10 Questions
What is the primary concern when evaluating threat intelligence assessment data?
The relevance of the data to your organization
What is the purpose of a confidence score in threat intelligence assessment?
To assign a level of trust to the information
How should low-confidence threat information be treated?
It should be considered in conjunction with other sources
What is a key benefit of consulting RFC documents in threat research?
They contain detailed technical specifications for Internet protocols
Why is it important to monitor social media accounts of prominent security professionals?
To learn about emerging cybersecurity threats and trends
What is the primary goal of conducting your own research into emerging cybersecurity threats?
To stay informed about the latest threats and improve your threat intelligence program
What is the focus of a good threat research toolkit?
A combination of various sources and types of information
Why is it important to learn about adversary tactics, techniques, and procedures (TTPs)?
To better understand the ways that attackers function and improve your threat intelligence program
What is the primary benefit of attending professional conferences and local industry group meetings?
To learn about emerging cybersecurity threats and trends
Why is it important to evaluate the source of threat intelligence assessment data?
To determine the vendor providing the data
Study Notes
Cybersecurity Threat Environment
- The modern cybersecurity threat environment consists of various types of threats, each with distinct characteristics.
Threat Actors
- Cybersecurity threat actors differ in skills, capabilities, resources, and motivation.
- They can be internal or external to an organization.
- Internal threats can be just as dangerous as external threats.
- Threat actors can be categorized by their level of sophistication, ranging from unsophisticated script kiddies to advanced persistent threats (APTs).
- Resources and funding also vary among threat actors, with some having virtually limitless resources and others being hobbyists.
- Motivation and intent also differ, with some seeking thrills and others engaged in targeted corporate espionage.
Physical Security
- Physical security is crucial, as attackers who gain physical access to a component can compromise it.
- Attackers can exploit unsecured or poorly secured wireless networks, even from a parking lot.
- Removable media, such as USB drives, can be used to spread malware.
Supply Chain Risks
- Sophisticated attackers may target an organization's IT supply chain, gaining access to devices before they are delivered to the end user.
- This type of third-party risk is difficult to anticipate and address.
- Strong vendor management practices can help identify and mitigate these risks.
Threat Research
- Threat research involves gathering intelligence on modern cyber adversaries' tactics, techniques, and procedures (TTPs).
- Security companies and researchers engage in primary cybersecurity research to uncover TTPs.
- Security solution providers analyze customer data to identify TTPs.
- Honeynets are used to observe how hackers interact with vulnerable systems.
- The dark web is a primary source of threat intelligence.
Threat Intelligence
- Organizations need reliable, up-to-date threat intelligence feeds to stay ahead of threats.
- Multiple feeds can be used to validate information.
- Threat maps provide a geographic view of the threat landscape.
- However, geographic attribution is often unreliable due to attackers relaying attacks through cloud services and compromised networks.
Assessing Threat Intelligence
- Timeliness, accuracy, and relevance are key factors in assessing threat intelligence sources.
- Confidence scores can be used to filter and prioritize threat intelligence based on trustworthiness.
- Low confidence information should not be ignored, but should be treated with caution.
Building a Threat Research Toolkit
- Sources for building a threat research toolkit include:
- Vendor security information websites
- Vulnerability and threat feeds from vendors, government agencies, and private organizations
- Academic journals and technical publications
- Professional conferences and local industry group meetings
- Social media accounts of prominent security professionals
- Information on adversary TTPs.
Learn about the modern cybersecurity threat environment, including major types of threats and their characteristics, as well as building a threat intelligence capability.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
