[Music]
[Applause]
perfect good morning good morning so
thank you for showing up at 9:00 a.m.
for a talk that's always nice today I
want to talk about consuming versus
generating intelligence so you're gonna
see a lot today about finalizing reports
understanding sort of pivoting off
indicators a lot of good talks lined up
for today but I think this is a
fundamental question that most people
will come to in their organizations do i
leverage what's available in the
community leverage vendors leverage
feeds reports whatever else and just
consume intelligence or do I go a little
bit past that and actually start
generating my own intelligence so I'll
walk through today is from my
perspectives on an approach to consume
and sort of guiding our maturity along
how we consume and give some
recommendations on the generation of it
as well
so as a little bit of background now I
run a company called Drago's but yes I
do have the 578 course the cyber threat
intelligence course here at Sam's and
the ICS five one five course which is
Incident Response inside of industrial
control system environments probably
more importantly though I write a
comic-strip I found out my time in the
military that it was really really
beneficial to be able to explain very
technical topics to generals and
congressmen in three pane comics it was
very useful to sort of explain what
myself and my team did but a little bit
of a further background which I'll bring
into the talk is when I first got
started even though I was an air force
officer I never really worked in the Air
Force I got shipped off to one of the
intelligence agencies pretty much day
one and spent my whole background in
that world when I first got to this
intelligence agency they told me all
right your job is to generate
intelligence I'm like okay cool all
right gonna do this your job is to find
the unknown unknowns I don't think
that's an intelligence requirement like
that doesn't sound very specific and
testable and something that we
and actually work with and they're like
no no no it's cool like Rumsfeld's
talking about this unknown unknown thing
I need you to do unknown unknown cyber
stuff along that's the industry but I
have a background working with control
systems so I thought well I'll focus my
mission on control systems so over time
what we ended up doing was looking at
what nation-states were breaking in to
control system environments the whole
idea there is maybe there's threats and
teams that we just haven't seen before
the traditional way
so you think of normal government
networks normal sort of government view
they might see China and Russia a lot
but that's because they're breaking into
the defense industrial base that's
because of breaking into networks to
steal off data but maybe we don't see
the Algerian apt team very often but can
control system environments you might
actually see that it's different threats
for a different threat landscape so we
started identifying a number of teams
that nobody else was tracking just based
off of changing where we were doing our
collection based off of requirements so
for all of those that have seen the
intelligence lifecycle before right
planning in Direction led to different
collection which allowed us to
understand and analyze out hold
different threats that other people
weren't tracking so I'll try to bring
some of that background today as well
again I like comics so I'm gonna have a
couple of these in the slides of today
this is basically how everybody gets
invited to speak at security conferences
where little Bobby says we need more
scalable cloud-based threat intelligence
analytics and automate a big data
security endpoints and matt said do you
have no idea what you just said do you
nope but I said it out loud and got to
speak at a conference and I figure if I
set it twice more I'd be a security
expert and Matt says yeah sounds about
right
I generally see in this field probably
more than any other we are a little bit
buzzword centric if somebody can
actually explain to me the difference
between a storage platform and a threat
intelligence platform and a tip versus
some other pivoting app it would be
great
but it's at some points we just have a
lot of terms that we're throwing around
and maybe not fully understand so I'll
try to cover that today as well number
one though I'm going to look at a model
the sliding scale of cyber security we
I'll introduce here in a second to
structure this discussion of consuming
intelligence and before I pivot into
generating it so one more little Bobby
just to get us going here I have the CAS
oh and he tells little Bobby I need you
to ensure that no cyber attacks occur
little Bobby says great what's our
budget I guess oh no no no we got to cut
all that out what Bobby says okay well I
can assure you we will never see any
cyber attacks and again just notes
versus what you're seeing versus what's
actually available in the data what I
mean by that is a key point on whether
you can generate or consume intelligence
is based off of what's available for you
to consume in the first place if your
vendor or your feed or the public
