Upload File

sans cti summit 2016 - data-driven threat intelligence: sharing

51
Data - Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing (# ddti ) Alex Pinto Chief Data Scientist MLSec Project / Niddel @alexcpsec @MLSecProject @NiddelCorp

Upload: alex-pinto

Post on 13-Apr-2017

2.368 views

Category:

Data & Analytics


1 download

Report

TRANSCRIPT

Page 1: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Data-DrivenThreatIntelligence:MetricsonIndicatorDisseminationandSharing

(#ddti)

AlexPintoChiefDataScientist

MLSec Project/Niddel@alexcpsec

@MLSecProject @NiddelCorp

Page 2: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

• Previouslyon#ddti• ChallengesatTISharing• MeasuringTISharing• TheFutureofSharing

Agenda

Page 3: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Thisisadata-driventalk!Pleasecheckyouranecdotesatthedoor

Page 4: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing
Page 5: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Previouslyon#ddti• UsefulMethodsandMeasurementsforHandlingIndicators• AnalysisofThreatIntelligenceFeeds• Indirectly,amethodologyforanalyzingTIProviders

• Combine(https://github.com/mlsecproject/combine)• GathersTIdata(ip/host)fromInternetandlocalfiles

• TIQ-Test(https://github.com/mlsecproject/tiq-test)• RunsstatisticalsummariesandtestsonTIfeeds

Page 6: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

TIQ-TEST- TonsofThreat-yTests

• NOVELTY – Howoftendothefeedsupdatethemselves?• AGING – Howlongdoesanindicatorsitonafeed?• POPULATION – Howdoesthispopulationdistributioncomparetomydata?

• OVERLAP– Howdotheindicatorscomparetotheonesyougot?

• UNIQUENESS – Howmanyindicatorsarefoundonlyononefeed?

Puttingthisthreatinteldatatowork

Page 7: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

OverlapTestMoredataisfine,butmakesure

itisdifferent

Page 8: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

OverlapTest- Outbound

Page 9: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

UniquenessTestCanwetellifweareclosetofinding*all*thethreats?

Page 10: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing
Page 11: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Ihatequotingmyself,but…

Page 12: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

KeyTakeaway#1

MORE!=BETTERThreatIntelligenceIndicatorFeeds

ThreatIntelligenceProgram

Page 13: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

ConstructiveFeedbackfromtheInternet:

“TISharingisTOTALLYgoingtosolvethis”

Right,folks?Right?

Page 14: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

TISharingSolutionPlan:

1. ThebestThreatIntelligenceistheonethatyouanalyzefromyourownincidents(homegrown/organicintelligence)

2. Thereisstrengthinnumbers– verticalherdimmunity!

3. ????????

4. PROFIT!!(oratleastSECURITY!!)

Oratleastaroughstrawman

Page 15: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

IfCONSUMINGisforthe1%,whatisthepercentageoforganizationsabletoPRODUCE?

Issue1- BYOTI

Page 16: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Issue2- HerdImmunity

Source:www.vaccines.gov

• Wemaybeabletodetectmore”virusstrains”togetherbutweare*terrible*atinoculation.

• Thethingswedetectthemostmutatetoofast(PyramidofPain)

• Whodidn’tgetimmunized,stillgetssick(FOMO-TI)

Page 17: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Issue?- Whatarewesharing• AUTOMATION-DRIVEN(PLATFORMS)• StraighttothepointIOCsharing

• ANALYST-DRIVEN(COMMUNITIES)• Strategicdata,bestpractices,unstructuredIOCs

• ”Analyst-driven”hasbeenaroundforever(innon-IC,atleastsinceFS-ISACwascreated)

• Thesamepeoplewhobash”justIOCsharing”:• BashSTIX/TAXIIfortryingtoencodecomplexity• TellseveryoneitisIMPOSSIBLEtohireanalysts

Page 18: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

TheCognitiveDissonancesofTISharing

Everybody shouldshare! TheCIRCLEOFTRUST

Page 19: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Doyoutrustthegroupenoughtoconsume?

TheTwoSidesoftheTrustCoin

Doyoutrustthegroupenoughtoshare?

Page 20: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Okay,I’llbite

Canwemeasureourcurrentsharingplatformscommunities?

Page 21: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

ThreatIntelligenceSharingWewouldliketothankthekindcontributionofdatafromthefinefolksatFacebookThreatExchange andThreatConnect

…andalsothesharingcommunitiesthatchosetoremainanonymous.Youknowwhoyouare,andwe❤ youtoo.

