SlideShare uma empresa Scribd logo

Sharing is Caring: Medindo a Eficácia de Comunidades de Compartilhamento de Threat Intelligence

•Transferir como PPTX, PDF•
•
Alexandre Sieira
Alexandre Sieira

O compartilhamento de threat intelligence está subindo na lista de prioridades da maioria das grandes organizações. Muitas áreas de segurança estão sendo cobradas para consumir estas informações sem necessariamente ter processos implementados para usá-las. Junte-se a nós nesta apresentação para uma exploração baseada em dados quantitativos sobre práticas e comunidades de compartilhamento de threat intelligence. Nosso objetivo é demonstrar o que deve ser feito para que o compartilhamento de threat intelligence possa escalar além das barreiras técnicas e de confiança que atualmente atuam como fortes limitadores. Esta é mais uma apresentação da série Data-Driven Threat Intelligence. Na Mind The Sec do ano passado, apresentamos ferramentas e metodologias que permitiam a análise quantitativa de fontes individuais de threat intelligence, em especial feeds abertos e pagos, além de uma análise crítica em cima dos resultados baseados em um grande conjunto de indicadores coletados por nós. Este ano, o objetivo é estender estas ferramentas e metodologias para medir e analisar a eficácia, benefícios e barreiras associadas ao uso de comunidades de compartilhamento de threat intelligence, que estão proliferando mundialmente em diversas verticais do mercado.

Tecnologia
1 de 49
SHARING IS CARING: MEDINDO A EFICÁCIA DE COMUNIDADES DE COMPARTILHAMENTO DE THREAT INTELLIGENCE (#DDTI) Alexandre Sieira CTO da Niddel @AlexandreSieira @NiddelCorp
• Previously on #ddti • Challenges at TI Sharing • Measuring TI Sharing • The Future of Sharing Agenda
This is a data-driven talk! Please check your anecdotes at the door
Data-Driven Threat Intelligence
Previously on #ddti • Useful Methods and Measurements for Handling Indicators • Analysis of Threat Intelligence Feeds • Indirectly, a methodology for analyzing TI Providers • Combine (https://github.com/mlsecproject/combine) • Gathers TI data (ip/host) from Internet and local files • TIQ-Test (https://github.com/mlsecproject/tiq-test) • Runs statistical summaries and tests on TI feeds
TIQ-TEST - Tons of Threat-y Tests • NOVELTY – How often do the feeds update themselves? • AGING – How long does an indicator sit on a feed? • POPULATION – How does this population distribution compare to my data? • OVERLAP – How do the indicators compare to the ones you got? • UNIQUENESS – How many indicators are found only on one feed? Putting this threat intel data to work
Overlap Test - Outbound
I hate quoting myself, but…
Key Takeaway #1 Threat Intelligence Indicator Feeds Threat Intelligence Program MORE != BETTER
Constructive Feedback from the Internet: “TI Sharing is TOTALLY going to solve this” Right, folks? Right?
TI Sharing Solution Plan: 1. The best Threat Intelligence is the one that you analyze from your own incidents (homegrown / organic intelligence) 2. There is strength in numbers – vertical herd immunity! 3. ???????? 4. PROFIT!! (or at least SECURITY!!) Or at least a rough strawman
If CONSUMING is for the 1%, what is the percentage of organizations able to PRODUCE? Issue 1 - BYOTI
Issue 2 - Herd Immunity Source: www.vaccines.gov • We may be able to detect more ”virus strains” together but we are *terrible* at inoculation. • The things we detect the most mutate too fast (Pyramid of Pain) • Who didn’t get immunized, still gets sick (FOMO-TI)
Issue ? - What are we sharing • AUTOMATION-DRIVEN (PLATFORMS) • Straight to the point IOC sharing • ANALYST-DRIVEN (COMMUNITIES) • Strategic data, best practices, unstructured IOCs • ”Analyst-driven” has been around forever (in non-IC, at least since FS-ISAC was created) • The same people who bash ”just IOC sharing”: • Bash STIX/TAXII for trying to encode complexity • Tells everyone it is IMPOSSIBLE to hire analysts
The Cognitive Dissonances of TI Sharing Everybody should share! The CIRCLE OF TRUST
Do you trust the group enough to consume? The Two Sides of the Trust Coin Do you trust the group enough to share?
Okay, I’ll bite Can we measure our current sharing platforms communities?
Threat Intelligence Sharing We would like to thank the kind contribution of data from the fine folks at Facebook ThreatExchange and ThreatConnect … and also the sharing communities that chose to remain anonymous. You know who you are, and we ❤ you too.
Sharing Communities ARE Social Networks Social Network Selfie Sharing Community Selfie
Let’s look at the indicators first Using TIQ-TEST Overlap and Uniqueness tests
UNIQUENESS SLIDE Looks like we would get similar quality on a ”good” Threat Intelligence Sharing Community as we would on a ”paid feed"
Suggested Metrics for Sharing • ACTIVITY – How many indicators / posts are being shared day by day? • DIVERSITY – What is the percentage of the population that is actively sharing? • FEEDBACK – Are orgs collaborating on improving the knowledge in the sharing environment? • TRUST – How much data is shared ”openly” in relation to ”privately”? Looking for healthy dynamics
Activity Metric Is there any actual sharing going on?
Less data / Delays More data / Timely Large Group is roughly 40x bigger than Small Group
Organizations are less likely to share if they perceive they ”lost control” of who can consume.
Diversity Metric Check your sharing privilege
Roughly 10% of the organizations share data into the community
Some organizations are clearly in a better position operationally and legally to share. And that is expected due to our premises.
Feedback Metric But is the data any good?
🙀 I’m sure we can do better than this 🙀
Feedback Metric • Almost no support on automation-driven platforms • Some allow you to leave ”comments” or ”new descriptors” for the IOCs – even by counting those very low % in relation to new shared data • Analyst-driven environments allow for collaboration on e- mails and forum posts to describe and refine strategies and best practices. How can we make this collaboration work on automation-driven platforms?
Trust Metric Are we helping all the community or just a few orgs at a time?
76%. Again, sounds about right
Overall ”quality” of data goes up too!
Trust Metric • The rough estimate seems to be that more than 80% of ”sharing” (IOCs, messages, etc) happens in ”private groups” inside the infrastructure of the sharing platform • All communities have them: • Part of the DNA of the IC / cleared community • Offsets the trust equation, but defeats the ”herd immunity” argument • Usually MANDATORY on collaboration with LEA But then the ”good” data is not helping ”the community”! Is there any way we can reconcile?
The Future of Sharing 🔮 At the very least my humble opinion
#squadgoals Increase the TRUST among peers Reduce the TECHNICAL BARRIER for sharing useful information
TRUST: Reputation and Anonymity
AlienVault OTX clearly got the memo
TRUST: Anonymity + Good Curation Some sharing communities accept anonymous submissions that they then curate and disseminate to all organizations
IOCs Feedback TelemetryLESS MATURE MORE MATURE With ❤ and apologies to @DavidJBianco TECHNICAL BARRIER: ”Pyramid of Sharing”
Takeaways • Intelligence Sharing is a very analyst-centric activity that we have been tasked with scaling out with automation. No wonder it seems so hard. • Data can be as good as a paid feed, but you have to be in the right circles of trust • Does not solve analyst shortage and making the indicators / strategies operational into your environment
Thanks! • Q&A? • Feedback! ”The measure of intelligence is the ability to change." - Albert Alexandre Sieira @AlexandreSieira @MLSecProject / @NiddelCorp