information or whatever else is not
correlating with the intelligence
requirements that are levied by your
executives on down you will not be able
to just rely on consumption I would note
that probably some some statistically
relevant large portion of the community
really just wants to consume when we say
like I want a threat Intel team most
people just want to consume intelligence
what that generally looks like is hey
can I get a smart lady or guy on the
team that knows what we do that knows
what our organization does and can go
out into what's already produced and
find it match it up and drive security
better in our organization and that's
actually what a lot of threat Intel
teams today do they're not actually
generating a lot of their own
intelligence they're looking for what
intelligence is available and mapping it
back to the organization and that's
completely appropriate and that is where
everybody should be i'll make the pitch
that everybody should consume
intelligence but generating intelligence
is definitely a much loftier goal and
much much more expensive alright so the
topic of the sliding scale and for those
of you that my class you'll have seen
this slide before I got some interesting
positions after I got the government go
over and deal with a think tank and
seeing policy makers and talk to them
about cyber security at the same time
teaching it sands and doing for the
technical thing and I identified that
cyber security is a word that means
nothing
to everybody right I got to ask people
like what do you do them like I do
cybersecurity I'm like that doesn't help
me at all understand what you do as an
individual all right and it was
exacerbated at the policy level where
congressman congressional staffers they
had no understanding of what the
community was actually doing so I
authored a paper it's a sans white paper
Freema it's interesting googling it but
titled the sliding scale of
cybersecurity and what I basically
positioned is there are five categories
of investment you can make along
security to give you some sort of value
to your organization on the left-hand
side of the scale we have architecture
this is architecting your networks out
the first time securing the supply chain
patching the vulnerabilities that you
have figuring out what decisions you're
gonna make about how you position your
organization's networks and systems then
we have passive defenses and this is
where most of the vendor products rely
and this is most of where the vendor
products are in terms of some box or
system or aspect I can add on top of the
architecture that will do some level of
defense in the face of an adversary or
give me some level of visibility into my
organization but it doesn't necessarily
require human activity the entire time
in other words I can put this box on the
network go home to sleep at night and
it's still gonna do something I may need
to update it tune it work with it but
it's not a hundred percent interaction
and that's a good thing because we just
don't have time the day to take care of
a hundred percent of every box on the
network so we want passive defenses an
active defense is the humans getting
involved it's very much that active
approach where a instant responder
threat hunter security operations person
goes through the environment looking for
threats trying to defend against the
threats that are currently there
intelligence I think we all kind of get
a little bit about that I'm collecting
data exploiting information creating
intelligence products whether it's TTP
briefings intelligence reports
tradecraft for our responders to go
better and then offense offense for a
security perspective has to be legal and
it has to be inside some sort of
confines of security not national
security so it's not this discussion of
should Russia in the u.s. be preparing
for offense for national security
reasons no for a cyber security
discussion to ask me something like
botnet takedowns stopping a
denial-of-service something to that
level I will note that when I made this
model one of the things I positioned was
that most of the value is on the
left-hand side of the scale I actually
don't think people should be doing
offense I usually tell my class very
bluntly like the one blunt thing I say
is if you suck at defense you're
probably gonna suck at offense all right
so don't just be like oh we can hack
back and it'll be okay like that's not
gonna be a good strategy so I like
people with a structure on the left and
move forward it doesn't mean only invest
in one and then move and move and move
but realize that the return on
investment for what you're doing in an
organization is much more to the
left-hand side of the scale moving to
the right as an example when I first got
to the intelligence agency that was at
they gave us the DoD Network and I don't
mean like a portion of it they gave us a
video D Network to look at and said hey
we have somewhere on the order of 10
million IP connected devices like here's
10 million IP connected devices I'm like
okay can we have like a architecture map
or like data flow diagram or anything
