First Step Guide for Building Cyber Threat Intelligence Team. Hitoshi ENDOH (NTT-CERT) Natsuko INUI (CDI-CIRT)



Similar documents
AT&T Global Network Client for Windows Product Support Matrix January 29, 2015

COMPARISON OF FIXED & VARIABLE RATES (25 YEARS) CHARTERED BANK ADMINISTERED INTEREST RATES - PRIME BUSINESS*

COMPARISON OF FIXED & VARIABLE RATES (25 YEARS) CHARTERED BANK ADMINISTERED INTEREST RATES - PRIME BUSINESS*

Analysis One Code Desc. Transaction Amount. Fiscal Period

Case 2:08-cv ABC-E Document 1-4 Filed 04/15/2008 Page 1 of 138. Exhibit 8

Enhanced Vessel Traffic Management System Booking Slots Available and Vessels Booked per Day From 12-JAN-2016 To 30-JUN-2017

Computing & Telecommunications Services Monthly Report March 2015

Deep Security/Intrusion Defense Firewall - IDS/IPS Coverage Statistics and Comparison

Centers of Academic Excellence in Cyber Security (CAE-C) Knowledge Units Review

Detailed guidance for employers

Ashley Institute of Training Schedule of VET Tuition Fees 2015

Deep Security Intrusion Detection & Prevention (IDS/IPS) Coverage Statistics and Comparison

CENTERPOINT ENERGY TEXARKANA SERVICE AREA GAS SUPPLY RATE (GSR) JULY Small Commercial Service (SCS-1) GSR

Accenture Cyber Security Transformation. October 2015

Menu Case Study 3: Medication Administration Record

Certification Programs

How To Understand The Third Platform Ct Market Transformation In Latin America

Deep Security Vulnerability Protection Summary

Protect Yourself in the Cloud Age

BCOE Payroll Calendar. Monday Tuesday Wednesday Thursday Friday Jun Jul Full Force Calc

EMC Software Release and Service Dates for NetWorker and NetWorker Modules Last Updated on February 21, 2013

Colorado s Accountable Care Collaborative

Release of the Draft Cybersecurity Procurement Language for Energy Delivery Systems

CAFIS REPORT

Consumer ID Theft Total Costs

Domain Name Abuse Detection. Liming Wang

P/T 2B: 2 nd Half of Term (8 weeks) Start: 25-AUG-2014 End: 19-OCT-2014 Start: 20-OCT-2014 End: 14-DEC-2014

P/T 2B: 2 nd Half of Term (8 weeks) Start: 26-AUG-2013 End: 20-OCT-2013 Start: 21-OCT-2013 End: 15-DEC-2013

P/T 2B: 2 nd Half of Term (8 weeks) Start: 24-AUG-2015 End: 18-OCT-2015 Start: 19-OCT-2015 End: 13-DEC-2015

Accident & Emergency Department Clinical Quality Indicators

Reacting to the Challenges: Business Strategies for Future Success. Todd S. Adams, Chief Executive Officer Adams Bank & Trust Ogallala, Nebraska

Measuring and Monitoring Customer Experience

Managing Projects with Practical Software & Systems Measurement PSM

Gilead Clinical Operations Risk Management Program

14-Dec-15. Number Amount Number Amount Number Amount Number Amount Number Amount

Manchester City Council Report for Information. Managing Attendance (Real Time Absence Reporting)

NICE and Framework Overview

Current counter-measures and responses by CERTs

WEATHERHEAD EXECUTIVE EDUCATION COURSE CATALOG

AUSTRALIAN ONLINE LANDSCAPE REVIEW MAY 2013

Stephen Doune HRIS Project Manager Plan International

The Latest Internet Threats to Affect Your Organisation. Tom Gillis SVP Worldwide Marketing IronPort Systems, Inc.