Page 22: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

SharingCommunitiesARESocialNetworks

SocialNetworkSelfie SharingCommunitySelfie

Page 23: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Let’slookattheindicatorsfirst

UsingTIQ-TESTOverlapandUniquenesstests

Page 24: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

OVERLAPSLIDE

Page 25: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

OVERLAPSLIDE

Page 26: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

UNIQUENESSSLIDE

Lookslikewewouldgetsimilarqualityona”good”ThreatIntelligenceSharingPlatformaswewouldon

a”paidfeed"

Page 27: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

SuggestedMetricsforSharing

• ACTIVITY – Howmanyindicators/postsarebeingshareddaybyday?

• DIVERSITY –Whatisthepercentageofthepopulationthatisactivelysharing?

• FEEDBACK – Areorgscollaboratingonimprovingtheknowledgeinthesharingenvironment?

• TRUST– Howmuchdataisshared”openly”inrelationto”privately”?

Lookingforhealthydynamics

Page 28: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

ActivityMetricIsthereanyactualsharinggoing

on?

Page 29: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Lessdata/Delays Moredata/Timely

LargeGroupisroughly40xbiggerthanSmallGroup

Page 30: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Organizationsarelesslikelytoshareiftheyperceivethey”lostcontrol”ofwhocanconsume.

Page 31: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

DiversityMetricCheckyoursharingprivilege

Page 32: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Roughly10%oftheorganizationssharedataintothecommunity

Page 33: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Someorganizationsareclearlyinabetterpositionoperationallyandlegallytoshare.Andthatis

expectedduetoourpremises.

Page 34: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

FeedbackMetricButisthedataanygood?

Page 35: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing
Page 36: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

🙀 I’msurewecandobetterthanthis🙀

Page 37: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

FeedbackMetric• Almostnosupportonautomation-drivenplatforms• Someallowyoutoleave”comments”or”newdescriptors”fortheIOCs– evenbycountingthoseverylow%inrelationtonewshareddata

• Analyst-drivenenvironmentsallowforcollaborationone-mailsandforumpoststodescribeandrefinestrategiesandbestpractices.

Howcanwemakethiscollaborationworkonautomation-drivenplatforms?

Page 38: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

TrustMetricArewehelpingallthecommunity

orjustafeworgsatatime?

Page 39: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing
Page 40: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

76%.Again,soundsaboutright

Page 41: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Overall”quality”ofdatagoesuptoo!

Page 42: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

TrustMetric• Theroughestimateseemstobethatmorethan60%of”sharing”(IOCs,messages,etc)happensin”privategroups”insidetheinfrastructureofthesharingplatform

• Allcommunitieshavethem:• PartoftheDNAoftheIC/clearedcommunity• Offsetsthetrustequation,butdefeatsthe”herdimmunity”argument• UsuallyMANDATORYoncollaborationwithLEA

Butthenthe”good”dataisnothelping”thecommunity”!Isthereanywaywecanreconcile?

Page 43: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

TheFutureofSharing🔮Attheveryleastmyhumble

opinion

Page 44: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

#squadgoalsIncreasetheTRUST

amongpeers

ReducetheTECHNICALBARRIERforsharinguseful

information

Page 45: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

TRUST:ReputationandAnonymity

Page 46: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

AlienVault OTXclearlygotthememo

Page 47: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

TRUST:Anonymity+GoodCuration

Somesharingcommunitiesacceptanonymoussubmissionsthattheythencurateanddisseminate

toallorganizations

Page 48: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

IOCs

Feedback

TelemetryLESSMATURE

MOREMATURE

With❤ andapologiesto@DavidJBianco

TECHNICALBARRIER:”PyramidofSharing”

Page 49: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Takeaways• IntelligenceSharingisaveryanalyst-centricactivitythatwehavebeentaskedwithscalingoutwithautomation.Nowonderitseemssohard.

• Datacanbeasgoodasapaidfeed,butyouhavetobeintherightcirclesoftrust

• Doesnotsolveanalystshortageandmakingtheindicators/strategiesoperationalintoyourenvironment

Page 50: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing
Page 51: SANS CTI Summit 2016 - Data-Driven Threat Intelligence: Sharing

Thanks!

• Q&A?• Feedback!

