Theory and Practice of Cyber Threat-Intelligence Management Using STIX and CybOX Siemens AG All rights reserved
|
|
|
- Samantha Thomas
- 8 years ago
- Views:
Transcription
1 Bernd Grobauer Siemens CERT Theory and Practice of Cyber Threat-Intelligence Management Using STIX and CybOX
2 Siemens Core Topics Page 2
3 Siemens is a global company Page 3
4 Corporate Technology the center of Siemens research: 1,600 scientists, 4,400 software developers, and about 420 Intellectual Property experts Page 4
5 What we have been working towards for the past few years GOAL: We receive lot s and lot s of cyber threat intelligence based on STIX & CybOX Page 5
6 Exchange has taken off Now what? Page 6
7 Let s see! We receive lot s and lot s of cyber threat intelligence based on STIX & CybOX Page 7 Then a Miracle Occurs Analysts know what s important Detection tools know what to look for!
8 Reality? Analysts don t know what s important We receive lot s and lot s of cyber threat intelligence based on STIX & CybOX Page 8? Detection tools don t really know what to look for
9 What is the heart of the problem? Page 9
10 Drinking from a fire hose Source: Page 10
11 Detection: Finding the needle in the haystack Page 11
12 Detection with Cyber-Threat-Intelligence Sharing: The second-order haystack problem You need to find the needles that you need to find in your haystack Page 12
13 Detection with Cyber-Threat-Intelligence Sharing: The second-order haystack problem You need to be able to access all relevant needles almost instantly Page 13
14 What are essential ingredients of the miracle we are trying to work? Then a Miracle Occurs! Analysts know what s important We receive lot s and lot s of cyber threat intelligence based on STIX & CybOX Page 14 Detection tools know what to look for!
15 Two essential components for working the Cyber Threat Intelligence Miracle based on STIX/CybOX Page 15
16 STIX and CybOX from 10,000 feet Page 16
17 Cyber Observables Page 17
18 (Threat) Information Where we come from: In shared data, contextual information that supports a precise analysis of what is happening / has happened often was missing completely or provided rudimentary within a document that is only fit for human consumption (e.g., PDF report) Page 18
19 Threat Intelligence How confident am I, what stage of the killchain are we talking about, What kind of activity does this belong to? What is the attacker s modus operandi (tactics, techniques & procedures)? What was the asset, the impact, Who is behind it (and what are his motives?) What are the vulnerabilities the attacker exploits? How should / did we react? Source: Page 19
20 STIX and CybOX seen from 1 inch Page 20
21 Relationships and Facts in STIX/CybOX If you look at STIX and CybOX, you see that XML s hierarchical structure is used for two different purposes: modeling of containment relations between different objects Observable Event Action File structuring of facts Filename Filepath Hashes Hash Type Value MD5 6E48C3 Page 21
22 Example: A CybOX Observable XML Source Page 22
23 Example: Importing a CybOX 2.0 Observable XML Source: Focusing on objects and facts Observed event: An action that creates a file with certain file name, file path and hash Page 23
24 Example: A CybOX Observable XML Source Defining object boundaries In the XML, an identifier is provided for each structure that naturally gives rise to an information object of its own. Page 24
25 Example: A CybOX Observable XML Source Extracting flat facts from hierarchical XML The facts we are really interested into about the observed file are: Properties/File_Name = foobar.dll Properties/File_Path = C:\Windows\system32 Properties/Hashes/Hash/Type = MD5 Properties/Hashes/Hash/Simple_Hash_Value = 6E48C34D74A931EC2CE90ABD7DAC6A Page 25
26 Relationships and Facts in STIX/CybOX If you look at STIX and CybOX, you see that XML s hierarchical structure is used for two different purposes: modeling of containment relations between different objects Observable Event structuring of facts Filename Filepath Hashes Action Hash Type Value MD5 File 6E48C3 This leads to nodes and edges This leads to facts about a node Page 26
27 STIX/Cybox Graph: Example Page 27
28 STIX/Cybox Graph: Example Page 28
29 STIX/Cybox Graph: Example Page 29
30 STIX/CybOX node: example facts Page 30
31 Two essential components for working the Cyber Threat Intelligence Miracle based on STIX/CybOX Page 31
32 Two essential components for working the Cyber Threat Intelligence Miracle CORRELATION Page 32
33 So, how to solve the following? Page 33
34 How do we find out whether these two reports have anything in common with our other reports??? Page 34
35 So, how to solve the following? Page 35
36 STIX/CybOX add a layer of complexity regarding correlation E.g., Event 1 Event 2 Event n IP = Report 1 Report 2 Report 3 Indicator 1 Indicator 2 Indicator 3 IP = IP = IP = Page 36
37 A STIX/CybOX-specific motivation for correlation: Same observable information occurs in many different observables Page 37
38 Munich CERT has observed Page 38
39 Munich CERT has observed UID Namespace: munich.de Page 39
40 Washington D.C. CERT has observed , as well UID Namespace: dc.us Page 40
41 Hamburg CERT has also observed UID Namespace: hamburg.de Page 41