and like oh no this doesn't really have
all of that we'll figure that out but
can you start finding China I'm like
dude until you tell me what systems I'm
looking at what normal looks like
everything might as well be China right
like there's no way to structure a
really good act of Defense kind of
security operations and our focus on an
environment that you have no
understanding of but imagine from that
return on investment perspective how
simplistic it can be if you know your
systems they're well maintained do you
have the passive defenses to give you
visibility logs everything else by the
time you get to that active defense
stage the return on investment you're
getting at something like a sock is much
more significant so that's that's the
position all right so I was told we have
to use World War 2 era pictures I am
going to avoid what was done in like six
other talks and you won't see Hitler and
swastikas so I think that's like a bonus
but maybe next year we'll do something
like my little pony or something because
apparently world war ii was just too
much for people but to me if you're
finding yourself in the starting
position which i think most people at
some point will i don't want to give
sort of the lofty well you do what works
for you right i always hated that as a
new person i'd like give me some advice
on how to start everyone's like it it
depends it's up to you and ever really
helped me so here's my position if
you're in a position that you're already
often off to the races and running and
being awesome
good don't change anything based off
what I'm about to tell you if you're in
a starting position here's how I think
you should structure it it's the and you
can barely see it but it's the 40 30 20
10 rule up that pyramid so if we think
of the sliding scale of security and
we're gonna rule out offense cuz I don't
think you should do it anyways the
architecture which is the bottom should
get it probably around 40% of your time
or investments up to passive defenses
which are 30 percent 20 percent for
active defense Intel 10 percent the
reason I structure it like that is
because we as analysts tend to get
biased about what we love and not
necessarily the value we returning to
the organization what I mean by that is
Intel is by far in my opinion the
sexiest thing you can do it's cool it's
fun it's exciting it is in no way where
the security budget should be going
compared to all of the other things it
should be the 10% secret sauce you
sprinkle on top of a well-structured
well defensible environment and that
you're returning value to the security
already in place but if you don't have
an incident response team if you don't
have logs of the environment if you have
a patch management program it's not time
to invest in a very expensive Intel team
so that's my 40 30 20 10 rule when it
comes to that sliding scale
alright so counterintelligence along
this as well so I'm basically what I'm
doing over these next couple slides is
along the sliding security
how can you invest in Intel and this is
just a couple tidbits so from that first
category that we started the top at 10%
intelligence where does intelligence
sort of benefit its own self right
where's that self licking ice cream cone
where's the tin Intel for Intel
when we talk about driving intelligence
from that security standpoint back in
the organization to me it's a lot of
sort of the red team focus Intel for
strategic purposes operational we want
to do all that but if we're actually
impacting directly security from an
intelligence category I do like red
team's that are using the adversary
tactics now I didn't say anything about
pentest we're not talking about somebody
running necess and exploiting a
vulnerability and thinking that's super
sweet it might be for anybody that's
like unique snowflakes about NASA but
I'll note when it comes to red teams I'm
talking about a team that understands
from the intelligence team you know what
we're getting hit with this ap t28 that
we keep hearing about the news what are
the tactics techniques procedures that
they're using
let's emulate that against ourselves and
figure out how we're going to prioritize
the security investments based off of
what they would do since they're in our
threat model right so that Intel for
Intel say it could be there why the
pictures so I included the Red Army for
like Red Team I thought that was kind of
clever and I noted that like Russian it
and get a whole lot of love and like the
other slides they were there too in ww2
by the way I also note like last year I
mentioned Russia in terms of like being
a threat on some ICS stuff I'd seen and
actually got feedback I'm like why are
you picking on Russia Russia's not
always the threat I'm hoping this year
like we all are like cool with it
anyways so on the right hand side you'll
see in individuals anybody know who this
is by the way it's like the most badass
person in history yeah
it's what finnish sniper yeah all right
so this will just refer to him as white
death because that was his nickname and
I don't speak Finnish so well but white
death was a single Finnish farmer that
