Using Digital Threat Intelligence Management (DTIM) to Combat Threats

IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Using Digital Threat Intelligence Management to Combat Threats:
Understanding the Ins and Outs of DTIM Platforms
David Monahan
Managing Research Director,
Security and Risk Management
Enterprise Management Associates
Alon Arvatz
CPO and Co-founder
IntSights

Watch the On-Demand Webinar
Slide 2 © 2018 Enterprise Management Associates, Inc.
• Using Digital Threat Intelligence Management to Combat
Threats: Understanding the Ins and Outs of DTIM Platforms
On-Demand webinar is available here:
https://ema.wistia.com/medias/dfkndj8ttw
• Check out upcoming webinars from EMA here:
http://www.enterprisemanagement.com/freeResearch

Today’s Speakers
Alon Arvatz, CPO and Co-founder, IntSights
George S. Patton said “If everyone is thinking alike, then somebody isn’t thinking.” Alon
thinks, but not like most of us. And it’s this quality that has given him vast experience and
knowledge in the world of cyberthreat intelligence, and why he has succeeded in working
in the most advanced environments in the world. After serving in an elite intelligence unit
in the Israel Defense Forces, Alon joined Guy Nizan to establish Cyber School, a center
providing teenagers with courses, seminars and summer camp workshops on cyber
intelligence.
David Monahan, Managing Research Director, Security and Risk Management, EMA
David is a senior information security executive with several years of experience. He has
organized and managed both physical and information security programs, including security
and network operations (SOCs and NOCs) for organizations ranging from Fortune 100
companies to local government and small public and private companies. He has diverse audit
and compliance and risk and privacy experience such as providing strategic and tactical
leadership to develop, architect, and deploy assurance controls; delivering process and policy
documentation and training; and working on educational and technical solutions.

Logistics for Today’s Webinar
An archived version of the event recording will be
available at www.enterprisemanagement.com
• Log questions in the chat panel located on the lower
left-hand corner of your screen
• Questions will be addressed during the Q&A session
of the event
QUESTIONS
EVENT RECORDING
A PDF of the speaker slides will be distributed
to all attendees
PDF SLIDES

Using Digital Threat Intelligence Management to Combat Threats:
Understanding the Ins and Outs of DTIM Platforms
David Monahan
Managing Research Director,
Security and Risk Management
Enterprise Management Associates

Why Invest in DTIM
• Breaches are increasing and seem inevitable for every company
• Organized cybercrime operates like a business, perpetrated by a small number
of groups who take great care not to expose their activities in online forums
• Cybercrime presents a significant risk to individuals and organizations
• The FBI reported that Internet crime led to losses in excess of $1.3 billion USD in
2016.1
• Business email compromise (BEC) and business email spoofing (BES) accounted for
$5 billion USD in losses globally between October 2013 and December 2016.2
• Victims’ losses, related to BEC and BES schemes, increased by 2,370 percent
between January 2015 and December 2016, according to figures released by the FBI.2
• The perceived gap between criminality and nation-states, in terms of both actors
and capabilities, will continue to shrink.2
• 1) 2016 IC3Report.pdf
• 2) SecureWorks 2017 State of Cybercrime Report

Why Invest in DTIM (cont’d)
• Nearly 1 billion personal records and just over 1 billion credentials were stolen in
2016
• 2017 VDBIR identifies that external notification of breach is still the #1 method of
discovery
• Financial gain motivates approximately 68 percent of cyber-breaches, while
espionage drives about 25 percent. All other motivations account for only seven
percent of breaches.3
• DTIM solutions have the opportunity to drive faster response in as much as 75
percent of breaches.
• DTIM can reduce identification time of information release to less than 24 hours

Definition: Digital Threat Intelligence Management (DTIM)
Platforms that aid organizations with
external threat identification and risk
management by locating, gathering,
and assimilating threat intelligence
from a variety of sources.
Not just a data feed!

