[Music]
thank you very much uh chris
so as you know
uh previous panel talked about search
service framework tools but also
outline the necessity to have data that
enable them to stay ahead of the game
and understanding the threat landscape
i have couple of speakers with
this session
and they will present on threat
intelligent sharing platform and tools
the desired outcome is to reflect on the
strategic role of search platform
and promoting collaboration amongst the
cert and supporting national and
regional exchange information model
our first speaker will be
andreas
eclody
andras works at the
luxembourgian computer security
assistant response team
serp as software developer
and he has been developing the missed
call since early 2030
andreas
over to you please
thanks a lot
and thanks for the introduction uh so
yeah indeed the plan is to talk a little
bit about
information sharing via mist
and also a little bit about what we as a
c cert
do with misspell so i hope that my
screen sharing is working now can you
see the slide
yes okay perfect perfect
uh so a little bit uh to start this
whole thing out what is misp in the
first place and what is the thing that
i'm going to be talking about
so misp is a threat information sharing
platform so it's free and open source
we've been developing it for a pretty
long time now so the whole thing started
in uh 2012 early 2012 late 2011 so quite
a long time ago and it's been improved
over and over by the community and by us
as well uh ever since
so it's basically the idea of a tool
like this uh threat intelligence
platform in general is that you're
taking in data from all sorts of sort uh
sources now misp is a little bit
different than some of the other threat
intel platforms is that it has a heavy
focus on sharing so that means that a
large part of the data that we're
dealing with uh with ms is basically
data that we are receiving from our
partners from our community
uh from other c certs and so on
as well as osm data obviously so we take
all of this data uh
that we produce ourselves that we
receive from oscent that we receive from
our partners we harmonize this
information we correlate it and we
enrich it uh by our internal tools via
the different tools
and subscriptions that we have
for services and then we can collaborate
on this information and feed our
automated protective tools with this
information
uh so that's one of the main outputs of
of such a tool so this is just a quick
idea of what mispis and what threat
intel sharing platforms in the first
place are
so who are we
we are basically an organization called
circle and we are the luxembourgish
national sea search for the private
sector so that means that we're funded
by the ministry of economy to build
security for the community at large now
luxembourg is one of these weird
countries that is very interconnected
due to the fact that a lot of
organizations are incorporated in
luxembourg so we we have a pretty wide
reach in terms of what we consider our
constituency and we and we want to
basically build these tools and data
that we're building
uh for the global community because of
that
uh we're also partially co-funded by
various eu projects to build a
build our tools including misp
uh so basically our our involvement with
misp is that we are leading the
development of the tool
as well as projects related to it as
well as managing a bunch of different
communities out there for the private
sector for cesar networks
for law enforcement military
and intelligence
communities financial sector and so on
and at the end of the day we're also
have users of the tools so we can give
you those a perspective of of uh what
sort of issues we're trying to tackle as
a c-sert basically uh using the tooling
uh itself
so
first of all before we get uh look into
the
the how and why
for using tools like this let's talk a
little bit about open source and this is
something that uh that has been a
recurring topic i think during the day
and the advantages and disadvantages of
open source uh i think that one of the
most overlooked and one of the most
important advantages of open source
tooling is
it's really that we're that most of us
uh that are in c-certs or
or socks or other security
teams we have a fixed budget that we're
kind of tiptoeing around every year and
there is no way around that we have to
fit everything that we have to do into
that budget now where we spend the
budget has a different impact on how we
as an organization can grow over time
so generally when we're in when we're
looking into different tools that we can
use we have the option of either buying
services so going to service provider
that will do all of these tasks for us
the downside of that is that we are at
the mercy of the service provider our
data is usually not kept within our own
premises
and depending on what happens with the
service provider might have an
operational impact on what we do
on the other hand we can also purchase
tools and basically run those those
proprietary tools ourselves uh in-house
now the downside of that is that we
besides that the
typical uh issues that come up like not
not being able to vet the source code
for example of the tool and know what
the tool actually does under the hood
is that most of our budget will be end
up spending on licensing and support
that means there's very little what we
can do ourselves to influence how the
tool works
and if issues pop up it's our support
contract set that we have to rely on
so it's not a bad option in terms of
keeping the data in our own network but
it's still
a black box that we're dealing with so
to say and we're still ending up
spending our budget on the licensing and
the support
now open source on the other hand allows
us to take our entire budget that we
have for the tooling and invest it in
personnel that will run the tool and
that will basically improve the tool
uh and the advantage of that that is
that training our own
colleagues
or hiring more
more team members
ends up uh growing the maturity of us as
an organization so these are reusable
skills uh and the personnel that we
basically end up hiring to manage these
tools can be used for other tasks at the
same time so it's enough to win for the
organization i think this is a really
overlooked fact so i highly encourage
everyone to also take this into a
consideration when you're making those
decisions between open source and
proprietary tools
that basically the entire budget would
in the end flow into uh enriching your
team
now
some of the let's look at some of the
cases
that we as a cser deal with with sharing
information in general and where a
platform like miss becomes interesting
for us
so we basically take the different tasks
that we do
at our certain in four main categories
um especially those that have a
at least some information sharing
connections we have our core services
such as incident response we have our
proactive services that mostly deal with
generating
security data like feeds or alerts or
notifications to our constituency
uh and also advanced services that
mostly deal with uh with collaborating
during incidents uh
with law enforcement with the judicial
arm or with the victims themselves
finally another main group is also
being an enabler for information sharing
but we'll talk about that in a moment
so
let's first look at the core services
part so i already mentioned that
incident response is a huge part of
this pillar basically for us as c-cert
one of the biggest tasks that we're
dealing with or one of the most volumous
tasks
is the instant response itself that
means whenever we are involved in in the
instant response that we get called in
by an organization
we basically have our process that we do
that we do starting from the uh
from the capturing of the data
investigation itself and then finally
the outcomes and dissemination of the
outcomes uh to the community so we
basically use uh miss partip as a
an internal storage for the ongoing uh
flow of the information that we derive
during the incident so that means that
if we're seeing
ransomware case we're extracting all the
technical information and we're storing
those in our tip
we basically derive indicators and
correlate this information
on the go in the system we enrich it
using internal lookup systems that we
host ourselves
such as passive ssl passive dns
systems and so on as well as all those
services that we subscribe for for
example virustotal domain tools passive
total whatever so a bunch of these
different services
so we basically immediately get more
information on the incident that we're
dealing with
by inputting it in our system and it's
automatically running these correlations
and lookups for us
so sometimes we
immediately see okay this is something
that the community already knows about
we don't really care about that much
about
deeply diving into it we see what we're
dealing with here so we save ourselves a
lot of time now this is where osm
information becomes interesting as well
because osint information allows us to
cross-correlate information and see
these are things that have been seen by
the community at large already so we
already get a pivot point that we can
use to investigate further whether it's
fully overlapping with what was shared
in the ocean community for example
we can also coordinate things like uh