Recomendados

Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightHostway|HOSTING
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Mark Arena
 
The Diamond Model for Intrusion Analysis - Threat Intelligence
The Diamond Model for Intrusion Analysis - Threat IntelligenceThe Diamond Model for Intrusion Analysis - Threat Intelligence
The Diamond Model for Intrusion Analysis - Threat IntelligenceThreatConnect
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingDhruv Majumdar
 
Building a Successful Threat Hunting Program
Building a Successful Threat Hunting ProgramBuilding a Successful Threat Hunting Program
Building a Successful Threat Hunting ProgramCarl C. Manion
 
CTI ANT: Hunting for Chinese Threat Intelligence
CTI ANT: Hunting for Chinese Threat IntelligenceCTI ANT: Hunting for Chinese Threat Intelligence
CTI ANT: Hunting for Chinese Threat IntelligenceJacklynTsai
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonBen Boyd
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 

Recomendados

Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightHostway|HOSTING
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Mark Arena
 
The Diamond Model for Intrusion Analysis - Threat Intelligence
The Diamond Model for Intrusion Analysis - Threat IntelligenceThe Diamond Model for Intrusion Analysis - Threat Intelligence
The Diamond Model for Intrusion Analysis - Threat IntelligenceThreatConnect
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingDhruv Majumdar
 
Building a Successful Threat Hunting Program
Building a Successful Threat Hunting ProgramBuilding a Successful Threat Hunting Program
Building a Successful Threat Hunting ProgramCarl C. Manion
 
CTI ANT: Hunting for Chinese Threat Intelligence
CTI ANT: Hunting for Chinese Threat IntelligenceCTI ANT: Hunting for Chinese Threat Intelligence
CTI ANT: Hunting for Chinese Threat IntelligenceJacklynTsai
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonBen Boyd
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceVishal Kumar
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat IntelligenceDeepak Kumar (D3)
 
Threat Hunting 101: Intro to Threat Detection and Incident Response
Threat Hunting 101: Intro to Threat Detection and Incident ResponseThreat Hunting 101: Intro to Threat Detection and Incident Response
Threat Hunting 101: Intro to Threat Detection and Incident ResponseInfocyte
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightDeep Shankar Yadav
 
Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?Raffael Marty
 
Crowd-Sourced Threat Intelligence
Crowd-Sourced Threat IntelligenceCrowd-Sourced Threat Intelligence
Crowd-Sourced Threat IntelligenceAlienVault
 
SIEM and Threat Hunting
SIEM and Threat HuntingSIEM and Threat Hunting
SIEM and Threat Huntingn|u - The Open Security Community
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat IntelligenceMarlabs
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityPanda Security
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE - ATT&CKcon
 
