Creating REAL Threat Intelligence with Evernote at TakeDownCon CA on June 2, 2015
•
3 gostaram•2,643 visualizações
In the presentation that threat intel vendors do not want you to see, threat data from open source and home grown resources meets Evernote as the ultimate braindump repository with the outcome of producing real actionable threat intelligence that your organization can leverage to stop the bad guys. This presentation discusses an experiment of using Evernote as a informal threat intelligence management platform, the specific concepts and strategies used, and its overall effectiveness. Specific topics covered include the advantages of using an open and flexible platform that can be molded into an open/closed source threat data repository, an information sharing platform, and an incident management system. Although using Evernote in this way in large enterprises is probably not possible, organizations can apply the same reference implementation to build similarly effective systems using open source or commercial solutions. And yeah … threat intel vendors still hold a role in ultimate threat intelligence nirvana but there is a lot you should do on your own first in order to better understand your requirements in searching for that ideal partner.
Recomendados
Mais conteúdo relacionado
Destaque
Destaque (7)
Mais de grecsl
Mais de grecsl (6)
Último
Último (20)
Creating REAL Threat Intelligence with Evernote at TakeDownCon CA on June 2, 2015
- 1. Creating REAL Threat Intelligence with Evernote @grecs – NovaInfosec.com
- 2. Disclaimer Opinions expressed are solely my own and do not express the views or opinions of my employers, customers, etc. NovaInfosec.com@grecs,
- 4. 20 Yrs Industry 16 Yrs Infosec 5 Yrs SOC
- 6. Consulting • 20 Years Industry/Infosec Experience • Security Engineering/ Architecture • SOC 2.0/Transformation • Security Training NovaInfosec.com@grecs,
- 7. Agenda • Premise • Beginnings • Pivot • 3 Legs of Threat Intel • Evernote as an Intel Repo • Alternatives • Future NovaInfosec.com@grecs,
- 8. PREMISE Over Engineering Build (at least try to) Before Buy NovaInfosec.com@grecs,
- 9. Premise Over Engineering • Tendency to Over Complicate • Keep It Simple Stupid • What Can We Do Quick & Dirty that Will Get Us 60- 70% of the Way There? • Onboarding Workflow System Example Solution Fine As Is Est. Requs. to Develop Eventual Solution
- 10. Premise Build (at least try to) Before Buy • Before Buying New Commercial Solution – Try Quick & Dirty Solution In-House First • Use Tools Already Have & All Familiar With • Setup Good Set of Processes Since Lacks Safety Checks • Have Smart People Actually Use Solution for 6-12 Mos. • Continually Evolve Processes with Lessons Learned – Maybe that Will Solve Your Needs – Else Understand What REALly Need Commercial • Invest in People & Process 1st, then Products Case In Point:Threat Intel Services NovaInfosec.com@grecs,
- 11. BEGINNINGS Dashboard 1.0 Dashboard 2.0 Dashboard 3.0 Take-Aways NovaInfosec.com@grecs,
- 12. Beginnings Dashboard 1.0 • SOC Security Engineer Position Many Years Ago Working to Create Dashboards • Wanted to Measure Risk • Use Traditional Risk Equation – Vulnerability Data Based on Patch & Other Tools – Threat? Decided to Use Vendor Threat Levels (e.g., SANS INFOCON, Symantec – normalize and average) Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,
- 13. Beginnings Dashboard 2.0 – Google Reader, iGoogle, Feedly
- 14. Beginnings Dashboard 3.0 • Moved from Feedly to Netvibes Since Designed Ground Up as Dashboard • Added “Cyber Intel” Tab with Sources Still Active from Feedly Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,
- 15. Beginnings Dashboarding Take-Aways • Nice for “Blog” Post Feeds • Tough to Follow for Data-Driven Feeds – Changing Too Fast – Feedly Pro – NetVibes VIP • Keep All Feed Data & Searchable • Expensive for One-Off Analyst Resource • Introduce Concept of One “Bucket” to Dump All Into • Doesn’t Work for Periodically Updated Data Files Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,