like the actual instant response process
we can invite our partners to join our
uh
our mist
and to actually collaborate with them
and uh in the entire instant response
process and share what we are seeing as
we as the analysis goes along we also do
some additional tasks with missiles such
as takedown requests so what one of the
outcomes of an incident is often that we
end up with a set of infrastructure that
we're seeing is compromised and used by
the attackers that we should take down
requests to the
various service providers
so we have the tooling for that
available and let's do that directly
from there
and also we basically have another
system that we use to monitor
a bunch of different sources for
information leaks and we share the
information that we find there
uh through mispassword if you're
interested in the tool by the way the
link is there at the bottom it's called
air framework it's also open source so
just feel free to install it and get
started with it
now for the proactive services this is
uh where we produce data so that means
that uh that both as an outcome of our
internal analysis and research as well
as redistribution and enrichment of osnt
information goes uh goes into this
pipeline we basically take data from all
these different sources we put our own
analysis efforts on top of it and then
we share that information back to our
constituency
so we act as also an aggregator as well
as an enrichment
organization basically in this case
so i'm not going to go too deeply into
all the different options here it's a
pretty loaded slide so feel free to have
a look at that afterwards we have a lot
of options there of what you can do
now for the advanced services this is
something that uh
that obviously not every c cert
or cert will do in general but for
national c certs uh this is something
that is much more common to collaborate
for example or be called into uh
to to instant response cases where you
also
uh the uh
victim also wants to involve law
enforcement for example so this would be
something where we would collaborate
with them as well now one of the
interesting outcomes of a lot of these
cases is also the disclosure and the
sharing of vulnerability information so
we don't just share information about
the actual threats themselves but also
very often engage with vendors or with
with
close communities to share information
about the different vulnerabilities that
are found so even before it gets to a
point where a cve is being reported
there is already information sharing
going on before that
for the entire vulnerability disclosure
process
so you can coordinate the entire process
involve the vendor
work on a fix or wait for them to report
back uh that issues have been fixed and
then go through the open process of
reporting it
finally uh and this is something that uh
for most uh national entities will be
interesting uh uh one of the things that
we do is we also run a lot of
communities for
uh sectoral uh
groups as well so that means that if you
want to be an enabler for example for
the mandatory reporting duties of the
different communities
this is something that you can very
easily set up by running a miss
community for that specific sector the
specific group that needs to be involved
in that
also another interesting side effect is
that you can also use a community like
that uh
for the different members to be able to
seek
additional help for collaboration
so very often uh
when it comes to different levels of
maturity of the organizations this is
more and more required
so
besides these different sharing
activities one of the other goals that
we generally have and i highly encourage
everyone to think about stepping outside
of their sectors their national
boundaries and start to build larger
interconnected networks of sharing now
one of the interesting things is
obviously the most most important data
that you will be seeing is whatever
targets your organization your sector
your geographic location but there is so
much overlap going on between the
different attacker techniques that are
targeting the different uh
victims out there that sharing the
information about these different
attacks helps you basically see the
trends of what attackers are doing in
general
so uh one of our our our goals basically
uh sc cert is also to bring together
these different communities out there a
lot of the sharing in these uh these
silos of sharing that have been popping
up over the past decade such as
financial in sharing communities and so
on are already somewhat well organized
but the sharing between these different
communities still needs an extra push so
this is where where all the sisters can
play a huge role
so yeah this is basically what i just
went over so we can hop over that
now some something else is an outcome of
this entire process is that you're also
raising the maturity of your community
and you can really
take additional steps to make this go
faster than
than it would naturally in a sharing
community so one of the things that you
can do is when you're sharing
information and this is a large part of
information sharing nowadays it's not
just to share data and information used
to detect or block malicious uh
actions but also to share methodologies
so whenever you're sharing
what you uh the outcomes of the
investigation also share how you've
reached those conclusions
one of the things that has been
absolutely great to see in the community
is for example the sharing of detection
rules
of uh of scripts that the people used
during uh hunting
for for a given attack
these things being included together
with the actual threat reports become
super interesting when it comes to
giving ideas to other organizations in
your community on how they can
tackle similar threats in the future and
if you raise the maturity of your
community you will benefit from it uh
over over the
longer period of time anyway first of
all because you're interconnected in one
way or another with your sector or with
your
national community
or also simply because you will get
better information shared back to you
that you can use
uh but with all of this uh
anything that the that the tooling that
uh that we're talking about here will
solve for you nothing will actually
overcome the toughest challenge of all
of that and that is building trust
so having communities having community
gatherings is one of the most important
parts of the entire process
and also setting up play playing rules
that basically everyone can agree to
so to get started with misp you have
basically different ways if you if
you're interested in it first of all if
you're a first.org member you already
have access to ms benson so log into the
uh
miss vincent stuff first
you should automatically get access if
you're authenticating via the uh
iem solution of of first uh and finally
if you want to uh
join any national or sectorial missed in
your region reach out to them if they
have a miss
and if they have a community and if no
you can always set up your own it's an
open source tool all you need is a
server that you that that you can
maintain and install misspawn and then
you're good to go and then you can start
interconnecting with uh peers with other
communities out there and start
exchanging
information with them
so misp itself is one two out of uh many
that you that you should be looking at
uh
for open source tooling nowadays you can
pretty much build your entire tool chain
out of open source tools if you're a
c-cert
so we're living in pretty good times for
that
we have another tool that we're working
on currently called cerebrate that we
in particular want to build as a
community management tool
so this tool is being built as part of a
new funded project called millicertis2
the idea behind this tool is to first of
all do community management tool
interconnection orchestration as well as
fleet management for tools like misp
so to
summarize this whole thing because i
think i'm being a bit slow here
what you get out of all of this is you
end up with structured actionable
information that you can use for
detection blocking and so on based on
what your community produces what osm
data you get from uh
from out there
uh what data you get from vendors and so
on and you can collaborate on this
information uh
and also in your ongoing incidents using
this information
and build your
productive tools out of that pretty
easily
and also
last but not least again raising the
maturity of your community should be
always
one of the main goals of running a
community like that so if you're looking
into that direction this is one of the
biggest outcomes on there
there are some ways to connect to us and
some ways to get more information listed
there on the last slide so feel free to
reach out to us anytime if you have
questions if you get stuck
with it or if you just want to validate
your ideas on how to build a community
just let us know and we're here to help
so thank you
uh thank you thank you very much uh
andreas
for your presentation around community
building tool and these
something that comes
often
in
information sharing
is
the need for a vocabulary
of event recording and student sharing
and also
uh being able to like have a kind of
common languages for describing security
incident on this note i will i would
like to invite john greens
john graham has over 19 years of