Technical track chris calvert-1 30 pm-issa conference-calvert
Technical track chris calvert-1 30 pm-issa conference-calvertTechnical track chris calvert-1 30 pm-issa conference-calvert
Technical track chris calvert-1 30 pm-issa conference-calvertISSA LA
 
Telesoft Cyber Threat Hunting Infographic
Telesoft Cyber Threat Hunting InfographicTelesoft Cyber Threat Hunting Infographic
Telesoft Cyber Threat Hunting InfographicSarah Chandley
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghOWASP Delhi
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence WorkshopPriyanka Aash
 
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, DohaGCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, DohaSyed Peer
 
IOCs Are Dead—Long Live IOCs!
IOCs Are Dead—Long Live IOCs!IOCs Are Dead—Long Live IOCs!
IOCs Are Dead—Long Live IOCs!Priyanka Aash
 
Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014
Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014
Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014Santiago Bassett
 
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...MITRE - ATT&CKcon
 
Careers in Cyber Security
Careers in Cyber SecurityCareers in Cyber Security
Careers in Cyber SecurityDeep Shankar Yadav
 
The Business Benefits of Threat Intelligence Webinar
The Business Benefits of Threat Intelligence WebinarThe Business Benefits of Threat Intelligence Webinar
The Business Benefits of Threat Intelligence WebinarThreatConnect
 
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...Alex Pinto
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 

Mais conteúdo relacionado

Mais procurados

Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceVishal Kumar
 
Threat Hunting 101: Intro to Threat Detection and Incident Response
Threat Hunting 101: Intro to Threat Detection and Incident ResponseThreat Hunting 101: Intro to Threat Detection and Incident Response
Threat Hunting 101: Intro to Threat Detection and Incident ResponseInfocyte
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightDeep Shankar Yadav
 
Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?Raffael Marty
 
Crowd-Sourced Threat Intelligence
Crowd-Sourced Threat IntelligenceCrowd-Sourced Threat Intelligence
Crowd-Sourced Threat IntelligenceAlienVault
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat IntelligenceMarlabs
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityPanda Security
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE - ATT&CKcon
 
Technical track chris calvert-1 30 pm-issa conference-calvert
Technical track chris calvert-1 30 pm-issa conference-calvertTechnical track chris calvert-1 30 pm-issa conference-calvert
Technical track chris calvert-1 30 pm-issa conference-calvertISSA LA
 
Telesoft Cyber Threat Hunting Infographic
Telesoft Cyber Threat Hunting InfographicTelesoft Cyber Threat Hunting Infographic
Telesoft Cyber Threat Hunting InfographicSarah Chandley
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghOWASP Delhi
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence WorkshopPriyanka Aash
 
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, DohaGCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, DohaSyed Peer
 
IOCs Are Dead—Long Live IOCs!
IOCs Are Dead—Long Live IOCs!IOCs Are Dead—Long Live IOCs!
IOCs Are Dead—Long Live IOCs!Priyanka Aash
 
Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014
Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014
Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014Santiago Bassett
 
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...MITRE - ATT&CKcon
 
The Business Benefits of Threat Intelligence Webinar
The Business Benefits of Threat Intelligence WebinarThe Business Benefits of Threat Intelligence Webinar
The Business Benefits of Threat Intelligence WebinarThreatConnect
 

Mais procurados (20)

Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement Matrice
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat Intelligence
 
Threat Hunting 101: Intro to Threat Detection and Incident Response
Threat Hunting 101: Intro to Threat Detection and Incident ResponseThreat Hunting 101: Intro to Threat Detection and Incident Response
Threat Hunting 101: Intro to Threat Detection and Incident Response
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to Insight
 
Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?Artificial Intelligence – Time Bomb or The Promised Land?
Artificial Intelligence – Time Bomb or The Promised Land?
 
Crowd-Sourced Threat Intelligence
Crowd-Sourced Threat IntelligenceCrowd-Sourced Threat Intelligence
Crowd-Sourced Threat Intelligence
 
SIEM and Threat Hunting
SIEM and Threat HuntingSIEM and Threat Hunting
SIEM and Threat Hunting
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda Security
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
 
Technical track chris calvert-1 30 pm-issa conference-calvert
Technical track chris calvert-1 30 pm-issa conference-calvertTechnical track chris calvert-1 30 pm-issa conference-calvert
Technical track chris calvert-1 30 pm-issa conference-calvert
 
Telesoft Cyber Threat Hunting Infographic
Telesoft Cyber Threat Hunting InfographicTelesoft Cyber Threat Hunting Infographic
Telesoft Cyber Threat Hunting Infographic
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
 
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, DohaGCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
 
IOCs Are Dead—Long Live IOCs!
IOCs Are Dead—Long Live IOCs!IOCs Are Dead—Long Live IOCs!
IOCs Are Dead—Long Live IOCs!
 
Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014
Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014
Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014
 
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
 
Careers in Cyber Security
Careers in Cyber SecurityCareers in Cyber Security
Careers in Cyber Security
 
The Business Benefits of Threat Intelligence Webinar
The Business Benefits of Threat Intelligence WebinarThe Business Benefits of Threat Intelligence Webinar
The Business Benefits of Threat Intelligence Webinar
 

Semelhante a Sharing is Caring: Medindo a Eficácia de Comunidades de Compartilhamento de Threat Intelligence

Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...Alex Pinto
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...
Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...
Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...Alexandre Sieira
 
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and SharingData-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and SharingAlex Pinto
 
CansecWest2019: Infosec Frameworks for Misinformation
CansecWest2019: Infosec Frameworks for MisinformationCansecWest2019: Infosec Frameworks for Misinformation
CansecWest2019: Infosec Frameworks for Misinformationbodaceacat
 
Terp breuer misinfosecframeworks_cansecwest2019
Terp breuer misinfosecframeworks_cansecwest2019Terp breuer misinfosecframeworks_cansecwest2019
Terp breuer misinfosecframeworks_cansecwest2019bodaceacat
 
Misinfosec frameworks Cansecwest 2019
Misinfosec frameworks Cansecwest 2019Misinfosec frameworks Cansecwest 2019
Misinfosec frameworks Cansecwest 2019bodaceacat
 
AI and the Researcher: ChatGPT and DALL-E in Scholarly Writing and Publishing
AI and the Researcher: ChatGPT and DALL-E in Scholarly Writing and PublishingAI and the Researcher: ChatGPT and DALL-E in Scholarly Writing and Publishing
AI and the Researcher: ChatGPT and DALL-E in Scholarly Writing and PublishingErin Owens
 
2021-02-10_CogSecCollab_UBerkeley
2021-02-10_CogSecCollab_UBerkeley2021-02-10_CogSecCollab_UBerkeley
2021-02-10_CogSecCollab_UBerkeleySara-Jayne Terp
 
Distributed defense against disinformation: disinformation risk management an...
Distributed defense against disinformation: disinformation risk management an...Distributed defense against disinformation: disinformation risk management an...
Distributed defense against disinformation: disinformation risk management an...Sara-Jayne Terp
 
Are You Listening? Real time data and social media
Are You Listening? Real time data and social mediaAre You Listening? Real time data and social media
Are You Listening? Real time data and social mediaAndrew Walker
 
Are you listening? Real Time Measurement and Monitoring
Are you listening? Real Time Measurement and MonitoringAre you listening? Real Time Measurement and Monitoring
Are you listening? Real Time Measurement and MonitoringKlaxon
 
You Give Us The Fire We'll Give'em Hell!
You Give Us The Fire We'll Give'em Hell!You Give Us The Fire We'll Give'em Hell!
You Give Us The Fire We'll Give'em Hell!wmetcalf
 
Social engineering
Social engineeringSocial engineering
Social engineeringRobert Hood
 
20240104 HICSS Panel on AI and Legal Ethical 20240103 v7.pptx
20240104 HICSS Panel on AI and Legal Ethical 20240103 v7.pptx20240104 HICSS Panel on AI and Legal Ethical 20240103 v7.pptx
20240104 HICSS Panel on AI and Legal Ethical 20240103 v7.pptxISSIP
 
Enterprise Search and Findability in 2013
Enterprise Search and Findability in 2013Enterprise Search and Findability in 2013
Enterprise Search and Findability in 2013Findwise
 
Dashboards are Dumb Data - Why Smart Analytics Will Kill Your KPIs
Dashboards are Dumb Data - Why Smart Analytics Will Kill Your KPIsDashboards are Dumb Data - Why Smart Analytics Will Kill Your KPIs
Dashboards are Dumb Data - Why Smart Analytics Will Kill Your KPIsLuciano Pesci, PhD
 
The Journey to DevSecOps
The Journey to DevSecOpsThe Journey to DevSecOps
The Journey to DevSecOpsShannon Lietz
 

Semelhante a Sharing is Caring: Medindo a Eficácia de Comunidades de Compartilhamento de Threat Intelligence (20)

Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
Determining the Fit and Impact of CTI Indicators on Your Monitoring Pipeline ...
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - Submitted
 
Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...
Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...
Threat Intelligence Baseada em Dados: Métricas de Disseminação e Compartilham...
 
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and SharingData-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
 
CansecWest2019: Infosec Frameworks for Misinformation
CansecWest2019: Infosec Frameworks for MisinformationCansecWest2019: Infosec Frameworks for Misinformation
CansecWest2019: Infosec Frameworks for Misinformation
 
Terp breuer misinfosecframeworks_cansecwest2019
Terp breuer misinfosecframeworks_cansecwest2019Terp breuer misinfosecframeworks_cansecwest2019
Terp breuer misinfosecframeworks_cansecwest2019
 
Misinfosec frameworks Cansecwest 2019
Misinfosec frameworks Cansecwest 2019Misinfosec frameworks Cansecwest 2019
Misinfosec frameworks Cansecwest 2019
 
AI and the Researcher: ChatGPT and DALL-E in Scholarly Writing and Publishing
AI and the Researcher: ChatGPT and DALL-E in Scholarly Writing and PublishingAI and the Researcher: ChatGPT and DALL-E in Scholarly Writing and Publishing
AI and the Researcher: ChatGPT and DALL-E in Scholarly Writing and Publishing
 
2021-02-10_CogSecCollab_UBerkeley
2021-02-10_CogSecCollab_UBerkeley2021-02-10_CogSecCollab_UBerkeley
2021-02-10_CogSecCollab_UBerkeley
 
Distributed defense against disinformation: disinformation risk management an...
Distributed defense against disinformation: disinformation risk management an...Distributed defense against disinformation: disinformation risk management an...
Distributed defense against disinformation: disinformation risk management an...
 