42 Further, Berlin CERT has observed UID Namespace: berlin.de Page 42
43 Further, Berlin CERT has a Sandbox that saw in five malware samplesb Page 43
44 So now we have seven observables that describe Page 44
45 For simple cases, you could avoid using several UIDs via a naming scheme that derives the UID from the primitive observable Page 45
46 So you can get rid of some observables Page 46
47 So we might as well forget about deterministic naming schemes Page 48
48 Most promissing approach for correlating reports: find correlations on STIX/CybOX entities and walk the graph Calculate upon import?? Page 49
49 Some examples of calculating the? Design of data model In Mantis, we exploit a feature of the mantis data model for carrying out correlation on fact level Use normalized basic indicators see second part of talk Machine learning approaches Basic idea: calculate similarity on STIX/CybOX entities Ongoing research with University of Göttingen Stay tuned Page 50
50 Facts as correlation basis If you look at STIX and CybOX, you see that XML s hierachical structure is used for two different purposes: modelling of containment relations between different objects Observable Event Action File This, MANTIS preserves description of facts Filename Filepath Hashes Hash Type Value MD5 6E48C3 This, MANTIS flattens into a list of fact term - value pairs... and deduplicates these facts Page 51
51 Example: A CybOX Observable XML Source Extracting flat facts from hierarchical XML The facts we are really interested into about the observed file are: Properties/File_Name = foobar.dll Properties/File_Path = C:\Windows\system32 Properties/Hashes/Hash/Type = MD5 Properties/Hashes/Hash/Simple_Hash_Value = 6E48C34D74A931EC2CE90ABD7DAC6A Page 52
52 Cybox 2.0 Observable Cybox 2.0 Observable Correlation by Facts using the MANTIS data model Info Object Fact 1 Fact n Info Object Fact 1 Fact n Properties/Hashes/Hash/SimpleHashValue=6E48C3 is shared between two different InfoObjects Page 53
53 A correlation graph view Page 54
54 Here, the algorithm found correlations between the report in question and another malware report Page 55
55 Detailed information is provided about what the relationship entails (which common facts were found in which sub objects of the related reports) Page 56
56 Detailed information is provided about what the relationship entails (which common facts were found in which sub objects of the related reports) Page 57 The fact Properties/File_Name = run.dat was found in descendant object such and such of STIX Package Analysis report. Telexcopy.exe the same fact is present in object so and so, which is a descendant of STIX Package Analysis report : telex.exe
57 In this case, the name of the malware binary already hinted at a possible relation, but for the really interesting cases, this is not the case Page 58
58 Possible pitfalls Page 59
59 Possible pitfalls Wow, this malware report has a relationship with a CISCP report!!! Wait a second this is my development system there should not be any CISCP reports on this system. Ahhh. it is the sample_report.xml that was sent around to demonstrate the STIX updates made in spring 2014 So what is the correlation here???? Certainly not the filename malicous.fil?!? Aha: da39a3ee5e6b4b0d3255bfef afd80709 is the SHA1 of an empty file Page 60
60 Two essential components for working the Cyber Threat Intelligence Miracle DERIVATION & RATING OF BASIC INDICATORS Page 61
61 Two essential components for working the Cyber Threat Intelligence Miracle DERIVATION & RATING OF BASIC INDICATORS Page 62
62 A rather easy, 1:1 mapping Page 63
63 A file object may contain several basic indicators Page 64
64 A file object may contain several basic indicators Page 65
65 Another example: an observed Page 66
66 Another example: an observed Page 67
67 Note: For CybOX observables, you can use the derived basic indicator(s) for correlation! Page 68
68 Derivation of possibly actionable indicators Processing each STIX/CybOX XML upon import yields a table of basic indicators that is fit for import into detection/prevention mechanisms. Page 69
69 How to get from possibly actionable indicators to indicators that make action worthwhile?? Processing each STIX/CybOX XML upon import yields a table of basic indicators that is fit for import into detection/prevention mechanisms. Page 70
70 Two essential components for working the Cyber Threat Intelligence Miracle DERIVATION & RATING OF ACTIONABLE INDICATORS Page 71
71 For rating a possible indicator, we need context Page 72
72 Possible sources of context: Within a report Who is the sender of the report? What contextual information does the STIX indicator yield? Kill chain Confidence Associated Campaign & Threat Actor Page 73
73 Possible sources of context: Between reports In which other reports does the basic indicator occur? Page 74
74 Rating basic indicators First component: Walk the graph TLP Confidence Kill Chain Campaign Threat Actor Amber High C&C World Domination Cunning Cricket Extract context information from STIX/CybOX content upon arrival of an import This requires walking the graph that is formed by the STIX report Codify context in a status information Page 75