experience leading investigation of of
the elaborate and cyber security
incident
with the government and civilian
security sector uh over to you uh john
thank you very much are you able to see
my screen okay
yes
okay
excellent so
as i was introduced my name is john
grimm um i'm going to talk about the
varus framework the vocabulary event
recording in incident sharing it's a
framework that we use here at verizon
for building out our data breach
investigations report it's our annual
publication into the world of
cybersecurity incidents and data
breaches
we've been using varus for a number of
years the dbir is 14 years old and varus
almost goes back and far
in time in terms of that report itself
so i have a background in digital
forensics and cyber counterintelligence
uh from both the u.s army as well as my
years here with verizon in the uh the
corporate world
dealing with data breaches for our
customers so today i'm going to hone in
on the a4 threat model which is a core
component of the varus framework this is
something that organizations can use for
both
cyber threat hunting as well as
incidents as well as some other use
cases that i'll use toward the end of
today's session so
let me go ahead and get into defining
the varus a4 threat model so it consists
of four a's as you probably very much uh
can imagine with the the title of a4
threat model it's actors and actions
assets and attributes so actors are the
subject of the sentence if you're
looking at a typical english sentence
where these are the folks who are
conducting the actions which is the verb
of the sentence so actors and actions go
hand in hand they help us understand who
the threat actors are
the assets and the attributes are the
object of the sentence the assets are
what is being impacted in terms of the
threat actor activities and the
attributes are how we are showing the
impact to those assets and specifically
we're using the cia triad
confidentiality integrity and
availability so if you're interested in
learning more about varus the a4 threat
model and the vera schema in general
please visit the links that are on the
bottom left of the screen various
community.net as well as github.com i'll
provide these links at the end of the
session as well
so let's look
at the outputs from using the varus a4
threat model so this is just an example
of data data that i queried against our
data set from the dbir we have the dbr
data set which has 83 different
contributors worldwide in our data set
that's looking at breaches and cyber
security incidents so here i'm primarily
looking at breaches on the screen here
that i'm sharing and these are breaches
as defined by
cyber security instance was a where
there's confidentiality impact at 100
percent of the time what does that mean
that means we've confirmed that a data
breach occurred there's been a
an exfiltration of breach or a
compromise of data exploration of data i
should say or a compromise of that data
so on the very left hand side you can
see that data varieties and privacy
breaches this is how we show the
confidentiality attribute we're looking
at 2020 data
2271 different breaches and you can see
here percentage-wise the breakdown of
personal versus credentials medical bank
payment and internal this is very
informative this gives you an idea of
what's happening out there with breaches
involving privacy data when we look at
the actors which is the first a of the
a4 threat model highlighted here the top
three actors looking at 666 different
breaches involving privacy data
organized crime as you can see is number
one followed by an affiliated and system
administrator so the first two are
external actors the third one is system
administrator which is an internal actor
followed by developer and end user which
are also internal actors so this gives
us some granularity beyond where they're
coming from i'll talk a little bit more
about who these threat actors are or
more specifically the different
varieties of threat actors here shortly
but i just wanted to give you an example
here of what the information looks like
when we look at the verb for the subject
verb object of the air varus a4 threat
model you can see here looking at 1847
data breaches involving privacy we've
got use of stolen credentials which is a
hacking action a variety followed by
misconfiguration which is an interaction
variety and fishing which is a social
action variety so this kind of gives you
an idea from the standpoint of cyber
defenses as well as intelligence where
to focus your defenses on in terms of
privacy breaches and how the threat
actors are
actioning against those assets that
they're targeting so speaking of the
assets which is the third day of the
fourth rap model
these are the asset varieties and
privacy breaches looking at the 2020
time frame web application server at 55
and mail servers at 45 44
followed by database servers at 17 and
then documents which is a form of media
at 10
and then finally the fourth a here is
attributes and we're only looking at the
integrity attributes the confidentiality
attribute is in the data varieties on
the far left of the screen and the
availability just not showing that as an
example but i will talk about that
shortly so you can see the top three
integrity varieties and privacy breaches
or software insulation at 56 percent
altered behavior at 41 and modified data
at 22
so this is an example of how you can use
the data in terms of various and more
specifically the a4 threat model to
convey what's happening in terms of
specifically here privacy data breaches
so let's let's take a step back here and
look at the action so
i did skip over the actors there are
three actor categories the external
internal partner external actors
do not have any legitimate access to the
data the assets the environment they're
outside the building logically or
physically they're halfway around the
world logically they just do not have
access and they're actually attacking or
hacking into the environment
the internal actors have some level of
trust and privilege to the data the
assets in the environment these folks
are nefarious as well as folks that are
committing errors so they're not
necessarily nefarious so internal actors
for varus are those folks who have some
level of trust and privilege they could
be an end user they could be assisted
administrator they could be a manager
they could be a finance person
the actions are what the acts are actors
take and there's seven action categories
you can see here starting from right to
left or environmental and physical those
are two actions that we see sometimes in
our case load as well as in the overall
dbi or data set not so much though
compared to the other actions a good
example the physical would be your
payment card skimmers for example
when we look at error which is the
bottom left there these are actions
committed by the internal actors or the
partners the partners or actors who have
some level trust and privilege to the
data the assets in the environment
errors do not typically have a motive
but again
they are mistakes and they are committed
by partners or internal
actors misuse is another action category
that could be committed by an internal
actor or a partner actor this is exactly
how it sounds it's misusing or abusing
something such as credentials or
hardware data and it leads to a data
breach social malware and hacking are
the top three actions we typically see
across the board social is the very
front end typically of a path-based
attack where it's a threat actor
externality organization that's
leveraging the human element sending out
featuring emails for example or
pretexting
the the targeted entity and gaining
access into the environment or gaining
access to the data hacking or the
actions taken by the attacker and
malware are the actions taken by the
malicious software so these are the
seven action categories they're good to
know
but what's even more informative is
knowing the varieties underneath each
one of the actions and this is just an
example here of hacking actions and
breaches if you're interested in
learning more about the data that's been
put together by our data scientists you
can simply go to the interactive website
the link is on the bottom this is just
screenshots from that website this shows
actions from the standpoint of motives
espionage motive in yellow at the top
financial motive in orange at the bottom
so we've got two motives that we
primarily see within the dbir data set
number one motive is financial by far
number two is espionage and then after
that there are some minor motives like
such as fear ideology grudge and fun
which i'm not showing here on the screen
so the varieties are the more
detailed uh
information that falls under each of
those seven action categories here we're
only looking at hacking actions and the
varieties here you can see for espionage
the number one variety is exploit
vulnerability followed by use of back
door or command control and for
financial the number one variety there
for hacking is use of stolen credentials
followed by brute force and in the
inside there on the top right is vectors
it's another way that we can look at the
data going beyond the varieties we can
look at the vectors or the pathways or
or the methods or or i should say
the ways that threat actors are whatever
threat actors are using uh to gain