they gave a rifle to noscope or anything
like that and they said here's where
your adversary is gonna be here's what
your adversary looks like and was the
Russians at the time and he said just go
out and wipe out the adversaries as they
come into your environment he has the
most confirmed kills of any sniper in
history around 542 confirmed kills
that's pretty ridiculous for a sniper I
just thought that was too cool to pass
up there's some probably red team
connection there somewhere all right
what about active defense all right so
if we take an active defense discussion
and about how intelligence drives active
defense so from like a security
operation centers perspective if we have
an active defense team whether it's a
sockeye are people getting involved this
is generally the most natural place we
understand you use Intel it seems sort
of natural on I'm gonna better
understand adversary tradecraft so my
responders are gonna respond faster or I
understand that the lowest level form of
Intel these indicators are compromised
that when I see these indicators are
compromised in my network I'm probably
infected I need a scope the environment
so again from an ir or incident
perspective most of what occurs at the
active defense category is you observing
adversary intrusions which is what Mike
and I were talking on and everybody last
night about on the sort of the fireside
chat for those of you that attended it
all comes down to intrusion analysis if
you do it as a security operations
person or somebody else that's fine but
it really is all instant response to
some level because what you're doing by
its very nature is counterintelligence
some foreign adversary is doing an
intelligence action against you or
military you're identifying it
patterning it and trying to stop it in
the active defence category that Intel
is supposed to drive a better process
and try to make sure that our security
folks aren't displaying lakum all we
know in the industry that people get
burnt out if you can't
things like storyboards of water
actually going on and returned some
level of value that their job is easier
on a day to day basis you will find that
your security folks will get burnt out
and go somewhere else we have a very
high attrition rate in this field when
you don't get to see the other side of
the story so this to me is also a
defender narrative problem I see a lot
of organizations that say oh yeah but I
just took down an IP address but you
know what it's so simple for the
adversary to stay in it back up or it's
so simple for the adversary to do this
or so simple for the adversary to change
this or I'd route my adversary
infrastructure through China and look
like China it's super simple here's why
it's not your adversary is human right
if you've ever tried to do anything
inside of a government bureaucracy
nothing simple all right so even this
idea of well they're just gonna stand up
a new command and control infrastructure
yeah and it might be a change goal in
control process so the briefing on why
it occurred with the management process
oh are they a Western government they're
gonna have an RFP to see which defense
industrial contractors gonna bid on this
and so on and so on and so on it's a
painful process so although I spent a
good portion of my career on Intel in
defense it was a portion of my career
that I was on offense I was somebody's
apt it wasn't as glamorous as it sounds
and all notes that everything was far
more difficult than defenders like to
make it including myself if I were to
tell you why don't you have a hundred
percent patch ratio across your
organization it's this super easy we
would all cringe and really that's way
more difficult than it sounds
think of it from the adversaries
perspective as well for all the things
that we claim super easy for them to do
I'll know that your adversary is not
only human but they are probably dealing
still in PowerPoint
they've got management and they've got
metrics too so hopefully we can push
against those all right from a passive
defense perspective in terms of
intelligence I like our pasture defenses
to be better tuned based off of this
intelligence cycle this tends to be a
lot of feeds but what I don't want you
to get in the habit of course is just
driving yet another blacklist it should
be the output of more strategic more
operational level Intel to figure out
exactly what's useful here's my rule of
thumb for
putting things in your SEM firewall IDs
whatever else if it alerts and you
cannot answer questions off what the
data is don't use it alright so if you
get like this magic IOC from a grizzly
step report or something and it says
contact your network administrator when
this alerts like that's not context it's
not an indicator it's just another data
point and you'll never be able to
determine like is it really a false
positive well maybe this is that one
threat I was supposed to pull on and
I'll find the Russians
if you can't ask questions of your data
it should never go in your products in
the first place because one day it's
gonna alert and you're gonna have to
answer questions and it's gonna take you
