Service

ProvidersPublished: 16 October 2013

Page 4: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary. ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

CommercialThreatIntelligenceischangingSecurityPrograms

Page 5: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

Defining Threat Intelligence

Threat intelligence is evidence-based knowledge, including context,mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.Gartner 16 May 2013 G00249251

Page 6: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

IntelligenceisNothingNew

Page 7: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

Commercial Threat Intelligence Types

• Machine Real Time Intelligence (MRTI) fed through APIs

• Webroot• ThreatGrid• Centripital Networks

• Analytical / Contextual (people driven)• iSight (Now FireEye)• Crowdstrike

~nearly 100 vendors in this space today

Page 8: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

HowThreatsareRealized“TheBreakDown”

Page 9: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

ThreatIntelligenceVisualized

Page 10: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary. ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

SensitiveData:DefiningtheRiskToEducational

Institutions

Page 11: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

Sensitive Data Identification

• Organizational leadership discussions• Administrators• Business Managers• Board Members

• State Compliance• Data Ownership• Operational Impact

Think big buckets, not detailed data classificationCould be Operational Systems, PII, intellectual

property…

Page 12: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

Sensitive Data Prioritization

+ Risk to Life and Safety+ Physical Security Systems+ Video, Alarms, Controls all Network based

+ Risk of Personal Information theft+ PII+ Credentials and Health Data

+ Operational Impact+ Online Testing & Learning Systems+ Unavailability of Educational Systems and Resources

Page 13: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

™

ePlus.WhereTechnologyMeansMore.™

Utilizing Threat Intelligence

13

Page 14: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

Identifyingyourattacker

Page 15: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

Implementing an Intelligence Led Security Program

1. Understand your threat reality

2. Create intelligence collection requirements

3. Implement a proactive threat intelligence capability to monitor the relevant threat environment to your business

4. Integrate threat indicators delivered from intelligence provider(s) into your security technology, operations, workflow, and communications.

5. Correlate incident and threat indicators to the associated threat context to inform impact value and prioritization.

6. Train like you fight - Implement a custom training program that emulates the adversaries that pose the greatest risk to your business and train as a team.

Slide content courtesy of iSight Partners

Page 16: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

Language&Workflow

Page 17: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

Shrink the Problem and Improve Prioritization

ThreatSources

AttackSurface

CustomerSidePeople,process,andtechnologyhelpsthemdeterminepossiblerisks.

CyberThreatIntelligenceIntelligencehelpsthemdeterminewhicheventsposethegreatestrisktotheiruniqueorganization.

17

VERIFIEDTHREATINDICATORS

PRE-PROCESSEDANALYSIS

RAWOBSERVATIONS

INCIDENTINDICATORS

CORRELATEDEVENTS

ATTACKALERTS

NoisetoSignal(10,000Events/Day**)

**Source: Damballa’s Q1 2014 State of Infections Report

Page 18: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

BenefitstoThreatIntelligence

• Focused security spending on actual threats to your organization• Versus the current perceived threat model

• Verifying the reactive and improving the predictiveoverall threat response

• Improved risk threat mitigation metrics (is your security program effective?)

Page 19: Leveraging Threat Intelligence for Cyber Security in · PDF fileLeveraging Threat Intelligence for Cyber Security in Education ... Correlate incident and threat indicators to the associated

ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary. ePlus.WhereTechnologyMeansMore.™©2015ePlus inc. ConfidentialandProprietary.

LeeWaskevichSr Director- ArchitectureCCIE7764,CISSPePlus Technology,inc.130Futura DrivePottstown,[email protected]


Cyber Threat Intelligence Enterprise & Cyber Security › global › Images › Chain-phishing-O365.pdf · Fujitsu Cyber Threat Intelligence have identified chain phishing attacks

Cyber Threat Intelligence White Paper

THE CYBER THREAT INTELLIGENCE - ENISA

Global Cyber Threat Intelligence

Bridging the Skills Gap with Cyber Threat Intelligence · intelligence • Analysis and reporting Crucial Academy. Cyber Threat Intelligence: Current Situation ... •Integrate tactical

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence - CTI · Ανοιχτές Πηγές - Open Source Intelligence ... exchange cyber threat information for the detection, prevention, and mitigation of cyber

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

CYBER THREAT INTELLIGENCE - HEAnet · Cyber threat intelligence (CTI) is the analysis of an adversary’s motives, capability and opportunity to illicit harm consequently, “intelligence

Cyber Threat Intelligence - KPMG...risk through cyber threat intelligence. 1 KPMG’s Cyber threat intelligence We begin by understanding the business goals and operations of our clients

Cyber Threat Intelligence

Operational Cyber Threat Intelligence:

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

Cyber threat intelligence: maturity and metrics

The Cyber Threat Intelligence Matrix

Cyber Threat Intelligence faculteit/Afdelingen... · Page 1 of 40 Cyber Threat Intelligence From confusion to clarity; An investigation into Cyber Threat Intelligence Daan Planqué

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Threat Intelligence in Cyber Risk Programs

Threat Intelligence - Amazon Web Services · Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence ... Goal of Intelligence Analysis. Cyber Kill Chain™ Model

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

Injecting wisdom into Cyber Threat Intelligence

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Cyber Threat Operations Tactical Intelligence Bulletin

Cyber Security Intelligence & Threat Mitigation

The Evolution of Cyber Threats and Cyber Threat Intelligence

Cyber Surveillance and Threat Intelligence Sharing€¦ · Session 5: Cyber Surveillance and Threat Intelligence Sharing DESCRIPTION: The paucity of data and information on threat

Rob Dartnall | Director methodologies in Cyber Threat ......Rob Dartnall Director –Cyber Intelligence Rob is a CREST Certified Threat Intelligence Managers (CCTIM) and Cyber Intelligence

SecBI: Cyber Threat Intelligence

Alien vault sans cyber threat intelligence

Cyber Threat Intelligence Overview - Europa

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

LookingGlass Cyber | Cybersecurity & Threat Intelligence€¦ · CYBER SOLUTIONS LookingGlass Cyber Solutions delivers unified threat protection against sophisticated cyber attacks

Standardizing Cyber Threat Intelligence Information … · Standardizing Cyber Threat Intelligence Information with the Structured Threat Information eXpression (STIX™) Table of

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series