access using those varieties such as a
web application as you can see or
command shell
desktop sharing software for espionage
and web application desktop sharing and
backdoor c2 for uh the financial so
another way to look at the data the
results of uh
using the various framework or more
specifically
using the a4 threat model so this is
what it looks like behind the scenes if
you're interested in learning more
behind the scenes please go to
varuscommunity.net this is just again an
example of the hacking action variety
and the hacking action vector so we
define hacking this particular case on
the left hand side there and the columns
are in the middle and to the right the
three columns that you see first are the
hacking action varieties in the format
of action.hacking.variety
i underlined some of the ones that we
typically see over the years such as
brute force dos or denial service use of
backdoor c2 and then on the far column
is the
action.hacking.vector which is our
hacking action vectors
backdoor c2 are some of the more common
ones we see
desktop sharing as well as command shell
vpn and web application so it doesn't
look as as nice behind the scenes here
but this just gives you an idea of the
variety of different varieties for
hacking actions as well as vectors
that you can code if you're going to use
the varus framework knee for threat
model now of course this is uh by far
not everything that can occur out there
if you have something that's unknown and
you're not sure you can code it as
unknown and if it's other and it's not
fitting within the bullet bullet-sized
varieties and vectors here you can
certainly code it as other or you can
expand varus and start including newer
hacking varieties and vectors as
you know technology progresses
okay so let's look at an example of
using varus for coding so this is uh
vcdb coding so this is the varus
community database this is an open
source project where organizations folks
can use varus
code publicly disclose breaches and
incidents into the varus framework and
this is just a graphical example of a
famous um
or or a well-known case that involved uh
ransomware and specifically it's the
colonial pipeline so on the left-hand
side you can see an excerpt from an
article may 7th that outlines what
happened with the attack
it's great to read but it's very heavy
in terms of text if we use varus to code
what happened with that publicly
disclosed breach you can see the graphic
here in the middle and you know to the
right hand side of your screen here that
talks about the different components of
varus we've got victim demographics
there on the top left on the top right
our discovery method which was active
disclosure something that we typically
see with a ransomware attack
in the top
middle is attributes your
confidentiality integrity and
availability so was there data
disclosure absolutely yes that means
it's a breach what kind of data
varieties was it internal as well as
credentials
integrity was involving software
installation and the availability is
obscuration something we would see with
uh encrypted files the bottom left are
actor action and assets the three a's of
the four a4 threat model the top a
attributes is the fourth day so we can
see it's an external actor financial
motive using hacking and malware and
attacking a database and then you can
see the event chain there event one two
three and four walking through the
hacking the malware actions
telling the story from that standpoint
so just an example here of coding with
varus as i move through here another way
that you can use varus is the a4 uh grid
so taking those four components of the
a4 threat model the actors the actions
the assets and the attributes and
putting it into a grid here so
the very far left you can see assets dot
attributes that would be the yx axis and
the x-axis would be the actors dot
actions i believe i got that right x and
y and you can see how that you can pair
these up and then look at your
organization's incidents or breaches and
start filling in these squares to get a
heat map and giving you an idea of where
you need to focus your cyber defenses
and your detection response effort so
another tool that you can use for varus
finally here for varus we have the varus
framework here in the center which is
very good for incidents and breaches
that's what it's focused on it doesn't
get into attribution per se or some of
the more specific details in terms of
iocs or even counter measures or
controls so what we've done is we've
mapped the varus framework to miter
attack techniques you can see that on
the left hand side to help fill out
better what's happening with the
attacker activities and we've also
mapped varus framework to the assist
controls on the right hand side to
better
convey what countermeasures and controls
should be taken by a cyber defender so
we've been using assist controls for a
number of years in the dbir and we've
been using the minor attack techniques
for the last couple years in terms of
helping to show folks what's happening
out there with the threat actors
specifically
so various use cases so as you can see
we developed varus as a way to share
information a common framework a common
language for
for
for discussing events analyzing and
including in our dbir
this is something that we put together a
number of years ago in the early days of
the dbr that really help facilitate
collection and analysis it's something
that we've opened up to the public so as
you can imagine
it is a common framework at lingua
franca for sharing information
it's also codifiable or codifiable or
very sizable and shareable from that
standpoint
it's good for metrics performance
measurement risk management assessment
resource justification and strategic
planning
a lot of organizations look forward to
the release of the dvir every year so
that they can do their strategic
planning and resource justification but
other organizations may use the dbr and
or varus to help understand what's
happening in their environment i
mentioned the various community database
previously that is one of the
contributors to the dvir it's the only
data set that you ever know who the
attackers were or i'm sorry who the
defenders were because it was publicly
disclosed breaches so you can use the
vcdb to compare and contrast what's
happening in your environment in terms
of looking at it through the varus lens
we've also mapped to the cis controls as
well as the minor attack
and then finally you can use it simply
for instant triage for your sock your c
cert and your different teens and threat
modeling for your cti attribution and
your threat hunting
so if you're interested in learning more
there's some resources here the top
three bullets are the dvir and the
interactive website that i showed a
couple screenshots from to include dvr
fax figures and data the middle three
bullets are specific to the varus
framework the a4 threat model and the
varus schema on variouscommunity.net and
github.com and then finally the last
three are the various community database
varus web app and the varus coding style
guide so we do have a web application
that's that's available to code your
incidents and your breaches within your
environment into the varus web app
it's something you can use internally
and not share with anyone
we do ask if you're interested in
becoming a dbr contributor that you
verifies your data first and you
anonymize it varus is meant to um is
built with uh with that in mind
anonymizing the data before you send it
to our data scientist for inclusion in
the dvir that brings us to the end of
the session
and let's see if there's any any
questions at all
uh thank you very much john i'll
get question at the end to
deal with that
that is awesome you just responded to
a discussion that happened
uh last last week about challenges in
sharing event information
and i'm very glad that we were able to
make this presentation and also
very delighted to see how it realized
with
milo attack and cis control
i think thank you very much you're very
welcome thank you yeah so we talked
about platform
and uh john just presented
uh about uh
vocabulary and
need to have a kind of common language
for describing security accident
in a structured and repeatable manner
but where do you get those data
i would like to invite
pierre
from shadow server foundation
to
talk to us about
how shadow server contribute to
[Music]
coordinating last scale
[Music]
data collection and analysis
and also
uh
shadow server work with c cert and
various organizations uh pierre
over to you
uh thank you very much general barrett
uh thank you for having me on in this
session
um yeah so my name is
um can you see my my uh presentation in
full screen
just maybe yes we okay good
so i'll talk about uh well uh shadow
server and uh sharing uh free threat uh
intelligence at scale uh this is mostly
raw threat intelligence so you still
have to do some processing um
on the way up so to speak
um but uh yeah i'll give an overview and
uh also from the point of view of africa
and and the arab region um as well
uh so if you haven't heard of shadow
server um shadow server is not for
profit
i'm working to make the internet more
secure for everyone we are uh u.s based
and netherlands based
and we have been around for for well
over 15 years already and
have been well essentially