seven days or more of resources to
figure out it was a false positive and
the off email server all right so
architecture so this one's a little bit
more risky I was trying to find a non
offensive atomic bomb picture so this is
a test one why the atomic bomb an
architecture here we go here's the big
leap I'm gonna make because you as an
organization especially from a small to
medium-sized organization based off of
your understanding of your threat
landscape and the Intel that you're
consuming you may decide that you want
to have all of your architecture under
your control or you might actually
decide to move it to the cloud yeah
clever I got it all right
so the cloud can be a nuclear hormone
place or it could actually be pretty
good for small to medium sized
organizations as their entire
architecture model everybody doesn't
need to stand up an enterprise security
team in an enterprise Intel team I find
that this is actually an appropriate
solution for a majority of the community
but your intelligence also can help you
prioritize what you're doing with your
architecture I don't like the intel's
teams to be focused on vulnerabilities
in my opinion it's the one place I
wouldn't put an Intel team is the
vulnerability management group I can't
tell you where your should fit based off
your requirements but the one place
that's wrong in my opinion is the
vulnerability management group because
you will always be focused on
vulnerabilities are the threats when
they're not they're an opportunity for
the adversary to leverage in the
adversary the human is the threats but
in output of what you're doing can
absolutely be prioritizing
all the different vulnerabilities the
environment to say you know what these
three are really important based off the
adversaries that we're seeing that are
in our threat model and these three are
likely to be implemented at some level
or used at some level we should
prioritize it the patching across the
organization all right
big picture anyone know this location a
little bit more history trivia yeah
Coventry alright so what happened with
Coventry and this is like half British
conspiracy theory a lot of people
believe it to be true I think it
probably is but very controversial
during World War two there was a point
when the Allies had the Enigma machine
to break out the German encryption and
they were aware of an attack that was
going to occur on Coventry and the story
goes that the decision was made by
Winston Churchill not to position any
defenses because the adversary would
then learn about the Enigma machine it
would burn the sources and methods and
there would be massive loss of human
life after the fact but that's a hard
decision right it was much more
difficult than decisions you and I have
to make on a regular basis and it led to
massive casualties but potentially
turned the tide of the war that they
didn't give up that source of method we
generally won't be in that big of a
consideration we're consuming
intelligence but I do want you to note
that that intelligence gain loss is a
question you have to ask ahead of time
like how far are we gonna let this
intrusion go and learn from it and from
a consumption standpoint in my opinion
you don't ever get to this point if you
don't have a generation team in other
words if you yourself aren't generating
intelligence there's no reason to let
the adversaries román your environment
on the hope that an instant responder
later on is gonna get the data and turn
it into better intelligence for years so
on intelligence gain loss it's a thing
that trips up a lot of people in the
community my rule of thumb you can't do
it without a team that's actually
focused solely on generating
intelligence not consuming it all right
so as we move on and start rolling this
down we have a little Bobby here what is
cyber attribution well true attribution
is the identification of a person
organization or country responsibility
attacks so unmasking the bad guys yeah
what does that do for network security
my position here traditionally is that
attribution can be very interesting for
executives strategic level choices
international agreements a lot of value
in attribution particular potentially
true attribution in your environment
especially from a tactical perspective
does you no good if I tell you China's
in your network and you start thinking
Oh
intellectual property because that's
what they've heard over and over again
China steals intellectual property
you've missed the fact that they also
have data deletion teams they also have
espionage teams they also have military
preparation teams same thing with the
Russians Iranians Americans
everybody's got every team but
ultimately what happens is your security
folks get biased based off what they've
heard before and they respond
differently thinking they understand the
threat when they likely don't understand
that threat so I do like the made-up
name this glowing unicorn sparkling
panda whatever the crap they come up
with
I generally like some name associated
say there's a human threat and all of
this intrusion data is this human threat