Cisco 4Q11. Global Threat Report

TERMS OF REFERENCE FOR THE HUMAN RESOURCES AND COMPENSATION COMMITTEE

Practical Threat Intelligence. with Bromium LAVA

Cisco & Big Data Security

The Five W's of SOC Operations. Kevin

Architectural Services Data Summary March 2011

Supervisor Instructions for Approving Web Time Entry

BEHIND UNDERSTANDING AND MANAGING. SaaS BUSINESSES. Recurly counts some of the world s most successful subscription businesses as its customers

Virtual Desktops Security Test Report

RBC Insurance Fetes Online Auto/Home Insurance Growth

NTT R&D s anti-malware technologies

PTC Creo 2.0 Hardware Support Dell

CHOOSE MY BEST PLAN OPTION (PLAN FINDER) INSTRUCTIONS

Enterprise Projects Fiscal Year 2011/2012 Third Quarter Report

2016 Examina on dates

NHS BLOOD AND TRANSPLANT MARCH 2009 RESPONDING EFFECTIVELY TO BLOOD DONOR FEEDBACK

PROJECT MANAGEMENT PLAN <PROJECT NAME>

Walton Centre. Document History Date Version Author Changes 01/10/ A Cobain L Wyatt. Monitoring & Audit

Symantec's Secret Sauce for Mobile Threat Protection. Jon Dreyfus, Ellen Linardi, Matthew Yeo

Worldwide Cellular Network Handset Tracking Report. Forecast Period:

EMPLOYER S LIABILITY CLAIMS

Media Planning. Marketing Communications 2002

2015 Examination dates

Dipl. Kfm. Mario Hose, CEO

ACCESS Nursing Programs Session 1 Center Valley Campus Only 8 Weeks Academic Calendar 8 Weeks

ACCESS Nursing Programs Session 1 Center Valley Campus Only 8 Weeks Academic Calendar 8 Weeks

Supplier Rating System

Sage ERP MAS 90, 200, 200 SQL, and Sage ERP MAS 500. Supported Versions

CMMI and KANBAN is it possible?

CQC Compliance Monitoring Framework

In accordance with risk management best practices, below describes the standard process for enterprise risk management (ERM), including:

AgriLife Information Technology IT General Session January 2010

Homeland Security Grants Management Louisiana Emergency Preparedness Association (LEPA)

adjust reports The Undead App Store A 2014 retrospective report on App Store performance

Resource Management Spreadsheet Capabilities. Stuart Dixon Resource Manager

Creating Interactive Online. Adult ESL Classes with Moodle. Deborah Gordon February Technology & Distance Learning Symposium

IR Best Practice & the Tools Needed to Achieve it

OPERATING FUND. PRELIMINARY & UNAUDITED FINANCIAL HIGHLIGHTS September 30, 2015 RENDELL L. JONES CHIEF FINANCIAL OFFICER

Effectiveness of BCM through Exercising

A!Team!Cymru!EIS!Report:!Growing!Exploitation!of!Small! OfCice!Routers!Creating!Serious!Risks!

Transcription:

First Step Guide for Building Cyber Threat Intelligence Team Hitoshi ENDOH (NTT-CERT) Natsuko INUI (CDI-CIRT)

Agenda About Us CDI-CIRT NTT-CERT Part 1 Cyber Threat Intelligence Team Building Basics Part 2 NTT-CERT s experience (case study) Part 3 Comparison of 2 Different Teams Summary

Agenda About Us CDI-CIRT NTT-CERT Part 1 Cyber Threat Intelligence Team Building Basics Part 2 NTT-CERT s experience (case study) Part 3 Comparison of 2 Different Teams Summary

About CDI-CIRT Cyber Defense Institute Cyber Incident Response Team Provides incident response services to clients and non-clients (private & public sector) Most activities are within Japan Cooperation with international organizations Contact us at cirt@cyberdefense.jp For more details, please visit us below, thanks! http://www.cirt.jp/

Who am I? What do I do? Natsuko Inui Chief Analyst @ Cyber Defense Institute Incident Response (Coordination) Cyber Exercises OSINT, Research Most work is with the Public Sector (Including Defense) Cleaning up after my boss

Cleaning up after my boss

Hobbies, loves Ducati Monster 696 Aella Slip-on Silencer Flute Started lessons again this year! Music (highly addicted) Classical to R&B to Heavy Metal

About NTT-CERT NTT is the biggest telecommunication company in Japan. (946 subsidiaries, 240k employees) NTT Group provides a lot of public services. Our constituency is NTT Group. POC of security matters related NTT Group. https://www.ntt cert.org/index en.html

Who am I? What do I do? Hitoshi Endoh Research Engineer @ NTT Secure Platform Labs. Cyber threat analysis OSINT, Research Community Activities(JNSA,NCA, etc.) JNSA: NPO Japan Network Security Association NCA: Nippon CSIRT Association

Agenda About Us CDI-CIRT NTT-CERT Part 1 Cyber Threat Intelligence Team Building Basics Part 2 NTT-CERT s experience (case study) Part 3 Comparison of 2 Different Teams Summary