- 16. PIVOT Meanwhile… Rebaseline The Secret Weapon Ah Ha NovaInfosec.com@grecs,
- 17. Pivot Meanwhile… • Threat Intel Market Growing – Investigating Threat Intel – Consulted Experts & Users of Threat Intel Services • Basic Take-Aways – Fascinating Area with Lots of Cool Things Mathematically Correlated Together in Some Fancy Big Data Model – Not Much Value Beyond Open Source Resources – A Lot of Data Not Relevant to Organization • Dashboard – Was onto Something – Pulling all Open Source Info Together NovaInfosec.com@grecs,
- 18. Pivot Rebaseline • NetVibes VIP but Cheaper & More Flexible • Bucket to Dump All Data Into – Blog/Other Feeds – Data-Driven Feeds – Data Files – Other (anything else find – e.g., APT reports) • Easily Find Data – Searchable – Categories – Tagging for Viewing in Different Ways • Cloud-Based So Wouldn’t Have to Maintain & Accessible Everywhere – Email Folder (like in old days but too kludgy) – Log/Data Aggregation Tools NovaInfosec.com@grecs,
- 19. Pivot The Secret Weapon • Method for Using Evernote as GTD-Based Task Mgmt System – Treat Evernote Like a Database – Notebook == Table – Note == Free Form Record • Organization – Nested Notebooks – Hierarchical Tagging (provide metadata structure) • What Projects • When Importance – e.g., 0-6 • Where E.g., home, work, etc. • Who E.g., people that action has to do with • Combination Above • Search – ~ Notebook, Tag, Keyword, or Combination Thereof – Saved Searches NovaInfosec.com@grecs,
- 20. Pivot The Secret Weapon – Customization • Identifier Symbols for Each W* Category • Carry Through of W* Symbols into Sub-Tags • Included “.” after Symbols to Mark Headings NovaInfosec.com@grecs,
- 21. 3 LEGS OF THREAT INTEL Open Source Intelligence Information Sharing Case Tracking Existing Solutions NovaInfosec.com@grecs,
- 22. 3 Legs of Threat Intel Open Source Intelligence • Boils Down to – Indictors (e.g., IPs, Domains , URLs, Hashes, Email Addresses, … ) – Reports (e.g., vendor dossiers on threat TTPs) • Historically Lots of Open Source Resources – MalwareDomainList – Zeus Tracker – SSL Blacklist – … • Don’t Forget Social Networks (e.g., certain people/resources on Twitter) • Mix in Organizational Data as Well to Enrich (e.g., honeypots) • Commercial (but let’s get the free stuff down first to define requirements) • Big Need – Centralized Database to Record All this Information – Mmm? Perhaps a Shared Evernote Notebook Using Tags to Track? Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,
- 23. 3 Legs of Threat Intel Intel Sharing • Groups – ISACs (FS-ISAC, MS-ISAC, DIB-ISAC, …) – DIB – Infragard • Historically – Email List – Bulletin Boards • Big Need – Centralized Database to Record All this Information – Mmm? Perhaps a Shared Evernote Notebook Using Tags to Track? Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,
- 24. 3 Legs of Threat Intel Case Tracking • Pretty Simple with Many Workflow Systems Out There – Open New Case – Work It Periodically Adding Comments of What Done – Eventually Gets Closed • Many Existing Solutions – Remedy – RT – SharePoint • Big Need – Centralized Database to Record All this Information – Mmm? Perhaps an Evernote Notebook using Tags to Track? Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,
- 25. 3 Legs of Threat Intel Existing Solutions • Open Source Intelligence – Open Source: CRITS, CIF – Vendors Incorporating into Products • Intel Sharing – Email Lists, Bulletin Boards – Starting to Distribute in Standardized Format (TAXII, STIX) • Case Management – Open Source: RT, eTicket, Help Desk Lite, … – Commercial: Remedy, SharePoint • All-In-One – ThreatConnect (free to join; in cloud and on-premises) • Overall – Lots of Point Solutions But Not Flexible – Ease of Use (CEO down to analyst) – Centralized Database to Record All this Information Creating REAL Threat Intelligence with Evernote NovaInfosec.com@grecs,
- 26. EVERNOTE AS AN INTEL REPO Ah Ha OSINT Intel Sharing Case Tracking Summary Other Tricks EN Search Alternatives NovaInfosec.com@grecs,
