Module 3: Threat Intelligence

Module 3: Threat Intelligence

• This module focuses on evaluating threat intelligence sources.
• Information sources are used to communicate emerging network security threats.
• Various threat intelligence services are described.

3.1 Information Sources

• SANS Institute resources are largely free and include the Internet Storm Center (early warning system), NewsBites (weekly security news digest), @RISK (weekly digest of newly discovered attack vectors), Flash security alerts, and a Reading Room with over 1,200 research papers.
• SANS develops security courses.
• MITRE maintains a list of CVE (Common Vulnerabilities and Exposures) used by security organizations.
• FIRST is a security organization that brings together incident response teams of various organizations (government, commercial, educational) to share information and coordinate efforts.
• SecurityNews aggregates the latest security news, alerts, and vulnerabilities.
• (ISC)² provides vendor-neutral education and career services to over 75,000 professionals.
• CIS is a focal point for cyber threat prevention, protection, response, and recovery for governments through MS-ISAC.

Network Intelligence Communities (cont.)

• To remain effective, cybersecurity professionals must:
  • Stay up-to-date on the latest threats (subscribe to real-time feeds, security websites, blogs, podcasts).
  • Continue to upgrade skills (attend security training, workshops, conferences).
• Network security has a steep learning curve and requires ongoing professional development.

Cisco Cybersecurity Reports

• Cisco Annual Cybersecurity Report and the Mid-Year Cybersecurity Report help security professionals stay abreast of the latest threats.
• These reports provide updates on security preparedness, analysis of top vulnerabilities, factors behind attacks (adware, spam).
• Analysts should subscribe to these reports to understand threat actor tactics and learn how to mitigate these attacks.

Security Blogs and Podcasts

• Another way to stay updated on threats is through blogs and podcasts.
• Blogs and podcasts provide advice, research, and mitigation techniques.
• Cisco provides security blogs and podcasts from experts and the Cisco Talos Group.
• Subscribe to receive notifications of new content, and podcasts can be played from the internet or downloaded.

Lab - Evaluate Cybersecurity Reports

• Lab objectives:
  • Part 1: Research Cyber Security Intelligence Reports
  • Part 2: Research Cyber Security Intelligence Based on Industry
  • Part 3: Research Cyber Security Threat Intelligence in Real Time

3.2 Threat Intelligence Services

• Threat intelligence services allow the exchange of threat information (vulnerabilities, IOCs, mitigation techniques) for personnel and security systems.
• As threats emerge, threat intelligence services create and distribute firewall rules and IOCs to subscribed devices.
• Cisco Talos Threat Intelligence Group is one such service.

Cisco Talos (cont.)

• Cisco Talos is a major commercial threat intelligence team comprised of experts and researchers.
• Its goal is to protect enterprise users, data, and infrastructure from active adversaries.
• The team collects information about active, existing, and emerging threats.
• It provides comprehensive protection (against attacks and malware) to subscribers.
• Cisco Security products can use real-time security solutions.
• It provides free software, services, resources, and data.
• It maintains security incident detection rule sets for Snort.org, ClamAV, and SpamCop network security tools.

FireEye

• FireEye offers security services using a three-pronged approach (security intelligence, expertise, technology).
• It provides SIEM and SOAR with the Helix Security Platform, leveraging behavioral analysis and threat detection.
• Helix is a cloud-hosted platform combining diverse security tools and threat intelligence.
• FireEye blocks attacks across web, and email vectors and latent malware.
• It addresses all stages of the attack lifecycle with a signatureless engine for zero-day threat detection.

Automated Indicator Sharing

• The U.S. Department of Homeland Security (DHS) offers a free service called Automated Indicator Sharing (AIS).
• Enables real-time exchange of cyber threat indicators (e.g., malicious IP addresses, phishing emails) between the U.S. Federal Government and the private sector.
• Creates an ecosystem where threats are immediately shared with the community for protection.

Common Vulnerabilities and Exposures (CVE) Database

• The United States government sponsored the MITRE Corporation to create and maintain a catalog of known security threats (CVE).
• The CVE serves as a dictionary for cybersecurity vulnerabilities, using unique CVE Identifiers to facilitate data sharing.

Threat Intelligence Communication Standards

• Network organizations and professionals share information to increase knowledge of threat actors and assets.
• Several open standards facilitate cross-platform communication.
• Three common standards are Structured Threat Information Expression (STIX), and Trusted Automated Exchange of Indicator Information (TAXII), and CybOX.
• STIX is used for exchanging threat information between organizations.
• TAXII facilitates the communication of CTI (Cyber Threat Intelligence) over HTTPS.
• CybOX specifies events and properties of network operations to support many cybersecurity functions.

Threat Intelligence Communication Standards (cont.)

• Open standards facilitate standardized cyber threat intelligence information exchange.
• The Malware Information Sharing Platform (MISP) is an open-source platform for sharing IOCs for newly discovered threats.
• MISP is supported by the EU and is used by over 6,000 organizations globally.
• MISP enables automated IOC sharing between people and machines using STIX and other export formats.

Threat Intelligence Platforms

• Multiple threat intelligence sources can be very time-consuming to access and use.
• Threat Intelligence Platforms (TIPs) centralize the collection of threat data from various sources and formats.
• Three main types of data are IOCs, TTPs, and reputation information for internet destinations/domains.
• TIPs aggregate and present threat intelligence data in a comprehensible and usable format.

Threat Intelligence Platforms (cont.)

• Organizations can contribute to threat intelligence by sharing intrusion data (typically automated).
• Threat intelligence services utilize subscriber data to keep current with emerging threats.
• Honeypots are simulated networks/servers that attract attackers.
• Gathering data from honeypots can be beneficial, but also presents potential risks.
• Cloud-hosted honeypots isolate them from production networks.

Lab – Identify Relevant Threat Intelligence

• Lab objectives:
  • Part 1: Research MITRE CVEs
  • Part 2: Access the MITRE ATT&CK Knowledge Base
  • Part 3: Investigate Potential Malware

3.3 Threat Intelligence Summary

• Many organizations provide network intelligence.
• Keep up-to-date on threats and continuously improve skills.
• Utilize resources like the Cisco Annual and Mid-Year Cybersecurity Reports.
• Use security blogs and podcasts for threat information.
• Threat intelligence services allow exchange of threat information among personnel and security systems.
• These services create firewall rules and IOCs as threats emerge.
• Cisco Talos and FireEye are examples of these services.
• FireEye uses a three-pronged approach combining security intelligence, expertise, and technology.
• The U.S. Department of Homeland Security offers Automated Indicator Sharing (AIS)
• The MITRE Corporation maintains a catalog of known vulnerabilities and exposures called CVE.
• STIX, TAXII, and CybOX are key threat intelligence communication standards.

What Did I Learn in this Module? (summary)

• Various organizations (SANS, Mitre, FIRST, etc.) provide network intelligence information.
• Stay updated on threats and continuously improve skills. (Use Cisco reports, blogs, and podcasts.)
• Threat intelligence services allow for sharing threat data between personnel and security systems.
• Services create and distribute firewall rules and IOCs for subscribed devices. (Cisco Talos, FireEye)
• FireEye uses a three-pronged approach.
• The U.S. Department of Homeland Security's Automated Indicator Sharing (AIS) enables real-time exchange of cyber threat indicators.
• Common Vulnerabilities and Exposures (CVE) catalog is maintained by MITRE.