giving data away for free to
uh national sea certs and any
organization that owns a network so is
it an isp
an enterprise a bank
a university
essentially anyone that has any any any
address space assigned to them
um we have many unique sources from many
takedown operations conducted with law
enforcement um we have a global vantage
point and proven partnerships with
many national seasides around the world
law enforcement agencies and industry
and security researchers worldwide most
importantly what we share we share at no
cost to the end user at all
shadow server um
collects a lot of information and we do
it at at big scale uh there are very
many data sets we collect at scale at
shadow server these these just are a
highlight
of some of them um we are pretty well
known for scanning the internet
all the time so we have like the slide
here is 45 but we actually have 68 scans
running every single day
um
so we have a whole history of of the
internet as it's seen from from from
outside um with scanning for the last
few years
um we disrupt uh botnets
we think all uh threats by typically by
taking over over various uh domain names
like used for criminal infrastructures
and we direct them to our own um
own infrastructure so we have insight
into infected infected end users which
we then share out
we run sensor networks honeypots
essentially thousands of honeypots all
around the world running
simultaneously
which gives good insight into various
iot related attacks or or
attacks or oriented at web applications
or any essentially any exposed service
we collect malware data at scale um with
over essentially a million uh unique by
hash malware samples every single day
for a total repository of 1.5 billion
samples and we run these through
sandboxes
including our own proprietary ones so
that gives insight into
uh what the latest malware is doing
um we collect uh digital we go at ssl
certificates at scale so we have uh
essentially like 50 60 million uh
collected every single day that gives
good insight into criminal
infrastructure as well because criminals
also use
um ssl certificates to encrypt the
traffic
and all of this and while other data
sets is around 12 metabs of of malware
and threat intelligence stored and the
results are shared with uh with network
owners
um
so when any organization owes a network
over six thousand and uh national c
certs in uh in that cover 173 countries
and territories
and a lot of this is also used for for
law enforcement uh investigations
so our primary service uh and the one uh
it's easiest to subscribe to it's
everything is automated here are our
reports and and there is no reason not
to subscribe and get these reports
because if we are seeing something uh
then it's very likely a criminal actor
is also seeing something and they can
use uh these
uh the things also that we find to
actually get into your network and it's
better to learn from us than from a
ransomware note
that you have been being compromised so
no reason and not to not to subscribe
um to give you an idea of the scale uh
we see around 200 million for uh
accessible open vulnerable services per
day on average um and about 5 million
affected addresses per day on average
globally just in our sinkhole so that's
without the honey plots dark nets or or
or other means of observing observing
attacks um for africa um around 2.2
million accessible open vulnerable
services that doesn't mean all of them
are vulnerable but the ones once we can
see and
under certain circumstances they can be
exploited
and around 450 000 affected addresses
per day on average in africa um the
profile for africa is a bit different as
you can see a larger percentage of
devices infected is is like android um
instead of like the more infrastructure
server-side-based
things we see in in europe or or the us
um national seaside's receiving fees so
countries in green have a national
entity um receiving
our data on a daily basis um as you can
see here um
there still is some work to do to do in
africa although we have improved over
over the last year in terms of uh
outreach and we provide data to at least
20
national sea certs in africa but more
more to cover there also also in
in the arab states uh there is there is
some area of improvement uh so uh like
these are the latest um
a
list of countries within africa with
missing c-certs getting data at the
national level so this can be a
government c-search or an entity set up
as a national seaside or somebody acting
um as a de facto national t-shirt if
there is no no official no official
presence
if you have a contacts in any of these
countries or are from any of these
countries then please please let us know
and maybe we can we can help out and and
share data
there
similarly with with arab states uh
there is there
there are a few that that could have
could receive data
at the national level from us as well
um these are direct report recipients so
entities that have signed up directly to
us so not national certs so you can see
the numbers for for africa
typically uh these numbers are well
unfortunately uh pretty low just a few
um entities in a country often
multinationals that simply own eighty
space also in in these countries
um in africa predominantly south africa
kenya
um
has had the most but essentially even
larger countries like large countries
like nigeria egypt i just just have a
few entities
receiving data directly so if you have
like contacts with isps or other
organizations that you think should be
receiving our feeds directly just also
please point them
point them to us
similarly for for the arab states
coverage
could be
much better with the highest coverage
game and then the emirates
as such the other countries in egypt
saudi arabia still
pretty pretty low
and this is an asn view of of all the
asms out there that are assigned to
africa that are actually receiving our
data um
and uh you can see in red essentially
asms that are unfortunately not
receiving
data so uh well quite a lot uh to to
improve here in in terms of giving data
to
directly to organizations without uh
national certs uh as a proxy
um it looks uh even worse for for arab
states those arab league states um
lots
lots to improve here in the biggest
telecoms um out there um as well
um our reports are are described on our
website uh every report is different
they're approaching we're approaching 80
um reports uh right now
and essentially they they will report on
infections vulnerabilities ddos attacks
um uh essentially your assets that are
exposed on a daily basis and in some
cases there can be quite a lot of data i
showed the
total totals that we actually see for
for for the continent and for the
african continent and the world
um one thing that you might want to know
is that there are many optional reports
that you can also request from us that
you're probably not getting so if you're
already subscribing to to our our data
you should ask for a subscription to all
the optional reports if you're
interested and then you can have a good
asset inventory that will essentially
conduct for you on on a daily basis
and we've also actually um started to
introduce various ipv6 scans um this is
slowly being rolled out um so you could
probably subscribe to those as well and
first of all we have an api that you can
easily integrate with with your tools
and and to fetch our data automatically
or if you wish you can opt for the old
delivery methods of emails and and web
links
example reports
they have they are pretty well described
i hope on the website each report has
examples all the fields columns
identified
essentially all the reports are shared
in csv formats or if you use the api you
can also use
json json formats
subscribing is extremely easy there is
no
big process involved you just have to
get in uh
fill out the web form
that that requests some basic
information that we try also to use to
verify your your identity
and there is no formal agreement that
you have to sign or anything like that
if we verify you are who you are then
you will get these this this data well
pretty quickly
so um there's lots of data sets that
we're sharing and there's little time to
actually uh go through that so so i
won't um these are just some examples
just an example like for vulnerable
exchange servers there's lots of lots
happening happening regarding half him
and and and other actors uh um
exploiting the the
uh microsoft exchange vulnerabilities
from the first quarter
of the year and uh here is like an
example data that you could have
received if uh if you're subscribed at
that time um essentially vulnerable
um exchange servers also web shells this
kind of information that we discovered
um this is what africa looked like on at
that at that time at uh at the time of
that that incident with south africa
being uh most exposed and then egypt uh
second
um other countries uh to a lower lower
degree
um similarly here for uh
f4 for uh for more
arab regions uh
large focus like maybe in this case on
on the emirates as as being the
um primary affected uh entity but also
saudi and and and others as well
um our feeds uh well you can you can
either write parsers for them uh but
they're also of your own but there are
also many open source tools
that you can get
to actually fetch fetch the data and
they'll parse it normalize it for you
automatically and also share it out