but not necessarily what nation it is so
if your intelligence requirement is
let's do attribution and you aren't
doing the entire rest of the scale down
before offense you're never gonna get
there and it's not going to return the
value you think it will all right so
from that intelligence process in terms
of generating intelligence this is a
model that I use to sort of guide the
discussion a bit in my opinion if you're
generating intelligence again you're
doing intrusion analysis and that is a
natural occurrence between active
defense and Intel on the active defense
side you're in some level doing network
security monitoring instant response
forensics things in your environments
that are an active offense and the data
that's collected is passed over to the
intelligence side of the house the
intelligence teams are using kill chain
and diamond model type analysis to
extract out patterns across all this
intrusion data and then drive it back to
the active defense side of the house
consuming intelligence which better
drives the hunting which better drives
the incident response which better
drives the threat analysis this natural
back-and-forth process is one of the
ways that I sort of view from that
tactical technical perspective of what
we do is Intel analysts
that also means that I do think as a
requirement to generate intelligence you
need some sort of sock and some sort of
instant response team
now for those of you that are like well
strategic I'm focused on geopolitical I
agree
strategic is the way to go we want the
community to be there but if you're
focused solely on geopolitical you've
got to get the intrusion data somewhere
because that's what rises up to make
that strategic level analysis even if
you're just consuming it from others so
if your response is I'm just gonna
consume everybody else's reports and do
analysis off that you're still in threat
intelligence consumption land you're not
really generating out intelligence if
you're generating intelligence based off
of what you're seeing it still comes
from the number one foundational step
which is an intrusion all right
so understand your organization first so
a little tips for you about Intel if you
are an intelligence team I first want
you to understand what your organization
does what is the business line what is
the value that it returns make sure that
you can look to history to understand
the past intrusions and data that you
have I want you to understand your
organization so well that if someone
told you something that was wrong about
your organization or what they do you
spot it like Mark Hamill in World War
two like you should be able to pull out
that Mark Hamill did not fly the Angola
gay Luke Skywalker wasn't there you
should be able to pick that out very
quickly internal to your organization in
the same way understand your
capabilities
I want my intelligence team analysts to
know the questions that they're asking
are supported by the architecture and
teams in place as an example if you have
the 74 Z speeder bike from Star Wars for
your intelligence team that's awesome
but if it actually wasn't one of your
capabilities I don't want your
executives to ask you questions that you
can't answer so what does that translate
out to be if your intelligence
requirement is identify the threats that
we faced over the past six months and
you've got seven days of logs in your
environment your capabilities don't
match our intelligence requirements so
figure out what your security
capabilities are along that sliding
scale and make sure that as you sort of
read team it out in your mind that your
intelligence requirements match up to
what you can actually produce it's like
the big
point on generating intelligence next
articulate good intelligence
requirements generally speaking you
don't need a giant hammer or star
destroyer to actually go after small
cities or small requirements what I mean
by that is is your biggest challenge in
the organization the fact that it
currently takes 45 days to scope your
environment with an indicator and you're
trying to spin up a team to do
intelligence generation for the purpose
of attribution you've got other problems
you've got other things and it turns out
you might actually just be able to
consume intelligence to be able to meet
that requirements it is actually not as
difficult as you might think as well to
identify Star Wars related World War two
pictures it turns out there's whole
albums of them I wasted a good hour and
a half last night just looking at the
Star Wars pictures anyways in terms of
focusing on relieving pain points I'm
telling you there's lots all right from
a pain points perspective I like my
Intel teams to be service oriented what
I mean by that is you want to make sure
they don't become that self licking ice
cream cone if you tell your Intel team
go generate Intel they will do it it'll
be useless you won't actually be able to
have any derived value whatsoever but
man they're gonna spin up and generate
Intel because that's what Intel analysts
do without good requirements without
being service-oriented it'll cost you a
lot of money so what a service-oriented