75 Rating basic indicators Second component: Cumulative status & Status update upon new reports TLP Confidence Kill Chain Campaign Amber High C&C World Domination Page 76 Threat Actor TLP Confidence Kill Chain Campaign Threat Actor Cunning Cricket Amber High C&C World Domination Cunning Cricket + Min. TLP Max. TLP Min. Confidence Max. Confidence Kill Chain Campaigns Threat Actors Green Amber Low High C&C; Delivery World Domination, Gru s Plot Cunning Cricket,
76 Rating basic indicators Third component: Analysts input Page 77 + Min. TLP Max. TLP Min. Confidence Max. Confidence Kill Chain Campaigns Threat Actors Green Amber Low High C&C; Delivery World Domination, Gru s Plot Cunning Cricket,
77 Independent from CybOX/STIX: use additional data sources (OSINT, ) to support indicator rating OSINT, Page 78
78 Note: For CybOX observables, you can use the derived basic indicator(s) for correlation! Page 79
79 Note: For CybOX observables, you can use the derived basic indicator(s) for correlation! Page 80
80 Note: For CybOX observables, you can use the derived basic indicator(s) for correlation! Page 81
81 Note: For CybOX observables, you can use the derived basic indicator(s) for correlation! Page 82
82 By the way.. You can take a closer look into our cauldron: Central arts of Siemens threat-intelligence management framework MANTIS are available from Please make sure to use the development branch!!! Follow the instructions at Note: this is not a finished product (see next slide) Page 83
83 Caveat: What MANTIS is and isn t MANTIS is an alpha/early beta implementation of a framework for managing cyber threat intelligence expressed in standards such as STIX, CybOX, OpenIOC, IODEF, etc. Our aims of providing MANTIS as open source are: To aide discussions about tooling for emerging standards such as STIX, CybOX et al. To lower the entrance barrier for organizations and teams (esp. CERT teams) in using emerging standards for cyber-threat intelligence management and exchange. To provide a platform on the basis of which research and communitydriven development in the area of cyber-threat intelligence management can occur. MANTIS isn t a finished tool or project: we like to think that it provides a solid basis on which cyber-threat intelligence management can be built up upon, but if you expect something that out of the box covers all aspects of cyber-threat intelligence management or are unable/unwilling to dive into Django and Python code and fix/modify according to your requirements, MANTIS isn t for you. MANTIS (currently) isn t a tool fit for importing huge datasets or huge numbers of datasets. This situation may change at some point of time with more stream-lined importers, but MANTIS is really not intended to deal with very big data the way log management solutions are. Page 84
84 Summing up Threat-Intel exchange using STIX/CybOX has taken off Now we need to learn to drink from the fire hose Nature of STIX/CybOX adds requirements for correlation of reports extraction of basic indicators rating of indicators (partly) based on contextual information contained in STIX-portion of reports This talk has shown possible approaches Most likely, there are different approaches whatever tooling you use for dealing with STIX/CybOX: you cannot do without capabilities for correlation and indicator management Page 85
The MANTIS Framework Cyber-Threat Intelligence Mgmt. for CERTs Siemens AG 2014. All rights reserved
B. Grobauer, S.Berger, J. Göbel, T. Schreck, J. Wallinger Siemens CERT The MANTIS Framework Cyber-Threat Intelligence Mgmt. for CERTs Note MANTIS is available as Open Source under GPL v2+ from https://github.com/siemens/django-mantis
The MANTIS Framework Cyber-Threat Intelligence Mgmt. for CERTs Siemens AG 2014. All rights reserved
B. Grobauer, S.Berger, J. Göbel, T. Schreck, J. Wallinger Siemens CERT The MANTIS Framework Cyber-Threat Intelligence Mgmt. for CERTs Open Source solutions for Managing Cyber Threat Intelligence Fall 2012
The New ROI: Results Oriented Intel. David Amsler, Founder
The New ROI: Results Oriented Intel David Amsler, Founder Foreground Security Dedicated Security services firm Founded in 2000 with offices in Florida, Virginia, and Maryland Federal and commercial clients
Security Intelligence Services. www.kaspersky.com
Kaspersky Security Intelligence Services. Threat Intelligence Services www.kaspersky.com THREAT INTELLIGENCE SERVICES Tracking, analyzing, interpreting and mitigating constantly evolving IT security threats
Analytic and Predictive Modeling of Cyber Threat Entities J. Wesley Regian, Ph.D.
18th Annual Space & Missile Defense Symposium IAMD Evolution and Integration/Key Topic: Predictive Cyber Threat Analysis Analytic and Predictive Modeling of Cyber Threat Entities J. Wesley Regian, Ph.D.
Separating Signal from Noise: Taking Threat Intelligence to the Next Level
SESSION ID: SPO2-T09 Separating Signal from Noise: Taking Threat Intelligence to the Next Level Doron Shiloach X-Force Product Manager IBM @doronshiloach Agenda Threat Intelligence Overview Current Challenges
Threat Intelligence is Dead. Long Live Threat Intelligence!
SESSION ID: STR-R02 Threat Intelligence is Dead. Long Live Threat Intelligence! Mark Orlando Director of Cyber Operations Foreground Security Background Threat Intelligence is Dead. Long Live Threat Intelligence!