Criteria for Inclusion in DTIM
Paying Customers
Customer-validated time savings
Threat information must be externally verifiable

Architecture
and
Integration
Deployment
and
Administration
Functionality
Cost
Advantage
Vendor
Strength
Criteria for Inclusion in DTIM (cont’d)
Over 100 Key
Performance
Indicators
(KPIs)

Key Areas for Vendor Selection:
Data Sources & Collection
Data Aggregation Data Creation/Collection
Openly Available
Sources
Government
Sources
Private
Subscriptions
Proprietary
Collection
Common Internet Deep Web Dark Web Mobile Email Social

Deployment Flexibility
© 2018 Enterprise Management Associates, Inc.
Deployment
Flexibility
Managed
Service
On-
Premises
Cloud
Software,
Appliance,
Image
Slide 12

Data Accuracy and Actionability
Extreme
False
Positives
Superior
Accuracy
Inferior Analysis Superior Analysis
Where are
you today?
Business Loss,
Interruption
Rapid
Response
Inferior Automation Superior Automation

INDUSTRY ANALYSIS & CONSULTINGSlide 14
© 2018 Enterprise Management Associates, Inc.
TCO
Ease of Administration
Licensing
Integrations
Reliance on Professional Services

INDUSTRY ANALYSIS & CONSULTINGSlide 15 © 2018 Enterprise Management Associates, Inc.
ROI
Productivity
Cost
Avoidance
Cost
Reduction
Reduce
Brand
Erosion
Key Areas for Vendor Selection

Key Areas for Vendor Selection: Company Strength
Company
Strength
Support
Quality
Debt
Revenue
Customer
Retention
Responsiveness

Key Areas for Consideration for Buyers
Business Drivers-
• ROI/TCO
• Increased Threats/Risk
• Increased Awareness
• Compliance
• Third-Party Risks
• Move to Cloud
• …

How IntSights Provides Strong Value
Tailored
Protection
Data
Integrations
Visibility
IntSights

IntSights Cyber Strengths
 Deployment Flexibility
 Data Integrations
 Monitoring Breadth
 Automated Remediation

IntSights as a Vendor to Watch

How IntSights Stacked Up

How IntSights Stacked Up (cont’d)

T hreat Intelligence Realized.
Lessons Learned:
Building a Threat
Intelligence RFP
Alon Arvatz, CPO

BUILDING A THREAT INTEL PLATFORM RFP
‘Must-Have’ Capabilities:

TIP EVALUATION CHEAT-SHEET
AUTOMATED
REMEDIATION
THREAT RESEARCH &
ANALYSIS
IOC ENRICHMENT &
MANAGEMENT
(THREAT INTEL PLATFORM)
TAILORED INTELLIGENCE &
THREAT VISIBILITY
• Trends
• Research & Investigation
• Link Analysis
• IOCs aggregation & management
• IOCs investigation
• Intelligence Sharing
• Network & endpoint security integration
• External threat takedown
• Active Directory remediation
• Exploitable data
• Dark web
• Brand security
• Data leakage
• Phishing
• Attack indication

1. Threat Intel Data Collection & Brand/Asset Monitoring
Type Description of Requirement
Phishing
Detection of newly registered domains and sub-domains based on company assets: --
Common additions, Common permutations
Discovery of active phishing pages utilizing company name/graphic language
Image processing capabilities for detection of active phishing pages
"Piggybacking" of phishing site repositories
Data Leakage
Detection of leaked credentials based on company assets
Detection of confidential documents leaked online based on company assets and
watermarks
Detection of employee's private data leaked online (Doxing)
Detection of references to secret projects based on company assets
Detection of leaked software code and IP
Vulnerabilities
Reporting of newly disclosed vulnerabilities based on company assets
Active scanning of vulnerabilities on provided assets
Detection of exposed internal pages
Detection of open-ports on company's servers
Problem in SSL certificate/its installation
Unsecure FTP connections
Detection of publicly disclosed SQL/XSS vulnerabilities found on company's assets
Detection of unencrypted login pages
Detection of old and/or unmaintained pages