Are You Listening? Real time data and social media
Are You Listening? Real time data and social mediaAre You Listening? Real time data and social media
Are You Listening? Real time data and social media
 
Are you listening? Real Time Measurement and Monitoring
Are you listening? Real Time Measurement and MonitoringAre you listening? Real Time Measurement and Monitoring
Are you listening? Real Time Measurement and Monitoring
 
You Give Us The Fire We'll Give'em Hell!
You Give Us The Fire We'll Give'em Hell!You Give Us The Fire We'll Give'em Hell!
You Give Us The Fire We'll Give'em Hell!
 
Social engineering
Social engineeringSocial engineering
Social engineering
 
2020 09-01 disclosure
2020 09-01 disclosure2020 09-01 disclosure
2020 09-01 disclosure
 
20240104 HICSS Panel on AI and Legal Ethical 20240103 v7.pptx
20240104 HICSS Panel on AI and Legal Ethical 20240103 v7.pptx20240104 HICSS Panel on AI and Legal Ethical 20240103 v7.pptx
20240104 HICSS Panel on AI and Legal Ethical 20240103 v7.pptx
 
Enterprise Search and Findability in 2013
Enterprise Search and Findability in 2013Enterprise Search and Findability in 2013
Enterprise Search and Findability in 2013
 
Dashboards are Dumb Data - Why Smart Analytics Will Kill Your KPIs
Dashboards are Dumb Data - Why Smart Analytics Will Kill Your KPIsDashboards are Dumb Data - Why Smart Analytics Will Kill Your KPIs
Dashboards are Dumb Data - Why Smart Analytics Will Kill Your KPIs
 
The Journey to DevSecOps
The Journey to DevSecOpsThe Journey to DevSecOps
The Journey to DevSecOps
 
The Journey to DevSecOps
The Journey to DevSecOpsThe Journey to DevSecOps
The Journey to DevSecOps
 

Mais de Alexandre Sieira

Shopping for Vulnerabilities - How Cloud Service Provider Marketplaces can He...
Shopping for Vulnerabilities - How Cloud Service Provider Marketplaces can He...Shopping for Vulnerabilities - How Cloud Service Provider Marketplaces can He...
Shopping for Vulnerabilities - How Cloud Service Provider Marketplaces can He...Alexandre Sieira
 
SaaSpocalypse - The Complexity and Power of AWS Cross Account Access
SaaSpocalypse - The Complexity and Power of AWS Cross Account AccessSaaSpocalypse - The Complexity and Power of AWS Cross Account Access
SaaSpocalypse - The Complexity and Power of AWS Cross Account AccessAlexandre Sieira
 
Introdução à Segurança de Containers
Introdução à Segurança de ContainersIntrodução à Segurança de Containers
Introdução à Segurança de ContainersAlexandre Sieira
 
Uma Introdução a Threat Intelligence e Threat Hunting para Empresas Sem Orçam...
Uma Introdução a Threat Intelligence e Threat Hunting para Empresas Sem Orçam...Uma Introdução a Threat Intelligence e Threat Hunting para Empresas Sem Orçam...
Uma Introdução a Threat Intelligence e Threat Hunting para Empresas Sem Orçam...Alexandre Sieira
 
Reverse Engineering the Wetware: Understanding Human Behavior to Improve Info...
Reverse Engineering the Wetware: Understanding Human Behavior to Improve Info...Reverse Engineering the Wetware: Understanding Human Behavior to Improve Info...
Reverse Engineering the Wetware: Understanding Human Behavior to Improve Info...Alexandre Sieira
 
BYOD: Bring Your Own... Disaster?
BYOD: Bring Your Own... Disaster?BYOD: Bring Your Own... Disaster?
BYOD: Bring Your Own... Disaster?Alexandre Sieira
 

Mais de Alexandre Sieira (6)

Shopping for Vulnerabilities - How Cloud Service Provider Marketplaces can He...
Shopping for Vulnerabilities - How Cloud Service Provider Marketplaces can He...Shopping for Vulnerabilities - How Cloud Service Provider Marketplaces can He...
Shopping for Vulnerabilities - How Cloud Service Provider Marketplaces can He...
 