with with your community many of these
are very focused on the national c certs
there are some gaps i think with tools
for for isps for instance or other
organizations
that these tools could be adapted to
handle but that's that's another story
um you can also use uh commercial tools
a number of these these these exist if
you're interested in commercial tools
and aren't aware of them you can also
contact us and we can tell you which
which exists
as well if you don't want to use open
source open source software
which you should
um one thing we also do for for
community building is honeypot sensor
networks so you're on a large-scale
honeypot sensor networks honeypot
service framework
um where you could actually run a
honeypot in in your network and get it
essentially rapidly deployed in a
thousand locations even
worldwide
within minutes essentially
um
and this is a project that that we run
that currently uh
has a number of different honeypot types
operating proprietary ones as well as
as well as open source ones
um if you're interested in that please
please contact us this is an example of
the honeypot network that
we are building a community honeypot
network
and
well recently we've also been funded by
the uk foreign commonwealth and
development office to expand in africa
and indo-pacific that was the start of
the year and we have received funding to
do it again
so we will be looking for for four new
locations also uh especially in africa
and and also the commonwealth uh
countries
um africa in more detail where we have
censors so you can see um south africa
is pretty well covered
um a few other countries like like kenya
egypt um
uh
but lots lots more to be covered uh to
be covered here
um and this is all based on a framework
that we developed uh for for european
commission funded projects so we can
have an example of how an eu project has
also um impacted um
the world hopefully um positively
an example of how we collaborate with
entities this is uh not not for africa
but it's for latin america where we
partnered with cydia and ecuador
to install our sensors in latin america
um we were interested also in similar
partnerships in
africa
as well
if you are able to host a sensor to help
us help you
um
and and the community um this is
all that's needed essentially a vm or
physical machine with very low spec
um
it just needs to be a clean and clean
ubuntu install
um the biggest requirement for for for
hosting a sensor is essentially uh
at least two ipv4 addresses have have to
be have to be assigned preferably more
to actually run the honeypots one is
used for is used for management
um so we are trying to also to engage
more and more in africa
as mentioned we have had a
sponsored project from the uk cdo now we
have another ukfco project
so we are seeking more national network
owner
subscriptions in africa as well as more
collaboration on on the honeypots and
we're thinking of you know how to focus
in 2020 and make it easier to benefit
from all our free services
so some things related to to africa um
that you can track on on our blog
we plan to publish a new blog on the
threat landscape in africa and
that the current threat landscape as at
least according to our data that's going
to be published soon so hopefully we'll
also offer offer some insight on what we
see
and finally to wrap up quickly um i
think you know the data is is here is
here for free uh it comes it's
there is a lot of it um we collect we're
probably the biggest supplier of free
threat intel um worldwide i think if you
haven't subscribed um then you should
subscribe and if you're subscribing you
should probably ask for more as for the
optional reports if you haven't already
um i think it's it's it's the best way
to to actually um kickstart your cert if
you don't have any or
or if you're if you've just started or
essentially even for uh for an advanced
cert i think uh it's getting more and
more important to have a good
understanding of uh what assets they
have to protect in in their country
and now for instance we introduced a new
device identification report that
enables you to understand what vendors
and what models you actually have
deployed in your network or your
countries to give you insight into what
you're actually protecting i think
that's that's a valuable report that's
set on set up by default that you can
also you can also get now
um so that's a very quick spin uh
through uh what uh what we offer um uh
we're a bit short in time and we've run
already
so i hope this was a good a good
oversight and um well if you have any
questions or or or or something uh that
you'd like to follow up uh please do
um we would be happy to uh to engage and
uh
hopefully make the internet a safer
place thank you
thank you very much uh cura
uh i like the finger we need you
i think that
a couple of
countries
that you mentioned about uh have not
been receiving your feed yet uh online
so this is the opportunity collect to
engage with the computer and the shadow
server
uh to start receiving
information related to your server
ecosystem
um something that i would also like to
mention to you clearly is i understand
that kovid has delayed a lot of project
but i still believe that
let's say
god willing next year we should think
about
the project of conducting training
related to
proceeding those those feed that
people are receiving it it will bring a
lot of relevance
in how different teams and different
organizations receive and appreciate the
information that they get for you and
the different tools and arrangement that
they can make iran's around that
information
um yeah definitely happy happy to engage
there yeah thank you
um so in purest talk he mentioned also
running and
deploying honeypot network so the way i
understanding is and also from
um
andras presentation
is that you can either receive it
but you can also produce feed
and i would like to invite
adelie waheed
from episodes
to
talk to us a little bit about
the community honeypot project
in the asia-pacific
region
and
the arrangement around that um abil is a
senior internet security specialist at
apni and he is an active member of the
security community even a former first
member
that was even in charge i know that a
couple of teams
that have received the fellowship from
first online so adley was one of the
people behind that as well
at first
and he is currently leading the aptly
community honeypot project
prior to joining apni technique
he served
the bank of tokyo mitsubishi
and the malaysia asserts so hadley over
to you
thank you john a bit uh hello everyone
and uh fellow uh panelists
um i'm adly from ap nick and uh it's
almost uh 3 30 a.m here but i'm still
wide awake don't worry about that
i'll take a few minutes to talk a bit
about our community hanima project i
think a lot of things have been said
earlier
i'm really happy to be here because i
think some of our experience doing this
activity here
might be relevant to our counterparts in
the african and arab region because i
think there are lots of similarities in
terms of the security communities
activities
the threat landscape and you know the
mix nature of the maturity so some
economies have you know very mature
research very active security community
there are some countries who are still
developing the capabilities and lots and
lots of interest in capacity development
um
[Music]
we are the regional internet registry so
our core business is not really security
but we see
capacity development and community
engagement in this area
as an important
activity or initiative so
part of my role is to do lots of
engagement which means
doing lots of training
supporting
sharing information and basically
highlighting some of the things that
were mentioned earlier by many of the
speakers you know the free services by
shadow server
the uh miss prep threat sharing platform
how to use it who's using it and what
you know what is the benefit
uh but the crowd or the audience that we
are normally engaged with are the
network operators which
uh in most cases sometimes hold the key
to fixing or doing resolution of any
other cyber security incidents that we
face
at the same time there are also
interests from governments regulators
law enforcement agencies in many of the
economies uh within the asia pacific
region in terms of trying to understand
what is really going on you know if and
if we are trying to improve our security
by developing strategies and whatnot
what should we put in there so we find
that there is a gap there where we can
play an active role
so through a lot of the capacity
development activities that we do with
this community member we thought about
the honey net project as one of the um
initiative that can actually
help people think
uh
about security and also get involved in
some of the security initiatives that
are actively taking places all over the
world
so uh for the seasoned security uh
person maybe you know you are wondering
you know why honeypots i looked up when
was the first time i spoke about
honeypots at a first conference and i
found that in 2009 i did a presentation
on honeypots and detection however in
our context of the epinephrine community
honeynet project
it is more for creating awareness i
think earlier there was a presentation
that talks about maturity which is a
combination of awareness
when you can do then you can do you have