”Themeasureofintelligenceistheabilitytochange."- AlbertEinstein

AlexPinto@alexcpsec

@MLSecProject /@NiddelCorp


Sans cyber-threat-intelligence-survey-2015

Cyber Threat Intelligence - CTI · Ανοιχτές Πηγές - Open Source Intelligence ... exchange cyber threat information for the detection, prevention, and mitigation of cyber

Cyber Threat Intelligence Training Series · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series is a 5-days

The Business Use Case for Cyber Threat Intelligence (CTI) 201… · Attach risk scores to threat indicators, ... alerts as high priority • Allow SIEM or analyst to query the threat

2020 SANS Network Visibility and Threat Detection Survey

Cyber threat intelligence report cyber 5.pdfdata and technology such as threat intelligence feeds or intelligence platforms. CTI must be integrated into security and business processes,

NetWitness Investigator Freeware - SANS · Aggregation of these methods help profile actual threatening activity • Advanced Threat • Insider Threat • Policy/Compliance • Etc

Data sheet Circuit Breakers, Type CTI 25M, CTI 45MB, CTI 100camfoss.net/.../CTI25M-CTI45MB-CTI100.pdf · Type CTI 25M, CTI 45MB, CTI 100 Features Overload protection and short circuit

THREAT MANAGEMENT AND OUR TECHNICAL LEARNINGS IMPLEMENTING CTI · PDF fileTHREAT MANAGEMENT AND OUR TECHNICAL LEARNINGS IMPLEMENTING CTI ... threat indicators and intel ... correlate,

9:00-10:00 am Keynote Address Survival Heuristics: My ... 12-4-17.pdf · Requirements and Cyber Threat Intelligence Program Success . The hype around cyber threat intelligence (CTI)

Threat Landscape - SEA 09-2015 - SANs

2020 SANS Cyber Threat Intelligence (CTI) Survey

Alien vault sans cyber threat intelligence

TOWARDS A MATURE CTI PRACTICE - first.org · PDF fileindicators – but the real ... correlate threat information archive in structured repository production of actionable CTI Q. EXPANDING

Le service de Cyber Threat Intelligence du Cert-IST · Computer Emergency Response Team Industrie Services & Tertiaire Forum 2016 page 2 Sommaire 1. La Cyber Threat Intelligence (CTI)

CTI EU | Bonding EU Cyber Threat Intelligence

Threat Mosaic: Using CTI to Improve Collaboration and ... · Threat Mosaic: The Importance of Threat Collaboration & Intelligence Sharing Jonathan Couch, SVP Strategy ... Adversary-focused

CTI: Cyber Threat Intelligence - OASIS...2016/11/02  · • Cyber Threat Intelligence in its real meaning: CTI Level 2 (L2) – Contextual CTI 5Ws1H of Cyber Attacks Lets you determine

TOWARDS A MATURE CTI PRACTICE - OASISTowards a Mature CTI Practice – Borderless Cyber. threat indicators monitor (SIEM, IDS) block (firewall, ACL) hunt (data lake) production of

Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

Endgame SANS - Threat Hunting Before the Incident

CTI Capability Maturity Model | Marco Lourenco 1 · European Union Agency for Network and Information Security CTI Capability Maturity Model Cyber Threat Intelligence Course NIS Summer

2021 SANS Cyber Threat Intelligence (CTI) Survey

Security Strategy and Tactic with Cyber Threat Intelligence (CTI)

Overview Cyber Threat Intelligence Training Series · Cyber Threat Intelligence (CTI) Training Series is a 5-days training, which is divided into ... The Diamond Model ... into log

HEALTH CARE AND PUBLIC HEALTH CYBER THREAT … · In an effort to determine the needs for cybersecurity threat information (CTI) sharing in the Healthcare and Public Healthcaresector

Gain, CTI, & CTI by column

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Workshop Series - Foundation · 2020. 12. 22. · Introduction and Objective Cyber Threat Intelligence (CTI) Workshop Series is a 5-days workshop, which

The Evolution of Cyber Threat Intelligence (CTI): 2019 ...wow.intsights.com/rs/071-ZWD-900/images/The Evolution of Cyber Threat... · SANS Analyst Program | The Evolution of Cyber

Cyber Threat Intelligence - Cyber Security Academy · an informed decision on which countermeasures to deploy first, a new concept called Cyber Threat Intelligence (CTI) is often

Threat Hunting & IR - SANS Institute...Threat Hunting & IR Summit & Training 2019 October 2-7 | #ThreatHuntingSummit @sansforensics Venue ... FOR610 Reverse-Engineering Malware: Malware

Presentación de PowerPoint - CILEA Seminario Montevideo... · cti – tributaciÓn y fiscalidad. cti - mipymes. cti sistemas y tecnologÍa. cti - control de calidad. cti - peritaje

SANS Top New Attacks and Threat Report · Hear from the Experts: SANS Threat Panel at RSA Data Security Conference The RSA Conference started in 1991 and has grown to be the largest

SANS CTI Summit 2016 Borderless Threat Intelligence