After the Attack: RSA's Security Operations Transformed
After the Attack: RSA's Security Operations Transformed Ben Smith, CISSP RSA Field CTO (East), Security Portfolio Senior Member, ISSA Northern Virginia 1 The Environment ~ 2,000 security devices ~55M security
SHARING THREAT INTELLIGENCE ANALYTICS FOR COLLABORATIVE ATTACK ANALYSIS
SHARING THREAT INTELLIGENCE ANALYTICS FOR COLLABORATIVE ATTACK ANALYSIS Samir Saklikar RSA, The Security Division of EMC Session ID: CLE T05 Session Classification: Intermediate Agenda Advanced Targeted
Unstructured Threat Intelligence Processing using NLP
Accenture Technology Labs Elvis Hovor @kofibaron Shimon Modi @shimonmodi Shaan Mulchandani @alabama_shaan Unstructured Threat Intelligence Processing using NLP Enhancing Cyber Security Operations by Automating
Anatomy of Cyber Threats, Vulnerabilities, and Attacks
Anatomy of Cyber Threats, Vulnerabilities, and Attacks ACTIONABLE THREAT INTELLIGENCE FROM ONTOLOGY-BASED ANALYTICS 1 Anatomy of Cyber Threats, Vulnerabilities, and Attacks Copyright 2015 Recorded Future,
Actionable information for security incident response
Actionable information for security incident response Cosmin Ciobanu 2015 European Union Agency for Network and Information Security www.enisa.europa.eu European Union Agency for Network and Information
Integrating a Big Data Platform into Government:
Integrating a Big Data Platform into Government: Drive Better Decisions for Policy and Program Outcomes John Haddad, Senior Director Product Marketing, Informatica Digital Government Institute s Government
Soltra edge open cyber intelligence platform report
Soltra edge open cyber intelligence platform report Prepared By: Alan Magar Sphyrna Security 340 Ridgeside Farm Drive Kanata, Ontario K2W 0A1 PWGSC Contract Number: W7714-08FE01/001/ST Task 33 CSA: Melanie
Analyzing Targeted Attacks through Hiryu An IOC Management and Visualization Tool. Hiroshi Soeda Incident Response Group, JPCERT/Coordination Center
Analyzing Targeted Attacks through Hiryu An IOC Management and Visualization Tool Hiroshi Soeda Incident Response Group, JPCERT/Coordination Center Agenda 1. Advanced attacks specifically targeting Japanese
Symantec Cyber Threat Analysis Program Program Overview. Symantec Cyber Threat Analysis Program Team
Symantec Cyber Threat Analysis Program Symantec Cyber Threat Analysis Program Team White Paper: Symantec Security Intelligence Services Symantec Cyber Threat Analysis Program Contents Overview...............................................................................................
Threat Intelligence: Friend of the Enterprise
SECURELY ENABLING BUSINESS Threat Intelligence: Friend of the Enterprise Danny Pickens Principal Intelligence Analyst MSS FishNet Security DANNY PICKENS Principal Intelligence Analyst, FishNet Security
Whitepaper. Advanced Threat Hunting with Carbon Black
Advanced Threat Hunting with Carbon Black TABLE OF CONTENTS Overview Threat Hunting Defined Existing Challenges and Solutions Prioritize Endpoint Data Collection Over Detection Leverage Comprehensive Threat
Covert Operations: Kill Chain Actions using Security Analytics
Covert Operations: Kill Chain Actions using Security Analytics Written by Aman Diwakar Twitter: https://twitter.com/ddos LinkedIn: http://www.linkedin.com/pub/aman-diwakar-ccie-cissp/5/217/4b7 In Special
Operational Lessons from the RSA/EMC CIRC: People, Process, & Threat Intel
Operational Lessons from the RSA/EMC CIRC: People, Process, & Threat Intel @Ben_Smith Ben Smith, CISSP Field CTO (US East), Security Portfolio A Security Maturity Path CONTROLS COMPLIANCE IT RISK BUSINESS
Eight Essential Elements for Effective Threat Intelligence Management May 2015
INTRODUCTION The most disruptive change to the IT security industry was ignited February 18, 2013 when a breach response company published the first research that pinned responsibility for Advanced Persistent
Threat Intelligence: The More You Know the Less Damage They Can Do. Charles Kolodgy Research VP, Security Products
Threat Intelligence: The More You Know the Less Damage They Can Do Charles Kolodgy Research VP, Security Products IDC Visit us at IDC.com and follow us on Twitter: @IDC 2 Agenda Evolving Threat Environment
All about Threat Central
All about Threat Central Ted Ross & Nadav Cohen #HPProtect Forward-looking statements This is a rolling (up to three year) Roadmap and is subject to change without notice. This document contains forward
Cloud and Critical Infrastructures how Cloud services are factored in from a risk perspective
Cloud and Critical Infrastructures how Cloud services are factored in from a risk perspective Reaching the Cloud era in the EU Riga 16 June 2015 Jonathan Sage Government and Regulatory Affairs Cyber Security