to me means it means that when I stand
up an Intel team or when I ask for like
stock moving into Intel I expect to get
no value out of an Intel team for the
first six months I say all right we're
gonna hire people we're gonna put them
the position also a very unpopular
position
I don't agree in big budgets either for
the first six months usually for the
first year I want my Intel analyst to go
out and figure out what's open-source
what's available what can they use and
then make a cost justification for what
they're going to get in terms of vendor
products and feeds why number one I want
them to understand the science behind
what they're doing so they don't just go
when I push this vendor X button I get
Intel no no where is it coming from oh
they're just doing passive DNS lookups
okay thank you all so I want them to be
able to justify what they're doing in
terms of cost the organization at some
point the budget
is going to get smaller it will happen
even if it hasn't happened to you yet
and something's going to be removed from
your environment you're gonna have to
lose a tool lose a feed lose a product
at that point I want them to understand
how much it costs them or what the
effort was or what intelligence
requirements they couldn't fulfill
without that product and what its gonna
cost the organization to get rid of it
so as an example if you've got this four
hundred thousand dollar your Intel tool
seems really expensive it might be the
first thing on the budget to get ripped
off but if it's the only way that you're
doing intelligence requirements to meet
the CEO level tasks it's probably a good
investment right so figuring out exactly
what your capabilities and what your
intelligence requirements are to be that
service oriented component is useful
also I like taking my Intel folks
injecting them in every business unit
what is the chief marketing officer what
is the chief financial officer what is
the legal team what is the acquisitions
team what is the procurement team
getting out of Intel if the answer is I
don't know you're not generating
intelligence your organization you're
throwing i OCS at another Chinese threat
what I want you to focus on is speaking
the language of those other business
units do I know that from a procurement
standpoint that right now we're looking
at acquiring other companies and
adopting their risk model adopting their
threat model and that's gonna impact the
cost of onboarding them stealing
Sergio's term the cost of onboarding
your adversaries right because that's
all you're doing is adopting them what
is that going to cost us because that
might make a difference in the
acquisition price or process of
validating them so Intel analysts to
every other business unit in the
organization coming back speaking their
language after six months being able to
generate good requirements for those
teams because every team sucks at
generating intelligence requirements you
were going to have to generate it for
them you're gonna take it to them you're
gonna say is this what I am actually
doing for you that you like they're
gonna respond generally that sounds
great or that doesn't sound pretty good
at all you're gonna go back and forth
and you're going to really get that
intelligence requirement done correctly
it's going to be painful it is the most
important thing you will do all right
prioritize your threat model if you're
preparing for the landing of Normandy
and troops coming off the beaches and it
turns out it's just ran
somewhere and your organization's
biggest thing is ransomware you don't
need to also prioritize 80 80s walking
on the beaches belong up your defenses
in other words not everybody is going to
face all the apts
you don't have to invest in another
product or feed because someone told you
yeah but here's what APD 28 and 29 are
doing against the election
are we election systems no do they fit
in our threat model no ok cool you guys
figure it out we're gonna go focus on
the threats that are actually impacting
our organization so prioritize to your
threat model this is going to lead
eventually to you missing something
eventually something outside your threat
model is going to cost your organization
significantly you need the maturity and
trust between the executives and the
security teams and yourself to say you
know what that is OK we prioritized our
threat model based off of what we
understood we now have a learning moment
to do a little bit better but it's ok
that we missed that because look at all
the other coverage we have and we will
absolutely now add that to our threat
model if you'd like so it's an evolving
process
keep up the requirements there's a
difference between doing b-17s and be 47
bombers and having X wings flying along
the side of you what I mean by that is
very simple if you are in an
organization and you are getting all
that sliding scale of cybersecurity
discussion until it each phase and
things in life are good to fulfill your
requirements you probably don't need an
intelligence generation team simple as
that if you're doing all the
requirements based along the four