SaaSpocalypse - The Complexity and Power of AWS Cross Account Access
SaaSpocalypse - The Complexity and Power of AWS Cross Account AccessSaaSpocalypse - The Complexity and Power of AWS Cross Account Access
SaaSpocalypse - The Complexity and Power of AWS Cross Account Access
 
Introdução à Segurança de Containers
Introdução à Segurança de ContainersIntrodução à Segurança de Containers
Introdução à Segurança de Containers
 
Uma Introdução a Threat Intelligence e Threat Hunting para Empresas Sem Orçam...
Uma Introdução a Threat Intelligence e Threat Hunting para Empresas Sem Orçam...Uma Introdução a Threat Intelligence e Threat Hunting para Empresas Sem Orçam...
Uma Introdução a Threat Intelligence e Threat Hunting para Empresas Sem Orçam...
 
Reverse Engineering the Wetware: Understanding Human Behavior to Improve Info...
Reverse Engineering the Wetware: Understanding Human Behavior to Improve Info...Reverse Engineering the Wetware: Understanding Human Behavior to Improve Info...
Reverse Engineering the Wetware: Understanding Human Behavior to Improve Info...
 
BYOD: Bring Your Own... Disaster?
BYOD: Bring Your Own... Disaster?BYOD: Bring Your Own... Disaster?
BYOD: Bring Your Own... Disaster?
 

Último

AI presentation and introduction - Retrieval Augmented Generation RAG 101
AI presentation and introduction - Retrieval Augmented Generation RAG 101AI presentation and introduction - Retrieval Augmented Generation RAG 101
AI presentation and introduction - Retrieval Augmented Generation RAG 101vincent683379
 
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...FIDO Alliance
 
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...FIDO Alliance
 
ECS 2024 Teams Premium - Pretty Secure
ECS 2024 Teams Premium - Pretty SecureECS 2024 Teams Premium - Pretty Secure
ECS 2024 Teams Premium - Pretty SecureFemke de Vroome
 
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...FIDO Alliance
 
TopCryptoSupers 12thReport OrionX May2024
TopCryptoSupers 12thReport OrionX May2024TopCryptoSupers 12thReport OrionX May2024
TopCryptoSupers 12thReport OrionX May2024Stephen Perrenod
 
A Business-Centric Approach to Design System Strategy
A Business-Centric Approach to Design System StrategyA Business-Centric Approach to Design System Strategy
A Business-Centric Approach to Design System StrategyUXDXConf
 
How we scaled to 80K users by doing nothing!.pdf
How we scaled to 80K users by doing nothing!.pdfHow we scaled to 80K users by doing nothing!.pdf
How we scaled to 80K users by doing nothing!.pdfSrushith Repakula
 
Salesforce Adoption – Metrics, Methods, and Motivation, Antone Kom
Salesforce Adoption – Metrics, Methods, and Motivation, Antone KomSalesforce Adoption – Metrics, Methods, and Motivation, Antone Kom
Salesforce Adoption – Metrics, Methods, and Motivation, Antone KomCzechDreamin
 
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...FIDO Alliance
 
WSO2CONMay2024OpenSourceConferenceDebrief.pptx
WSO2CONMay2024OpenSourceConferenceDebrief.pptxWSO2CONMay2024OpenSourceConferenceDebrief.pptx
WSO2CONMay2024OpenSourceConferenceDebrief.pptxJennifer Lim
 
IESVE for Early Stage Design and Planning
IESVE for Early Stage Design and PlanningIESVE for Early Stage Design and Planning
IESVE for Early Stage Design and PlanningIES VE
 
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...marcuskenyatta275
 
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...panagenda
 
AI revolution and Salesforce, Jiří Karpíšek
AI revolution and Salesforce, Jiří KarpíšekAI revolution and Salesforce, Jiří Karpíšek
AI revolution and Salesforce, Jiří KarpíšekCzechDreamin
 
Intro in Product Management - Коротко про професію продакт менеджера
Intro in Product Management - Коротко про професію продакт менеджераIntro in Product Management - Коротко про професію продакт менеджера
Intro in Product Management - Коротко про професію продакт менеджераMark Opanasiuk
 
Portal Kombat : extension du réseau de propagande russe
Portal Kombat : extension du réseau de propagande russePortal Kombat : extension du réseau de propagande russe
Portal Kombat : extension du réseau de propagande russe中 央社
 
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...CzechDreamin
 
Syngulon - Selection technology May 2024.pdf
Syngulon - Selection technology May 2024.pdfSyngulon - Selection technology May 2024.pdf
Syngulon - Selection technology May 2024.pdfSyngulon
 
Oauth 2.0 Introduction and Flows with MuleSoft
Oauth 2.0 Introduction and Flows with MuleSoftOauth 2.0 Introduction and Flows with MuleSoft
Oauth 2.0 Introduction and Flows with MuleSoftshyamraj55
 

Último (20)

AI presentation and introduction - Retrieval Augmented Generation RAG 101
AI presentation and introduction - Retrieval Augmented Generation RAG 101AI presentation and introduction - Retrieval Augmented Generation RAG 101
AI presentation and introduction - Retrieval Augmented Generation RAG 101
 
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
 
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
 
ECS 2024 Teams Premium - Pretty Secure
ECS 2024 Teams Premium - Pretty SecureECS 2024 Teams Premium - Pretty Secure
ECS 2024 Teams Premium - Pretty Secure
 