Malware isn t The only Threat on Your Endpoints
Malware isn t The only Threat on Your Endpoints Key Themes The cyber-threat landscape has Overview Cybersecurity has gained a much higher profile over the changed, and so have the past few years, thanks
Practical Threat Intelligence. with Bromium LAVA
Practical Threat Intelligence with Bromium LAVA Practical Threat Intelligence Executive Summary Threat intelligence today is costly and time consuming and does not always result in a reduction of successful
Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst Abstract: Large organizations have spent millions of dollars on security
Attackers are reusing attacks (because they work)
The Problem Attackers are reusing attacks (because they work) Defenders are collecting and/or sharing information, but Often a manual process (copy-paste from a PDF) Different sources provide different
Threat Intelligence. Benefits for the enterprise
Benefits for the enterprise Contents Introduction Threat intelligence: a maturing defence differentiator Understanding the types of threat intelligence: from the generic to the specific Deriving value
WHITE PAPER: THREAT INTELLIGENCE RANKING
WHITE PAPER: THREAT INTELLIGENCE RANKING SEPTEMBER 2015 2 HOW WELL DO YOU KNOW YOUR THREAT DATA? HOW THREAT INTELLIGENCE FEED MODELING CAN SAVE MONEY AND PREVENT BREACHES Who are the bad guys? What makes
Sophisticated Indicators for the Modern Threat Landscape: An Introduction to OpenIOC
WHITE PAPER Sophisticated Indicators for the Modern Threat Landscape: An Introduction to OpenIOC www.openioc.org OpenIOC 1 Table of Contents Introduction... 3 IOCs & OpenIOC... 4 IOC Functionality... 5
Advanced Visibility. Moving Beyond a Log Centric View. Matthew Gardiner, RSA & Richard Nichols, RSA
Advanced Visibility Moving Beyond a Log Centric View Matthew Gardiner, RSA & Richard Nichols, RSA 1 Security is getting measurability worse Percent of breaches where time to compromise (red)/time to Discovery
Intelligence Driven Intrusion Detection
Intelligence Driven Intrusion Detection Matthias Wübbeling: matthias.wuebbeling@cs.uni-bonn.de Arnold Sykosch: sykosch@cs.uni-bonn.de Friedrich-Wilhelms-Universität Bonn: Working Group IT Security Fraunhofer
WHEN THE HUNTER BECOMES THE HUNTED HUNTING DOWN BOTNETS USING NETWORK TRAFFIC ANALYSIS
WHEN THE HUNTER BECOMES THE HUNTED HUNTING DOWN BOTNETS USING NETWORK TRAFFIC ANALYSIS /ABOUT/ME Thomas Chopitea - Incident handler @CertSG Digital forensics & incident response (#DFIR), malware analysis,
Redefining SIEM to Real Time Security Intelligence
Redefining SIEM to Real Time Security Intelligence David Osborne Security Architect September 18, 2012 Its not paranoia if they really are out to get you Malware Malicious Insiders Exploited Vulnerabilities
EITC Lessons Learned: Building Our Internal Security Intelligence Capability
EITC Lessons Learned: Building Our Internal Security Intelligence Capability SESSION ID: SEC-W08 Tamer El Refaey Senior Director, Security Monitoring and Operations Emirates Integrated Telecommunications
Can We Become Resilient to Cyber Attacks?
Can We Become Resilient to Cyber Attacks? Nick Coleman, Global Head Cyber Security Intelligence Services December 2014 Can we become resilient National Security, Economic Espionage Nation-state actors,
Symantec Cyber Security Services: DeepSight Intelligence
Symantec Cyber Security Services: DeepSight Intelligence Actionable intelligence to get ahead of emerging threats Overview: Security Intelligence Companies face a rapidly evolving threat environment with
81% of participants believe the government should share more threat intelligence with the private sector.
Threat Intelligence Sharing & the Government s Role in It Results of a Survey at InfoSec 2015 Section 1 1.1 Executive summary The last few years has seen a rise in awareness regarding security breaches
Threat Intelligence Platforms: The New Essential Enterprise Software
Gitomer-1 Threat Intelligence Platforms: The New Essential Enterprise Software Due to the ever-increasing volume of cyber attacks and regulatory pressures, there is a need for a new type of enterprise
Threat Intelligence: STIX and Stones Will Break Your Foes
Copyright 2014 Splunk Inc. Threat Intelligence: STIX and Stones Will Break Your Foes Fred Wilmot Director, Global Security PracCce Brad Lindow a.k.a. Superman Global Security Strategist, Splunk Disclaimer
Threat Intelligence Buyer s Guide
Threat Intelligence Buyer s Guide SANS CTI Summit, 10 February 2014 Rick Holland @rickhholland Principal Analyst Last year 2014 Forrester Research, Inc. Reproduction Prohibited 2 This year, Arnold s back!!