categories of the scale that I want you
to focus on and up to the strategic
level everything is good that's
perfectly fine to consume if you find
that there's more and more and more
legitimate intelligence requirements and
you just can't keep up with them
you have to enforce an actual
intelligence generation team inside of
your organization and be able to display
the value in the cost that it's going to
be expensive it is not a simple like one
more team generating intelligence as we
all should know is extremely extremely
expensive over time so as a matter you
know open-source tools and things can
make it better but everyone always
forgets the human analysts call
and the training and the maintenance and
the health care packages eventually it's
going to be extremely expensive for them
you must have key players I'll try to
figure out a way to get him in here and
the Star Wars pictures didn't quite go
but here's your connection Christopher
de leeuw is the sort of same gentleman
from the left to the right Christopher
Lee was a World War 2 era sort of
Special Forces member for those of you
that haven't sort of dug into his
history he's literally the most
interesting man in the world even on the
set of Lord of the Rings he was trying
to explain like stabbing scenes and and
Peter Jackson was like well when you
stab somebody in this one like pivotal
scene in Lord of the Rings spoiler
alerts for those you stabbed this person
I need him to make some sort of gasping
sound Chris really is like no no no no
here's what he the sound he's actually
gonna make and they're like how would
you know that it's like oh I've killed a
lot of people this way so we're gonna do
it this way in the film is like
that like my point in saying this is you
had to have key players when you're
consuming it is entirely appropriate to
rely on the vendor community mmm we have
a love-hate relationship usually but not
so much with the vendors what the vendor
sales teams but generally speaking
products and services and feeds and
reports you can do a lot in consumption
if you're gonna generate you can't
really buy that capability so much as
having key players no other process in
your organization is going to be as
analysts dependent as generating Intel
team if you have a single key player you
probably should not stand up a team that
person is eventually gonna leave or get
hit by a bus or something other right
and you're gonna have a very expensive
Intel program I generally like to see
consumption moving to Intel generation
finding that key player first process is
building at a team structuring training
internal documentation processes all the
process and if you're able to do all the
process and documentation and how the
Intel sort of training is gonna take
place and how we're gonna get that
analyst spun up and then you land with
three or four analysts that are key
players that's when you can go ahead and
make that determination that I can do an
intelligence generation team because
otherwise what will happen is no matter
how badass your Christopher Lee is it is
still one thought process and you never
want one
thought process when generating
intelligence requirements and when
generating intelligence off those
requirements you will get very very
biased perspectives I am a white guy
from Alabama who served in the Air Force
then in an intelligence agency nobody
likes me more and focus a lot on ICS
holy crap I have a lot of bias on me no
matter how much I try to defeat it I am
biased by a lot of things so if it's
just me driving the Intel in that
company it's going to have a flavor on
it that might drive my company in the
wrong direction you need a very
competitive analyst process so with that
as we run at a time here also Alan
Turing you can't like not mention Turing
in a world war 2 presentation by the way
I like this quote here we're not
interested in the fact that the brain
has the consistency of cold porridge at
the time people were arguing with him
about well it's an art versus science
and you can't make a thinking machine
because the brain is so complex you
can't make it you just can't do this you
can't formalize this it's not a thinking
machine and when he tried to explain how
we could people were like oh yeah yeah
but if you can explain it it's not
thinking and his point was well we don't
seem to mind that the brain is just a
bowl of cold porridge yeah we're all
convinced about its thinking capability
I can do it with a machine so here's my
pushback to you all you're gonna run
across the dialog that it's all art not
science and I call a lot of
what we do that we call art is just non
formalized processes that we feel
comfortable with you are going to be
able to formalize the processes I would
use the sliding scale to get started in
terms of where you're actually doing
intelligence move it up to strategic and
as you get more requirements build out
your intelligence generation team make
sure you have more than one person doing
that that is your formalized process
it's one sample approach to yours may be
different that's one sample approach to
how to meet those requirements for you
[Music]