capacity and capability to do certain
things
we find that in our engagement yes you
know people have been dealing with a lot
of security issues but in a lot of cases
the person behind the computer
is not that experienced or completely
new to the field so
by
going into the honey pots and when i say
honey pots we do actually do training uh
using honey pots uh where people can
actually see the attacks
and the artifacts and from there you
know they can do some analysis they can
appreciate how this works in
detection
um understand a bit of about forensics
uh you know risk management and so on
and so forth
um we started to do the training back in
2014 at bd dong so network operatives
group uh meeting in in bangladesh where
there's a bunch of isps
and it became one of the one of the hit
training i would say
since then and
what happens normally after each
training is people would be interested
in deploying their own honey pots and
would like to
share information and learn more so we
thought this was a good excuse for us to
set up this community of people who are
running honey pots
and
nothing much is expected of
them and
other than you know setting up a
honeypot and then you know let's do some
things together basically
um i find also that over time it helps
us to you know go into some of the more
advanced topic uh or some of the current
topics that everyone is discussing today
like the micro attack framework so we
can easily relate to what people are
seeing in their own honey pots into hey
this is what micro framework is talking
about and let's let's look at your data
for example we've been trying to
encourage people to go to the next step
by other than collecting information how
about we start a community that share
information uh proactively
through ms
and things like that
and i think most importantly the main
message is let's be proactive and take
action before an incident happens
or let's be more aware about what we do
in hardening our environment and
infrastructure and customers
so that you know when people need to
reach out to us we are ready to help uh
and even before people are reaching out
to us then we are already processing
information and taking action and
investing some time in security
this is my last slide uh so what is the
current state of the project so
fortunately um the the folks at ap nick
are very supportive about this
particular project uh because we find
that this is a very good excuse for us
to do multiple engagements
and to focus on various areas
we use a lot of open source tools and
you know all props and shout out to all
the open source tools developers out
there
we are thinking of ways to hopefully
support and fund some of these projects
in the future so that there is
continuity
and it will help the developers to
enhance the project that we use for free
um
there's been some collaboration as well
at our end mainly with large isps
universities and some national assets
and of course we are venturing into
trying to create smaller communities
where people can proactively share
threat information uh even if they don't
run honeypots so that's kind of the next
steps that we are thinking of over time
we have started to share feeds outside
the asia pacific community we started to
share some small feeds to with shadow
server
and and mis
internally at ap unique there is a
project that that is called dash that
provides insights uh on network
belonging to our members
so they can see if there is any
suspicious traffic uh or traffic going
to the honeypots as well as other
information about what routing security
and all of that
um the main outcome of this honeynet
project has been in the capacity
development activities as mentioned
earlier talks workshops um including at
ap cert taxon and many other security
events in the region
and as i mentioned earlier that one of
our concern is a lot of it a lot of
these tools that we use for free they
are being developed on people's free
time
and what can we do as a community to
then support them so that's one of the
areas that we are trying to help support
and improve
uh other than just running honeypots as
well
and with that i would like to end my
presentation and if anyone would like
more details on the implementation
because i don't think you have the time
for that
please reach out to me i'm more than
happy to share information and
maybe share some of the lessons learned
that we have experienced in running this
project
so john robert that's my short
presentation over to you thank you thank
you thank you
it's always a pleasure to have you um
thank you
um a lot of things that we can learn
from the ethnic experience and that we
can replicate
within the
african internet community
thank you for
for sharing that and sharing for your
experience
and i hope that
as we plan to reach out to you and if
you need to understand how
a similar initiative can be deployed in
the african continent i'm very confident
that you will be there
to work with us and with the africa
african community thank you so much
anthony
um to close this session i would like to
invite lawrence uma
to
talk to us about his experience
lawrence is a cyber security engineer
with over five years of his experience
he specializes in accident response
threat intelligence cyber security
training
leadership and currently manage the
security operations center at silence
tech
he is also the lead blue team consultant
that's happy rent over to you loris
loris are you online
yes i'm online
okay how about you
uh i hope i'm audible
yes
awesome i don't know if my screen is
visible my powerpoints are visible in
this video
yes
okay so
should be okay right now so first of all
uh welcome everyone morning good
afternoon and good evening uh wherever
you are joining us a special thanks to
africa such and fast for giving me this
uh opportunity to just share my
experience
in regards to cyber threat intelligence
so i will try to be as brief as adley he
has set a very
a good trend
so
my talk and discussion will basically
revolve around what i've done in regards
to
uh establishment of such especially in
the african market having worked with
the itu
on a few projects so most of the
speakers that have uh
just come before me are starting from
the morning session we have talked a lot
about uh existing frameworks
uh we have talked a lot about
consumption of cyber threat intelligence
i want to take
a slightly different
angle
and actually tackle honor
how we can
generate cyber threat intelligence
specifically i would focus on the
african uh context
i just a quick question
right now we have i believe around 54
countries in africa
in your own time just try to
find how many of those countries are one
have such and two how many of those
countries actually generating any form
of a cyber threat or intelligence
a lot of us
uh specifically such and just even
organizations
i believe for the last
ten or ten years or so we have been
doing a very good job consuming cyber
threat intelligence we have
matured processes matured platform
that have done a very good job in line
two supporting at the user however more
often or not
i've come across a question
by search
by the actual practitioners either
manning these arts basically asking us
or asking me in certain cases that
how can we start consuming
and
one generating our own feed sender
consuming those feeds and
sharing those feeds with the other peers
so the question here comes to
how do we generate relevant cti
in an environment where we have
technical uh challenges in regards to a
competency's point of view
where budget politics and trust
play a role and in most cases
these four are always trying to
slow you down
now before you handle but that list let
me just
go back and reiterate a few things that
i've shared
and just attached on i believe it's a
fact that ck consumption has matured
all the speakers from the morning
session are actually proof for this
a lot of platforms a lot of frameworks a
lot of maturity models all geared
towards that these are common goal
cta sharing platform also have a mature
miss pizza playing a very important role
now and it's just not only missed
other players are coming into the market
are 12 days
however
cti generation in most cases
has always been centered
around
deploying honeypot so deploy this
honeypot deploy that honeypot under and
you get cti
this bets the question
are we finding ourselves in a situation
where we have these amazing ferraris
amazing cars
but you are lacking competent competent
drivers who can actually actualize the
benefit these ferraris are meant to
offer the community of assets or any
other organizations who might be
interested into generating their own a
cyber threat
intelligence
having that in mind still comes back to
our question how do we ensure that
organization sites are able to generate
relevant cti ah in their environment
so
i won't i won't definitely not want to
bore everyone with that they all uh
threat intelligence generation framework
and cycle and all that
i'm going to choose to focus on three
aspects
planning direction and
collection specifically when uh
you are thinking of
generating threat intelligence
so first
in these discussions
one of the key thing that comes out or
that came out even in my engagement is
that
as an organization as a search you need
to know your constituency and