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
 
TopCryptoSupers 12thReport OrionX May2024
TopCryptoSupers 12thReport OrionX May2024TopCryptoSupers 12thReport OrionX May2024
TopCryptoSupers 12thReport OrionX May2024
 
A Business-Centric Approach to Design System Strategy
A Business-Centric Approach to Design System StrategyA Business-Centric Approach to Design System Strategy
A Business-Centric Approach to Design System Strategy
 
How we scaled to 80K users by doing nothing!.pdf
How we scaled to 80K users by doing nothing!.pdfHow we scaled to 80K users by doing nothing!.pdf
How we scaled to 80K users by doing nothing!.pdf
 
Salesforce Adoption – Metrics, Methods, and Motivation, Antone Kom
Salesforce Adoption – Metrics, Methods, and Motivation, Antone KomSalesforce Adoption – Metrics, Methods, and Motivation, Antone Kom
Salesforce Adoption – Metrics, Methods, and Motivation, Antone Kom
 
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
 
WSO2CONMay2024OpenSourceConferenceDebrief.pptx
WSO2CONMay2024OpenSourceConferenceDebrief.pptxWSO2CONMay2024OpenSourceConferenceDebrief.pptx
WSO2CONMay2024OpenSourceConferenceDebrief.pptx
 
IESVE for Early Stage Design and Planning
IESVE for Early Stage Design and PlanningIESVE for Early Stage Design and Planning
IESVE for Early Stage Design and Planning
 
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
 
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
 
AI revolution and Salesforce, Jiří Karpíšek
AI revolution and Salesforce, Jiří KarpíšekAI revolution and Salesforce, Jiří Karpíšek
AI revolution and Salesforce, Jiří Karpíšek
 
Intro in Product Management - Коротко про професію продакт менеджера
Intro in Product Management - Коротко про професію продакт менеджераIntro in Product Management - Коротко про професію продакт менеджера
Intro in Product Management - Коротко про професію продакт менеджера
 
Portal Kombat : extension du réseau de propagande russe
Portal Kombat : extension du réseau de propagande russePortal Kombat : extension du réseau de propagande russe
Portal Kombat : extension du réseau de propagande russe
 
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
 
Syngulon - Selection technology May 2024.pdf
Syngulon - Selection technology May 2024.pdfSyngulon - Selection technology May 2024.pdf
Syngulon - Selection technology May 2024.pdf
 
Oauth 2.0 Introduction and Flows with MuleSoft
Oauth 2.0 Introduction and Flows with MuleSoftOauth 2.0 Introduction and Flows with MuleSoft
Oauth 2.0 Introduction and Flows with MuleSoft
 

Sharing is Caring: Medindo a Eficácia de Comunidades de Compartilhamento de Threat Intelligence