The 3 Steps Back to the Basics Recognition Assessment Taking Action

Step 1. Recognition Situational Awareness Know your enemy Know thyself Lesson Learned No off-the-shelf solution Think!! Don t be lazy!! Attackers try too (Japan) Third party marunage

Step 2. Assessment Don t forget what you learned in the recognition phase Measure the risk(s) Where should sensors be implemented? Leveraging knowledge through discussions

Step 3. Taking Action Building the entire mechanism Framework System Human resources Operation Lessons Learned Aligning indicators, reading patterns Gathering information (FIRST members, blacklists, reports) Defining the roles of human resources

Agenda About Us CDI-CIRT NTT-CERT Part 1 Cyber Threat Intelligence Team Building Basics Part 2 NTT-CERT s experience (case study) Part 3 Comparison of 2 Different Teams Summary

NTT-CERT s experience (case study) Introduce NTT-CERT s Activities based on CDI s 3 steps Step 1. Recognition Step 2. Assessment Step 3. Taking Action Sharing OSINT information Lessons Learned

Step 1. Recognition Step 2. Assessment Proactive measures are very important. NTT Group provides national critical infrastructure of network communications. NTT-CERT needs Cyber Threat Intelligence Team. OSINT is suitable for us to collect information. Due to limitation of Japanese law, we can t use subsidiaries log data. OSINT is very useful to share (no confidential information).

Step 3. Taking Action in 2013 Jan. Feb. Mar. Apr. May. Jun. Jul. Aug. Sep. Oct. Nov. Dec. Team building Setting up, start daily work Training(next slide) Quarterly report(apr. Jun.) Start sharing information Quarterly report(jul. Sep.) Conference Speaker

Training by Senior Analyst, outside the company Benefit: Great skill up in the short term Valuable tools for collecting information and How to collect information safely Other useful tools and How to use them Methodology of making threat analysis, analyst report Improvement of expression ability Lessons Learned, Beneficial Know How

Daily Work 9:30 10:00 11:00 12:00 13:00 14:00 15:00 16:00 17:00 Collect articles Read articles, Summarize Sharing, discussion Detail analysis Tools evaluation Create reports etc.

Sharing OSINT information I don t know why. NTT CERT Oh, I got it!! Share Feedbacks Other CSIRTs It s a difference of perspective

L/L (1/4) OSINT Requirements Isolated Network from intranet Virtual PC and Resets every use Secure Browser with plug-ins (A lot of Japanese don t use plug-ins) Research tools (ex. Keeping source IP secret.)

L/L (2/4) Local Languages are very important Most detail information from local language Slang (Not in Dictionary, Rapid change) English Japanese Chinese Korean Russian Arabic Cyber Attack サイバー 攻 撃 网 络 攻 击 사이버 공격 кибератака ھجوم عبر االنترنت

L/L (3/4) Local languages are very important Machine Translation is not perfect. 軍 艦 巻 き Warship winding!? 軍 艦 巻 き is a kind of Sushi!

L/L(4/4) Facility World news programs with large screen televisions Notice a big news quickly Get latest topics and key words

Future work Sharing and Collaborating widely, Extending our knowledge Social Media Useful Tools Multilingual Imaginations(ex. Media literacy) (There is no Media literacy curriculum in Japanese school.)

Agenda About Us CDI-CIRT NTT-CERT Part 1 Cyber Threat Intelligence Team Building Basics Part 2 NTT-CERT s experience (case study) Part 3 Comparison of 2 Different Teams Summary

Comparison of 2 Different Teams Category of Business Vendor CDI CIRT NTT CERT Telecommunicati on Important thing Specialty Teamwork Position of the intelligence Constituency Cutting edge Client / Non Client (some exceptions) For proactive defense for NTT Group All Group Companies

Comparison of 2 Different Teams Relationships with other specialists Situation Awareness CDI CIRT NTT CERT By personal efforts By Team s activity IR itself Cyber Threat is global Shortage SOC Fixed members There are big differences between 2 companies same in Japan

Agenda About Us CDI-CIRT NTT-CERT Part 1 Cyber Threat Intelligence Team Building Basics Part 2 NTT-CERT s experience (case study) Part 3 Comparison of 2 Different Teams Summary

Summary No off-the-shelf solution for Cyber Threat Intelligence Team Think!! Don t be lazy!! CDI s 3 step methodology is useful for building the team

Thank you!