what is important and
relevant to them
i'll give an example so one of the
national assets you're actually working
with they had multiple constituencies
and each constituency was very specific
in regards to the kind of
intelligence one they want to generate
and are interested are interested in so
for one constituency they are more
interested in
can we get visibility on everything
related to http traffic related to api
another constituency
different approach for them they are
implicit in rdp ssh when you also get
people who are
playing are in the ot space totally
different
a requirement
planning and direction also helps build
on top of what other speakers have
mentioned
public private partnership as i said
i sound corrected but it's virtually
impossible for you to have a meaningful
visibility
uh in regards to census
for all your traffic because
you have the private sector doing their
own things you have the uh the academia
doing their own things in regards to
traffic the only way these you get this
visibility is by actually engaging and
working with this uh public-private
partnership
then there's that aspect over shared
prosperity
for this specific search
one of the main thing that actually
helped
uh this collaboration was they shared a
prosperity basically telling one
constituency that whatever you are
generating is going to help someone else
whatever they are working on is also
going to come and circle back and
help you
so that was a game changer
then threat modeling so threat modeling
basically goes back to planning and
direction in that
each constituency might be facing
different threats and it's only helpful
and meaningful for them to actually
collect intelligence related to their
threat modeling
now if
having figured out the planning and
direction phase the most
important thing now is
the collection
how
are we going to use
the planning phaser
input
and direct it to the collection office
so i will skip these i this laser
keeps appearing because
the main point is the
pointer is being able to collect these
relevant cti
so
the constituency model basically
works on the stakeholder approach i
believe that's one of the approach that
has also been championed by isoc
now when i'm when when you're looking at
this multistakeholder approach one of
the main thing
i advocate for and i've seen some good
success with is
going horizontal so basically going
horizontal basically means that as i
said
instead of uh
trying to lift this heavy burden
utilize
what is already existing
so
trust has been one of those key things
that has been mentioned through this out
as an organization a it is hard for
organization b to trust me either we
haven't had this kind of engagement
before however
both a and b will easily trust a
national a national center a national
entity
so going horizontal is all about public
private partnership being championed by
a national entity with focus on i shared
a
prosperity
so identifying your constituency as i've
said that you can't do this
alone
each different constituency each
stakeholder in that constituency will in
most cases have visibility that you
might not have
additionally they also might have
competencies that you you might not have
so
instead of
trying to reinvent everything and
build everything from ground up identify
the right stakeholder then i work with
them
communication and
identify the various champions so i
believe for this particular search
when you are rolling out this
a deployment
one of the main thing that actually
helped on board the various
constituencies and cement the
trustworthy the kind of communication
they sat harder with this constituency
so these were
a mix of uh physical meetings virtual
meetings where the constituency were
given the platform to ask questions
ask the technical questions the
executive question just for them to
understand
what the search wanted to do and how
that technology was actually
going to happen
and through asking of these questions
people are also able to fully understand
and
appreciate what the site was actually
trying to achieve this resulted in
fostering of transparency and just
building and
gaining more trust because
people will really
like change
if you're going to introduce changer
and there is insufficient communication
you basically introduce a stumbling
block in your path however
if you introduce change and you clearly
communicate change at this particular
change to the people you're going to
work to the absorption rate greatly
greatly i increases
uh moving on
so the other thing that uh in addition
to basically communicating
one of the other things that we actually
did was to reduce and eliminate the
learning and management overhead
so in most cases
this most constituency and most
stakeholders you'll be working they
won't want to increase the technical
overload they might be having they don't
want
to learn new ways to deploy something
or
figure how to actually deploy a solution
a strategy that actually worked for us
was creating
very simple manuals to set up sensors so
you basically tell
this particular
stakeholder that once you get
the sensor configuration run these two
commands
everything works
then secondly
one of the thing that we actually
capitalize on open source has been
has been mentioned multiple times here
so think over for instance creating
simple docker compose files create a
simple docker compose file
i tell uh
the partner you're working with in this
particular constituency
run this particular commander and at
this sensor i will be set up
so there's that fact of reducing and
completely eliminating that learning and
management overhead was
very very beneficial because at the end
of the day
the constituency definitely are going to
benefit from this
however at the same time you don't want
to labor them with that aspect over now
you need to learn docker now you need to
do a bcnd if they do it well and good
but they should not shoulder that
particular responsibility
now praising is always going to be i
mean
a major issue
one way to solve this is
go very affordable and one way to go
in a very affordable way either actually
using authors
so for these particular sensors and
honeypots we actually went with the
docker so we had
docker containers
then build on top of el canda i missed
just to ensure that the cost that
uh each the cost the cost basically that
the sat was in carry was very minimal
especially when it came to the technical
aspect of a setting up setting up these
then
having done that so
you have reduced already
eliminated at the learning cover
the prices the financial implication is
very low
how do you now
make use of existing cyber threat
intelligence
now the existing cyber threat
intelligence is still meaningful as much
as you are even creating your own
intelligence there is no need to
reinvent the will
one approach to use is actually
integrate your
the city you are generating with
existing cti and i'm i was very very
pleased and happy
to see the tunisian search team actually
doing something similar to that where
they basically integrate showdown with
what they are getting i don't know maybe
to reduce false positive or just to
further enrich uh enrich the cgi that
they are getting
now
all of these the main goal is to
actually get something similar like this
so
at the uh
at the bottom here we have the various
constituencies
in each constituency
you only deploy one sensor one sensor
running on a physical hardware which can
be virtualized
now in this physical hardware to ensure
we are maximizing all the resources we
have because that also translates into
budget
localizer everything you want to do so
in this particular case i believe
we had one sensor running more than a
five independent honeypots each custom
developed for that particular
constitution constituency
now given that we are running and the
minimizing cost so the sensor was a very
basic uh
machine
no premium as a specification
now everything from the sensor was being
shipped to
i was actually being shipped to
the search endpoint server a dedicated
server where all the heavy lifting was
being done now from this server all this
information was being enriched with
additional cti's trauma
other external partners
necessarily are part of that
constituency now where the constituency
felt the value and benefited from this
was that
each constituency was actually able to
access those feeds
via an access ba a role-based access
control system so in this case
you ship your logs
from the honeypot the honeypot reaches
the
uh the such infrastructure such does any
analysis enrichment that needs to be
done
then as a constituency you are able to
actually make use make sense of that
particular information
that you have
collected
so
that brings me to and and uh my main aim
and goal was just to share my experience
in regards to an approach that uh
we have user in deploying such and
deploying honeypot and helping us
especially in the african context
generators but great intelligence i
thank you so much and over to you
jane
yeah uh thank you very much uh lorenz
for sharing with us uh
your experience in deploying such
initiative and making also
cyber threatening images effective in a
resource constraint
environment
on this note i'm not sure that we have
enough time for question
but
you are welcome to
send your question or put your question
in the chat
we will
respond to them