- 27. Evernote as an Intel Repo Ah Ha • Define Notebooks & Hierarchical Tags for Metadata • Perfect Open & Flexible Framework to Build Off Of • Easy to Use Over Heavy Database or Workflow Management System • Start Dumping All Feeds/Data into Evernote Bucket Dashboarding + Secret Weapon + Threat Intel = Evernote as an Intel Repo NovaInfosec.com@grecs,
- 28. Evernote as an Intel Repo OSINT • Archive of Organization Relevant Data from Open Source Resources • Benefits – Database Can Search and Pivot Around In – Annotation of Notes • Dumping – Automated via Feeds – Clip into Evernote with Browser Add-On • Recommended Tagging Structure NovaInfosec.com@grecs,
- 29. Evernote as an Intel Repo OSINT • Threat Data/Intel – MalwareDomainList (RSS feed) – Zeus Tracker (RSS feed) – SSL Blacklist (RSS feed) – Malware-Analysis Traffic (RSS feed) • Vulnerability – Offensive Security Exploit Database (RSS feed) – NIST NVD CVE (RSS feed) – US CERT All Products (RSS feed) • Situational Awareness – SANS ISC Blog (RSS feed) NovaInfosec.com@grecs,
- 30. Evernote as an Intel Repo OSINT NovaInfosec.com@grecs,
- 31. Evernote as an Intel Repo OSINT - Automation • Email into Evernote – Sign Up for Service Using Evernote Email • IFTTT/Zapier for RSS Feeds – Easily to Implement – Limit of Only Getting Partial Data – Write Own RSS Scraper / FiveFilter • IFTTT/Zapier with Email Integration – Helps Some if Offer Mailing List with Full Data • StormStack - Open Source Clone+ of IFTTT • Scripts – E.g., Retrieve Files & Insert into Evernote • CIF Feeds NovaInfosec.com@grecs,
- 32. Evernote as an Intel Repo Intel Sharing • Intel Sharing – Shared Evernote Notebook for Partner Group – Create Note, Place in Shared Notebook to Distribute, & Use Standard Tags to Track • Case Tracking – Evernote Notebook with a Note per Investigation – Establish Note Template with – Tags to Id Workflow (e.g., Open, Working, Closed) NovaInfosec.com@grecs,
- 33. Evernote as an Intel Repo Summary !.When ].What @.Where ^.Who Case Tracking !.Case Tracking !High !Medium !Low ** ].Case Tracking ]CAS10000 ]CAS10001 … @.Case Tracking @Inbox @Working @Closed ^.Case Tracking Intel Sharing ** ].Intel Sharing ]SHA10000 ]SHA10001 … @.Intel Sharing @New @Relevant @Irrelevant) ^.Intel Sharing ^FS-ISAC OSINT DB ** ].OSINT DB ]OSI10000 ]OSI10001 … @.OSINT DB @New @Useful @Useless ^.OSINT DB ^NIST ^Abuse.ch … Only Tag if Relevant Primary Tags (**) Used to Cross-Ref Source or Who Added/Upd Workflow or State Reference Number Priority, Confidence, Rep
- 34. Evernote as an Intel Repo Other Tricks • Create New Meta-Notes that Pull Together Existing Notes (e.g., several OSINT notes, intel from partners, and cases assigned) • One-Off “Other” Tags to Pull Together Any Notes • Alternative Tagging Structures: Adversaries, Campaigns, Waves, Individual Attacks, Indicator DB, … NovaInfosec.com@grecs,
- 35. Evernote as an Intel Repo EN Search • How to Find Find All Data Threw into Evernote • Tags • Basic Search • Advanced Search – Specific Notebooks, Tags, Terms, Dates – “AND” Boolean Support • Example – Search for IP & Find Note – Run Secondary Search Around that Timeline – Discovery Similar Happenings • Saved Searches (e.g., Case Tracking) NovaInfosec.com@grecs,
- 36. Evernote as an Intel Repo Alternatives • Log Management Solutions • SIEMs • Others
- 37. Evernote as an Intel Repo Future • More/Improved OSINT Resources – Deconflict Sites with Multiple Feeds & Add if Needed – File Base Pulls (script / replace existing RSS) – Vendor APT Reports – News Blogs - Track Happenings Around Specific Period – Integration with CIF to Centralize/Tag Data • Improved/Formalized Tagging Structures • API Automation (e.g., auto tagging IP addresses) • EaaS (Evernote as a SIEM ;) )
- 38. Conclusion • Lots of Point Solutions but None Bring Together Like Good ‘ol Evernote • Start with Evernote to “Figure Stuff Out" • In End Determine REAL Requirements – Solution Fine As Is – Build In-House/Buy Commercial Full Out Solution NovaInfosec.com@grecs,
- 39. Questions? • Twitter @grecs • Website NovaInfosec.com, @novainfosec • Contact http://bit.ly/nispcontact o Questions/Consulting