Quality Over Quantity
Presented by Rod Rasmussen June 16, 2015 FIRST Conference, Berlin Quality Over Quantity CUTTING THROUGH CYBERTHREAT INTELLIGENCE NOISE Rod Rasmussen IID founder, CTO Co-chair Anti- Phishing Working Group
Concierge SIEM Reporting Overview
Concierge SIEM Reporting Overview Table of Contents Introduction... 2 Inventory View... 3 Internal Traffic View (IP Flow Data)... 4 External Traffic View (HTTP, SSL and DNS)... 5 Risk View (IPS Alerts
Standardizing Cyber Threat Intelligence Information with the Structured Threat Information expression (STIX )
THREAT-BASED DEFENSE Standardizing Cyber Threat Intelligence Information with the Structured Threat Information expression (STIX ) 2012. The MITRE Corporation. All rights reserved. IT IS BECOMING INCREASINGLY
Automate the Hunt. Rapid IOC Detection and Remediation WHITE PAPER WP-ATH-032015
Rapid IOC Detection and Remediation WP-ATH-032015 EXECUTIVE SUMMARY In the escalating war that is cyber crime, attackers keep upping their game. Their tools and techniques are both faster and stealthier
Evolution Of Cyber Threats & Defense Approaches
Evolution Of Cyber Threats & Defense Approaches Antony Abraham IT Architect, Information Security, State Farm Kevin McIntyre Tech Lead, Information Security, State Farm Agenda About State Farm Evolution
Applying Internal Traffic Models to Improve Identification of High Fidelity Cyber Security Events
Applying Internal Traffic Models to Improve Identification of High Fidelity Cyber Security Events Abstract Effective Security Operations throughout both DoD and industry are requiring and consuming unprecedented
ONLINE RECONNAISSANCE
ONLINE RECONNAISSANCE HOW YOUR INTERNET PROFILE CAN BE USED AGAINST YOU May 2013 Most people and organisations put information about themselves on the web. Companies advertise their work and achievements
Innovative Security for an Accelerating World New Approaches for Chief Security Officers
Information Systems Security Association Innovative Security for an Accelerating World New Approaches for Chief Security Officers John N. Stewart Senior Vice President Chief Security and Trust Officer
SQRRL ENTERPRISE Building the Modern Security Operations Center (SOC)
Target. Hunt. Disrupt. SQRRL ENTERPRISE Building the Modern Security Operations Center (SOC) WHAT ARE WE TALKING ABOUT TODAY? Who I Am Defining the SOC Functions of a SOC Do you even need a SOC? Organization
SOLUTION PRIMER. Rafal Los Director, Solutions Research Office of the CISO, Accuvant. James Robinson Director, Information Security, Accuvant
THREAT INTELLIGENCE Rafal Los Director, Solutions Research Office of the CISO, Accuvant James Robinson Director, Information Security, Accuvant Jason Clark Chief Strategy and Security Officer, Accuvant
Indexing Full Packet Capture Data With Flow
Indexing Full Packet Capture Data With Flow FloCon January 2011 Randy Heins Intelligence Systems Division Overview Full packet capture systems can offer a valuable service provided that they are: Retaining
Digital Forensic Techniques
Digital Forensic Techniques Namrata Choudhury, Sr. Principal Information Security Analyst, Symantec Corporation Professional Techniques T23 CRISC CGEIT CISM CISA AGENDA Computer Forensics vs. Digital Forensics
Visualization methods for patent data
Visualization methods for patent data Treparel 2013 Dr. Anton Heijs (CTO & Founder) Delft, The Netherlands Introduction Treparel can provide advanced visualizations for patent data. This document describes
Leveraging Global Threat Intelligence: Raising the Cost of Cyber-Warfare
SESSION ID: ECO-T09 Leveraging Global Threat Intelligence: Raising the Cost of Cyber-Warfare Dean Thompson (Dean.Thompson@anz.com) Senior Manager, Global Threat Intelligence & Advanced Response Australia
SORTING OUT YOUR SIEM STRATEGY:
SORTING OUT YOUR SIEM STRATEGY: FIVE-STEP GUIDE TO TO FULL SECURITY INFORMATION VISIBILITY AND CONTROLLED THREAT MANAGEMENT INTRODUCTION It s your business to know what is happening on your network. Visibility
Open Source Threat Intelligence. Kyle R Maxwell (@kylemaxwell) Senior Researcher, Verizon RISK Team
Open Source Threat Intelligence Kyle R Maxwell (@kylemaxwell) Senior Researcher, Verizon RISK Team 2 Before we begin All trademarks belong to their respective owners. No association with any other organizations,
HOW LOOKOUT S PREDICTIVE SECURITY UNMASKED A MOBILE THREAT
Mobile Threats MalApp HOW LOOKOUT S PREDICTIVE SECURITY UNMASKED A MOBILE THREAT Introduction To detect advanced threats that can evade signatures and behavioral analyses, Lookout developed a platform
A Primer on Cyber Threat Intelligence
A Primer on Cyber Threat Intelligence AS ADVERTISED 2 BUZZWORD BINGO! 3 TODAY S CYBER SECURITY CHALLENGES CISOs finding it difficult to define security ROI to executives Short shelf life for CISOs Vastly
Active Response: Automated Risk Reduction or Manual Action?
SESSION ID: CRWD-01 Active Response: Automated Risk Reduction or Manual Action? sec ops dream Monzy Merza Chief Security Evangelist Splunk @monzymerza Agenda Active Response Drivers Facets of Active Response
Sorting out SIEM strategy Five step guide to full security information visibility and controlled threat management
Sorting out SIEM strategy Five step guide to full security information visibility and controlled threat management This guide will show you how a properly implemented and managed SIEM solution can solve
The Path Ahead for Security Leaders
The Path Ahead for Security Leaders Executive Summary What You Will Learn If you asked security leaders five years ago what their primary focus was, you would likely get a resounding: securing our operations.