Attack Indications
Reporting of intention to target the company or industry
Reporting of major hacktivist campaigns
Reporting of illegal trade in the company's products online
Reporting of counterfeit activity re: company brands
Reporting of employee emails found on spam lists
Reporting of blacklisted IP addresses, based on CIDRs/ IP provided by the
company
Indications of activist initiatives against the company
Reporting of RDPs sold on the black market based on the CIDRs/IP provided
by the company
Reporting of malware samples targeting company based on company assets
Detection of machines infected with malware
Reporting of indications of insider activity within the company or industry
Executive monitoring
Alert on specific intentions to target VIPs based on a list provided by the
company
Alert on fake profiles utilizing the name/image of a VIP
Alert on VIP credentials leaked online
Brand Security
Fake profiles utilizing the company's name and/or graphic language for
fraudulent purposes
Fake profiles that impersonate company employees
Fake applications that resemble the company's' and/or utilize the company's
name/graphic language: mobile & desktop;
Malicious applications that resemble the company's and/or utilize the
company's name/graphic language
Defacement detection

Sources
Cyber-crime forums
Mobile messaging apps
IRC chat rooms
Application stores
Paste sites
Dev repositories
IP blacklists
Search engines - Google, Bing, etc.
Document sharing sites
Data leakage sites and repositories
Passive DNS
WHOIS servers
Bug-bounty sites
Phishing reporting sites
Social media sites
Data dumps shared via P2P
Insider-trading sources
E-commerce platforms
Black markets
Access to attached list of forums, black markets, and other deep web sources
Automated collection of new sources: "deep crawling", monitoring of new sites
added to the site indexes

2. Threat Intelligence Management & Research Capabilities
Type Description of Requirement
Threat Knowledge Base
"Threat encyclopedia" comprised of terms which describe the following types of threats:
Malware
Campaign
Threat Actor profiles
TTP's
IOCs per threat
Monitoring of APT-related activity
Trends and Analysis
The system can generate general cyber intelligence reports concerning trends and
developments in the cyber-threat landscape
Trend detection and monitoring
Built-in search engine for data scraped off forums and other deep/dark web sources
The system can generate industry-specific intelligence reports concerning trends and
developments in the cyber-threat landscape
Option for Ad-hoc reports, researches and papers upon request on different topics (Top used
TTPs by specific threat actors, etc.)
Malware and Malicious infrastructure
Automated malware analysis
Reverse engineering capability upon request
APT
Detection and long term monitoring of APT campaigns
APT threat actor monitoring
Access to forums where APT-affiliated TAs participate
Indicators of Compromise
Customized IOC generation
IOC prioritization
General IOC feeds for known threats
Commercial feeds

Internal:
• Active Directory Credential Theft
• Social Media Credential Leakage
• Phishing Domain Monitoring & Blocking
Endpoint
FirewallSIEM
Web Proxies and Email Gateways
Orchestration
3. Security Integration & Automated Remediation

External:
• Malicious Mobile Application Takedown
• Malicious Domain Takedown
• Suspicious Social Media Page Takedown
• Paste Site Takedown
60+ Paste Sites Safe Browsing Programs
Internet Registrars Social Media
App Stores
3. Security Integration & Automated Remediation

Question and Answer: Log Questions in the Q&A panel
located on the lower left-hand corner
Learn More About IntSights at www.intsights.com

Using Digital Threat Intelligence Management (DTIM) to Combat Threats

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Using Digital Threat Intelligence Management (DTIM) to Combat Threats

Semelhante a Using Digital Threat Intelligence Management (DTIM) to Combat Threats (20)

Mais de Enterprise Management Associates

Mais de Enterprise Management Associates (20)

Último

Último (20)

Using Digital Threat Intelligence Management (DTIM) to Combat Threats