  • 1. SHARING IS CARING: MEDINDO A EFICÁCIA DE COMUNIDADES DE COMPARTILHAMENTO DE THREAT INTELLIGENCE (#DDTI) Alexandre Sieira CTO da Niddel @AlexandreSieira @NiddelCorp
  • 2. • Previously on #ddti • Challenges at TI Sharing • Measuring TI Sharing • The Future of Sharing Agenda
  • 3. This is a data-driven talk! Please check your anecdotes at the door
  • 5. Previously on #ddti • Useful Methods and Measurements for Handling Indicators • Analysis of Threat Intelligence Feeds • Indirectly, a methodology for analyzing TI Providers • Combine (https://github.com/mlsecproject/combine) • Gathers TI data (ip/host) from Internet and local files • TIQ-Test (https://github.com/mlsecproject/tiq-test) • Runs statistical summaries and tests on TI feeds
  • 6. TIQ-TEST - Tons of Threat-y Tests • NOVELTY – How often do the feeds update themselves? • AGING – How long does an indicator sit on a feed? • POPULATION – How does this population distribution compare to my data? • OVERLAP – How do the indicators compare to the ones you got? • UNIQUENESS – How many indicators are found only on one feed? Putting this threat intel data to work
  • 7. Overlap Test - Outbound
  • 8.
  • 9. I hate quoting myself, but…
  • 10. Key Takeaway #1 Threat Intelligence Indicator Feeds Threat Intelligence Program MORE != BETTER
  • 11. Constructive Feedback from the Internet: “TI Sharing is TOTALLY going to solve this” Right, folks? Right?
  • 12. TI Sharing Solution Plan: 1. The best Threat Intelligence is the one that you analyze from your own incidents (homegrown / organic intelligence) 2. There is strength in numbers – vertical herd immunity! 3. ???????? 4. PROFIT!! (or at least SECURITY!!) Or at least a rough strawman
  • 13. If CONSUMING is for the 1%, what is the percentage of organizations able to PRODUCE? Issue 1 - BYOTI
  • 14. Issue 2 - Herd Immunity Source: www.vaccines.gov • We may be able to detect more ”virus strains” together but we are *terrible* at inoculation. • The things we detect the most mutate too fast (Pyramid of Pain) • Who didn’t get immunized, still gets sick (FOMO-TI)
  • 15. Issue ? - What are we sharing • AUTOMATION-DRIVEN (PLATFORMS) • Straight to the point IOC sharing • ANALYST-DRIVEN (COMMUNITIES) • Strategic data, best practices, unstructured IOCs • ”Analyst-driven” has been around forever (in non-IC, at least since FS-ISAC was created) • The same people who bash ”just IOC sharing”: • Bash STIX/TAXII for trying to encode complexity • Tells everyone it is IMPOSSIBLE to hire analysts
  • 16. The Cognitive Dissonances of TI Sharing Everybody should share! The CIRCLE OF TRUST
  • 17. Do you trust the group enough to consume? The Two Sides of the Trust Coin Do you trust the group enough to share?
  • 18. Okay, I’ll bite Can we measure our current sharing platforms communities?
  • 19. Threat Intelligence Sharing We would like to thank the kind contribution of data from the fine folks at Facebook ThreatExchange and ThreatConnect … and also the sharing communities that chose to remain anonymous. You know who you are, and we ❤ you too.
  • 20. Sharing Communities ARE Social Networks Social Network Selfie Sharing Community Selfie
  • 21. Let’s look at the indicators first Using TIQ-TEST Overlap and Uniqueness tests
  • 22.
  • 23.
  • 24. UNIQUENESS SLIDE Looks like we would get similar quality on a ”good” Threat Intelligence Sharing Community as we would on a ”paid feed"
  • 25. Suggested Metrics for Sharing • ACTIVITY – How many indicators / posts are being shared day by day? • DIVERSITY – What is the percentage of the population that is actively sharing? • FEEDBACK – Are orgs collaborating on improving the knowledge in the sharing environment? • TRUST – How much data is shared ”openly” in relation to ”privately”? Looking for healthy dynamics
  • 26. Activity Metric Is there any actual sharing going on?
  • 27. Less data / Delays More data / Timely Large Group is roughly 40x bigger than Small Group
  • 28. Organizations are less likely to share if they perceive they ”lost control” of who can consume.
  • 29. Diversity Metric Check your sharing privilege
  • 30. Roughly 10% of the organizations share data into the community
  • 31. Some organizations are clearly in a better position operationally and legally to share. And that is expected due to our premises.
  • 32. Feedback Metric But is the data any good?
  • 33.
  • 34. 🙀 I’m sure we can do better than this 🙀
  • 35. Feedback Metric • Almost no support on automation-driven platforms • Some allow you to leave ”comments” or ”new descriptors” for the IOCs – even by counting those very low % in relation to new shared data • Analyst-driven environments allow for collaboration on e- mails and forum posts to describe and refine strategies and best practices. How can we make this collaboration work on automation-driven platforms?
  • 36. Trust Metric Are we helping all the community or just a few orgs at a time?
  • 37.
  • 38. 76%. Again, sounds about right
  • 39. Overall ”quality” of data goes up too!
  • 40. Trust Metric • The rough estimate seems to be that more than 80% of ”sharing” (IOCs, messages, etc) happens in ”private groups” inside the infrastructure of the sharing platform • All communities have them: • Part of the DNA of the IC / cleared community • Offsets the trust equation, but defeats the ”herd immunity” argument • Usually MANDATORY on collaboration with LEA But then the ”good” data is not helping ”the community”! Is there any way we can reconcile?
  • 41. The Future of Sharing 🔮 At the very least my humble opinion
  • 42. #squadgoals Increase the TRUST among peers Reduce the TECHNICAL BARRIER for sharing useful information
  • 44. AlienVault OTX clearly got the memo
  • 45. TRUST: Anonymity + Good Curation Some sharing communities accept anonymous submissions that they then curate and disseminate to all organizations
  • 46. IOCs Feedback TelemetryLESS MATURE MORE MATURE With ❤ and apologies to @DavidJBianco TECHNICAL BARRIER: ”Pyramid of Sharing”
  • 47. Takeaways • Intelligence Sharing is a very analyst-centric activity that we have been tasked with scaling out with automation. No wonder it seems so hard. • Data can be as good as a paid feed, but you have to be in the right circles of trust • Does not solve analyst shortage and making the indicators / strategies operational into your environment
  • 48.
  • 49. Thanks! • Q&A? • Feedback! ”The measure of intelligence is the ability to change." - Albert Alexandre Sieira @AlexandreSieira @MLSecProject / @NiddelCorp

Notas do Editor

  1. Previously on #ddti, we were evaluating metrics on threat intelligence feeds
  2. How do you reconcile the push for sharing more and more everywhere and the established boundaries of trust that the community has been evolving on. Sharing is super hot right now, everyone is releasing their ”platforms” Can we measure if the sharing on the platforms is being effective?
  3. For the initial confusion from the industry when FB stepped forward, but they are bringing an interestingly fresh perspective to how those systems should be organized Using the graph database form FB, Moving fast to embrace more functionality Feedback / abuse
  4. Could we be in a sharing community and not have paid feeds?
  5. Valid sharing activities – Platforms – IOCs ; Community - Email threads and best practices