Data Mining in Incident Response Challenges and Opportunities
Data Mining in Incident Response Challenges and Opportunities Alexandre Dulaunoy - TLP:WHITE Information Security Education Day 1 of 22 CIRCL The Computer Incident Response Center Luxembourg (CIRCL) is
OpenTPX 2015 LookingGlass Cyber Solutions Inc.
OpenTPX v2.2 Oct 8 th 2015 LookingGlass Cyber Solutions PRESENTER: OpenTPX Contribution OpenTPX is a contribution by LookingGlass Cyber Solutions to the open source community 1 Specifications and source
An New Approach to Security. Chris Ellis McAfee Senior System Engineer Chris_Ellis@McAfee.com
An New Approach to Security Chris Ellis McAfee Senior System Engineer Chris_Ellis@McAfee.com Advanced Targeted Attack Challenges Criminal Theft Sabotage Espionage After the Fact Expensive Public Uncertainty
Windows Quick Start Guide for syslog-ng Premium Edition 5 LTS
Windows Quick Start Guide for syslog-ng Premium Edition 5 LTS November 19, 2015 Copyright 1996-2015 Balabit SA Table of Contents 1. Introduction... 3 1.1. Scope... 3 1.2. Supported platforms... 4 2. Installation...
The Advanced Attack Challenge. Creating a Government Private Threat Intelligence Cloud
The Advanced Attack Challenge Creating a Government Private Threat Intelligence Cloud The Advanced Attack Challenge One of the most prominent and advanced threats to government networks is advanced delivery
Cymon.io. Open Threat Intelligence. 29 October 2015 Copyright 2015 esentire, Inc. 1
Cymon.io Open Threat Intelligence 29 October 2015 Copyright 2015 esentire, Inc. 1 #> whoami» Roy Firestein» Senior Consultant» Doing Research & Development» Other work include:» docping.me» threatlab.io
ESG Brief. Overview. 2014 by The Enterprise Strategy Group, Inc. All Rights Reserved.
ESG Brief Webroot Delivers Enterprise-Class Threat Intelligence to Security Technology Providers and Large Organizations Date: September 2014 Author: Jon Oltsik, Senior Principal Analyst; Kyle Prigmore,
Discover & Investigate Advanced Threats. OVERVIEW
Discover & Investigate Advanced Threats. OVERVIEW HIGHLIGHTS Introducing RSA Security Analytics, Providing: Security monitoring Incident investigation Compliance reporting Providing Big Data Security Analytics
You ll learn about our roadmap across the Symantec email and gateway security offerings.
#SymVisionEmea In this session you will hear how Symantec continues to focus our comprehensive security expertise, global intelligence and portfolio on giving organizations proactive, targeted attack protection
Harnessing Intelligence from Malware Repositories
Harnessing Intelligence from Malware Repositories Arun Lakhotia and Vivek Notani Software Research Lab University of Louisiana at Lafayette arun@louisiana.edu, vxn4849@louisiana.edu 7/22/2015 (C) 2015
Attack Intelligence: Why It Matters
Attack Intelligence: Why It Matters WHITE PAPER Core Security +1 617.399-6980 info@coresecurity.com www.coresecurity.com A Proactive Strategy Attacks against your organization are more prevalent than ever,
Next-Generation Penetration Testing. Benjamin Mossé, MD, Mossé Security
Next-Generation Penetration Testing Benjamin Mossé, MD, Mossé Security About Me Managing Director of Mossé Security Creator of an Mossé Cyber Security Institute - in Melbourne +30,000 machines compromised
Sharing Intelligence is our Best Defense: Cyber Security Today Is a bit Like the Keystone Cops
Sharing Intelligence is our Best Defense: Incentives That Work versus Disincentives That Can Be Solved William Yurcik* Adam Slagell Jun Wang NCSA Security Research (NCSA) University of Illinois at Urbana-Champaign
Detect & Investigate Threats. OVERVIEW
Detect & Investigate Threats. OVERVIEW HIGHLIGHTS Introducing RSA Security Analytics, Providing: Security monitoring Incident investigation Compliance reporting Providing Big Data Security Analytics Enterprise-wide
Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: APTs first came on the scene in 2010, creating a wave
Fidelis XPS Tech Talk: Preventing Cyber Attacks With Real-Time Threat Intelligence. June 2010 Version 1.0 PAGE 1 PAGE 1
Fidelis XPS Tech Talk: Preventing Cyber Attacks With Real-Time Threat Intelligence June 2010 Version 1.0 PAGE 1 PAGE 1 Contents Introduction... 3 Fidelis XPS Feed Manager... 4 Fidelis XPS Policy: A Primer...
A Funny Thing Happened On The Way To OASIS: From Specifications to Standards
A Funny Thing Happened On The Way To OASIS: From Specifications to Standards Tom Millar Chief of Communications, US-CERT FIRST Berlin, June 18 th, 2015 Disclaimer This presentation is intended for informational
Who s Using Cyberthreat Intelligence and How?
Who s Using Cyberthreat Intelligence and How? A SANS Survey Written by Dave Shackleford Advisor: Stephen Northcutt February 2015 Sponsored by BeyondTrust 2015 SANS Institute Introduction Threat Intelligence
THE EVOLUTION OF SIEM
THE EVOLUTION OF SIEM WHY IT IS CRITICAL TO MOVE BEYOND LOGS Despite increasing investments in security, breaches are still occurring at an alarming rate. 43% Traditional SIEMs have not evolved to meet
Cyber Situational Awareness for Enterprise Security
Cyber Situational Awareness for Enterprise Security Tzvi Kasten AVP, Business Development Biju Varghese Director, Engineering Sudhir Garg Technical Architect The security world is changing as the nature
CYBER SCIENCE 2015 AN ANALYSIS OF NETWORK TRAFFIC CLASSIFICATION FOR BOTNET DETECTION
CYBER SCIENCE 2015 AN ANALYSIS OF NETWORK TRAFFIC CLASSIFICATION FOR BOTNET DETECTION MATIJA STEVANOVIC PhD Student JENS MYRUP PEDERSEN Associate Professor Department of Electronic Systems Aalborg University,
Threat Intelligence: What is it, and How Can it Protect You from Today s Advanced Cyber-Attacks A Webroot publication featuring analyst research
Threat Intelligence: What is it, and How Can it Protect You from Today s Advanced Cyber-Attacks A Webroot publication featuring analyst research 2 3 6 7 9 9 Issue 1 Welcome From the Gartner Files Definition:
Applying machine learning techniques to achieve resilient, accurate, high-speed malware detection
White Paper: Applying machine learning techniques to achieve resilient, accurate, high-speed malware detection Prepared by: Northrop Grumman Corporation Information Systems Sector Cyber Solutions Division
Combating a new generation of cybercriminal with in-depth security monitoring
Cybersecurity Services Combating a new generation of cybercriminal with in-depth security monitoring 1 st Advanced Data Analysis Security Operation Center The Challenge Don t leave your systems unmonitored.
White Paper: Leveraging Web Intelligence to Enhance Cyber Security
White Paper: Leveraging Web Intelligence to Enhance Cyber Security October 2013 Inside: New context on Web Intelligence The need for external data in enterprise context Making better use of web intelligence
Cyber Security Summit 2015
Cyber Security Summit 2015 Threat Intelligence 101: Introduction and Foundations Matthew J. Harmon IT Risk Limited, LLC Matthew J. Harmon IT Risk Limited, Principal Consultant DFIR, Pen Testing, Risk Management,
White. Paper. Rethinking Endpoint Security. February 2015
White Paper Rethinking Endpoint Security By Jon OItsik, Senior Principal Analyst With Kyle Prigmore, Associate Analyst February 2015 This ESG White Paper was commissioned by RSA Security and is distributed
The Landscape of Cyber, critical infrastructure and how Regulation fits in
The Landscape of Cyber, critical infrastructure and how Regulation fits in National Security and Critical infrastructure: New Perspectives for Private-Public Cooperation, Madrid, April 14th Jonathan Sage
Memory Forensics & Security Analytics: Detecting Unknown Malware
Memory Forensics & Security Analytics: Detecting Unknown Malware SESSION ID: SEC-T09 Fahad Ehsan Associate Director Security Research and Analytics UBS AG Where it all started. ------------------------------------------------------------------------------------------
From Threat Intelligence to Defense Cleverness: A Data Science Approach (#tidatasci)
From Threat Intelligence to Defense Cleverness: A Data Science Approach (#tidatasci) Alex Pinto Chief Data Scientist Niddel / MLSec Project @alexcpsec @MLSecProject () { :; }; whoami Alex Pinto That guy
ProtectWise: Shifting Network Security to the Cloud Date: March 2015 Author: Tony Palmer, Senior Lab Analyst and Aviv Kaufmann, Lab Analyst
ESG Lab Spotlight ProtectWise: Shifting Network Security to the Cloud Date: March 2015 Author: Tony Palmer, Senior Lab Analyst and Aviv Kaufmann, Lab Analyst Abstract: This ESG Lab Spotlight examines the
Rethinking Information Security for Advanced Threats. CEB Information Risk Leadership Council
Rethinking Information Security for Advanced Threats CEB Information Risk Leadership Council Advanced threats differ from conventional security threats along many dimensions, making them much more difficult
A White Paper from AccessData Group. Cerberus. Malware Triage and Analysis
A White Paper from AccessData Group Cerberus Malware Triage and Analysis What is Cerberus? Cerberus is the first-ever automated reverse engineering tool designed to show a security analyst precisely what
The Role of Threat Intelligence and Layered Security for Intrusion Prevention in the Post-Target Breach Era
The Role of Threat Intelligence and Layered Security for Intrusion Prevention in the Post-Target Breach Era Dave Plzak Security Evangelist Sentinel IPS davep@econet.com * Agenda Review of the current Network
Fostering Incident Response and Digital Forensics Research
Fostering Incident Response and Digital Forensics Research Bruce J. Nikkel bruce.nikkel@ubs.com September 8, 2014 Abstract This article highlights different incident response topics with a focus on digital
Advanced Persistent Threats
Emilio Tonelli Senior Sales Engineer South Europe WatchGuard Technologies, Inc. Advanced Persistent Threats the new security challenge Are you protected? Current Threat Landscape 2 Global Threat Landscape: