i'm guessing you guys can hear me
yeah
okay
people still uh coming in a little bit
that's okay
thank you everyone for showing up right
after lunch i know you guys are probably
nursing your food comas uh there's gonna
be a little bit of audience
participation in this i hope i can get
you guys to to scream a little bit or
maybe raise your hands
uh but we're here and we're going to be
talking about threat intelligence as it
and whether it's actionable in in the
year 2022
that of course implies that it wasn't
actionable before 2022 that's not what
i'm trying to imply but but as as we go
through the presentation
um i'm going to show everyone how it
evolved from what it was and what people
considered threat intelligence circa
2012 let's say to what it's considered
today
right and and that's kind of the premise
of the talk now full disclosure there's
some academic boring stuff at the
beginning so apologies for that but
there are some concepts that we just
have to go through a little equation
nothing nothing too crazy but first the
obligatory who am i slide hi my name is
peter i've been in this industry for 16
years uh on a w-2 in the 90s i was
getting in trouble on the internet with
knocks on a door and this type of stuff
but i've worked everything from the
hedge fund space building high frequency
trading systems that are secure i've
been doing pen testing i've been doing
red teaming also application security
etc etc
and now i run the engineering team at
flashpoint which is a threat
intelligence vendor so that's also a
disclosure that i work for a threat
intelligence vendor right i think that's
very important to uh to tell everybody
because there's an inherent bias with
threat intelligence in general and
coming from a vendor perspective is very
different than threat intelligence at a
small company when you're trying to
protect your video game your bank
whatever so i think that's also
important another thing i'd like to
mention is like this this talk was
really inspired by mark arnold's talk
from this very conference in 2018 on
hacking intelligence also a great
intelligence chat if you haven't uh
checked it out mark thank you and i know
you're sitting right there
thanks very much and also i'd like to
say that i'm coming from a very
privileged stance in an organization
that has great makers organizations our
intelligence teams our product teams are
fantastic and i have to give a shout out
to my engineering team over 76 brilliant
engineers trying to solve some really
really hard problems when it comes to
threat intelligence the scale that we're
dealing at is petabytes of data
terabytes of data a second it's so hard
to do and how do you funnel that stuff
up into something that's usually usable
actionable by your business
so like i said we're going to get a
little academic in the beginning so
apologies so here's the obligatory
definition of threat intelligence that
this is one of the few slides i'm going
to read directly off of again apologies
but i'm just going to the the gartner
definition um and um and if you guys are
want to play a game there's some
hexadecimal on the bottom figure that
out
but threat intelligence is an
evidence-based knowledge and
evidence-based knowledge including
context mechanisms indicators
implications and active action oriented
action being a key word there advice how
about how an existing an emerging member
or hazard to your assets sorry as i
slurred there a little bit this
intelligence can be used to inform
decisions regarding the subject's
response to a menace and or hazard right
this is how gartner defines it today uh
gartner just released a paper about how
to action threat intelligence i suggest
you read that it's pretty good um
one of the things that uh that that we
think about when we think about threat
intelligence against full disclosure
this is like the one vendor thing i
promise i'm not trying to sell you
anything but i think it's uh really
important that you guys know that
intelligence not just threat
intelligence intelligence and we're
going to talk about ontology of what
that means later intelligence allows you
to take rapid informed actions to
mitigate risk
or remediate risk or compensate risk
this is really important
intelligence is everywhere you need it
to be around the clock whenever you need
it to be and it's coming from sources
all over the the public internet also
the deep and dark web if you want to get
into the technical definitions of that
what that means we can but this stuff
comes from everywhere and not one
company well maybe google can but now
one company in a reasonable sense can
collect the entire internet
and really do the and really surface
these things in a quick
and informed way so that's what we we
try to do as threat intelligence
practitioners not just flashpoint
everybody we have to get this
intelligence to the people that need it
in order to mitigate take action etc
so obligatory concept number one the
diagram has anyone seen this
intelligence cycle diagram before show
of hands
really okay all right so go on wikipedia
um
the intelligence cycle um is what is
used by most intelligence agencies on
the planet
that includes our friends in the federal
government it's the cia the fbi but that
also includes the chinese intelligence
it also includes the fsb so on and so
forth this
concept of threatened of intelligence in
general is is a cycle it's wheel it's a
wheel and it's informative most
intelligence organizations
um write up uh finished intelligence
reports to inform policy decisions
that's what happens right but what i
think what i want everyone here to take
away from is that in this in this
process you have to plan and direct your
intelligence organization
for example somebody who issues sim
cards has a different threat
intelligence profile than somebody who
releases a video game those threat
intelligence programs are not the same
and we have to accommodate for that also
collection is super important and i want
to distinguish this collection is
probably one of the most important
pieces of of intelligence but collecting
data is not intelligence
data turns into intelligence after
processing an analysis
so after processing an analysis we then
get something
produced to you that is then
disseminated to your organizations to
the key stakeholders that can inform
policy decisions or inform a firewall
policy it can be soft decisions human
decisions it could also be technical
decisions so that is the obligatory
concept number one when we talk about
threat intelligence it's coming from
this world it's coming from
a
world based in human intelligence if
anyone knows how a cia case officer
works you just get out of training out
of the cia you're now a spy you get
probably sent to some agency
overseas you're you're you're
stationed at an office and you go out
and you meet one of your contacts who
works at a factory and you say i'll give
you 500
and you tell me what the output of your
factory is going to be for the next
couple of weeks right that's humans
human intelligence right it's that uh i
see you feds shifting in your sheets i i
see you
right
that that's human intelligence uh and
and that stuff is super important but
that takes on a different context in the
digital world and i'm going to talk
about that
obligatory concept number two one
equation and and we're done i promise
uh so in this one equation if you ever
read an infosec textbook infosec is what
we used to call it in the 90s before it
was cyber security
you're going to find this equation of
how to identify risk i i know that there
are two equations on the screen let's go
with the bottom one
it's basically threat times
vulnerability equals risk you add in
your impact impact is a measured source
of how a potential breach to your asset
can impact your entire organization
and
and you also have to like add in the
likelihood and likelihood the likelihood
is calculated in many different ways but
you have to factor in the technical
controls that you have in place for for
something that's on your network so for
example if you have your crown jewels on
an air-gapped computer that never
touches the internet on your network a i
don't know how you did that but great
but but b that's probably not going to
be
uh subjected to a ddos attack right so
these are the basic steps in identifying
risk in an organization and threat
intelligence as i said before helps
mitigate compensate or remediate risk
so
let's play a game
we're going to design an infosec program
uh is justin here justin varner
no
okay um but uh we're gonna define an
infosec program um
and at the very high level what we're
seeing what we're seeing on the slide is
the basics of an infosec program at a
small and medium business right
hypothetically let's just say our
business is around 200 people
and we invest in firewalls the best ones
utms you got your ids ips built right in
wildfire sandbox whatever right like you
have your best firewalls then you have
your endpoint and avs or your semantics
mcafee sentinel one whatever and your
vulnerability scanner there's mo there's
a lot of breach laws out there that
require vulnerability scanners so now
you have your vulnerability scanners
would you guys say this is like the
start of a good infosec program
bruce schneider infosec is a process not
a not a product right right let's say we
have the processes in place it's it's a
it's a good it's a good start right it's
very basic but it's a good start but
let's say we have budget our 200 person
company has a budget and we can add in a
little bit more things onto there asset
management from tanium who sponsored
something here uh
endpoint edr dlp your mail gateways your
application security firewall that
that's really good for mitigating
threats uh to your web application but
secure coding i think is probably better
so you're also paying up for the premium
versions of your repository so you can
do static analysis dynamic analysis make
sure your licenses are in compliance
with what your policies are so on and so
forth now our infosec program looks a
little bit better right
a little bit better right we have a
little bit more tools we have a little
bit more coverage more visibility on the
inside of our network
we have a little bit more budget so why
don't we throw in a sim you guys anyone
here ever configure a sim
how's how's that been like the six
months of your life right like that's
that's that's tough stuff uh right so
and then we're gonna get some threat
intelligence feeds circa 2012. you guys
remember here's my number call me maybe
that was the summer jam back then right
that
our threat intelligence fees are from
2012 and that's important because when
we were thinking about threat
intelligence back then it was ip
addresses domains
yara rules that's what we were thinking
about and so that's what we got and also
personnel so including yourself
in this 200 person company you got one
plus one staff member right so now this
is our infosec program you have all
these tools you have some process plus
one staff member oh by the way you guys
are also doing i.t changing printers and
all this other stuff sound familiar
anybody
right i'm the infosec guy i'm also the
printer changer guy yeah it it happens
um
so
we're in good shape but there are some
things we still can't buy right uh for
example we can't buy any sidecar
products for our kubernetes clusters our
microservices all this other stuff we
don't have the professional service
hours to configure our sims so we'll
figure that out later on or any of the
other cool new toys that everyone's
selling us nowadays but looking at this
infoset program for smb small medium
business looks okay right if your
processes are okay you can probably pass
a sock to audit
maybe even a fedramp audit depending on
what you're doing
but before we get there let's let's talk
about what our business is all right so
now we've designed this infosec program
for our for our business and let's do
something simple that probably has a low
threat profile
let's just show credit cards
that's what we do we're issuing credit
cards in our 200 person company
um
and uh
and yeah that if somebody needs a credit
card if apple's coming out with a new
credit card they come to us and they're
like we need a new credit card we're
like we got you we'll do the new apple
credit card let's do it so on and so
forth okay and this is where the
audience participation part comes in so
i'm going to i'm going to say what you
guys are going to see on screen
is what we would consider threat
intelligence and i'm going to
ask you guys to say i or nay about
whether this piece of threat
intelligence is actionable within the
constructs of our company that we just
defined
so
really quickly let's start with an easy
one
who knows what's on screen
it's a yara rule right it goes into your
uh utm i know we're all tired i know we
just state so the irs or nays um just so
you know there's no like right or wrong
answer i think it's more of like an
audience thing if you guys hear more
people say eye for something or some
people say nate that tells you about
their own environments rather than our
environment but based on what we talked
about
in setting up our infosec program is
this actionable eyes
eyes come on no one
one person is this actionable no okay uh
nays
no i got a little got a little hums over
there so some days all right fine uh
we're all eating it's it's a yara rule
this can be this can be consumed by our
ids and ips right it's for conte
ransomware con for conti ransomware it's
based behavioral you can put this into
your devices and it can stop this stuff
on your network it's it's it's fairly
actionable how about this one next one
is is this actionable
yes
seeing some nods
okay
nays
no nays good yes this is this is
generally actionable can you guys read
what's up there
it's stuxnet
we deliver credit cards how many
programmable logic controllers do you
think exist in our office anyone have a
siemens
plc in their office it's actionable
absolutely is it relevant to us
i don't know depends where your office
is how about this
anyone know what paceman is
somebody posting something on paceman
they just post hi
is this actionable
this one's easy
nays right right like it's it's not
really actionable there's really zero
context here there's not much we can do
with with this piece of information all
right how about this one
we get an email
from csa
your oracle java 7 security manager
bypass vulnerability
is this actionable
aye thank you yes this is absolutely
actionable but unlike
the yara rules uh that we had before
which were automatically consumed by our
devices this is an email that comes into
our probably security inbox and we've
got to make sure that us or our staff
sees this email and then takes uh action
appropriately throughout the
organization and since we run both it
and infosec and there's no concept of
sres or devops or something like that in
our business we're it's on it's on the
hook here to make sure that our java
libraries are up to date and not uh
vulnerable to to these uh uh to this uh
uh vulnerability not vulnerable to
vulnerability all right anyway
but how about this next one relatively
easy is the is this actionable
we can probably identify that it's an ip
address right
it's uh does anyone know that subnet
some people do
how about now
this is one of the net blocks used by
apt and then that very famous mandiant
report apt-1 is this actionable now
it's getting closer
right we can absolutely put this in our
firewall
right this was published in october 25th
2004. in our in our company where we're
issuing credit cards
right is this actionable do we have
business in china
do we need to have access to china so so
on and so forth it gets a little harder
right like this can very easily be
blocked in a firewall it can very easily
be actionable but do we want to action
it some decision making has to take
place here how about this one
what are we looking at here
dns
right have you guys ever subscribed to a
feed that you automatically feed into a
firewall and that feed gets popped and
now you're blocking all dns queries out
of your organization has that ever
happened
it could happen your threat intelligence
vendors can get popped right like yes
it's absolutely actionable and you might
not even see it get into your systems
but it can definitely uh ruin your day
it can definitely ruin your day
right and
this is part of the problem of threat
intelligence at least as it was in circa
2012 all right let's fast forward all
right we're in 2022 we're at rva sec the
world has changed right we got some
threat intelligence vendors there's
there's a lot of them out there topping
the charts right now is kate bush does
anyone know why
yes yeah stranger things good stuff
katie bush is on top again good job
right we finally got our sim configured
it's working now it's awesome it's been
it's been 10 years we finally got it
done we got some piv protocol chips that
we're using mfa on our laptop so we uh
mfa everywhere and we have local low
code automation we can automate things
that come that come in
and and it's like a soar right and now
since our business was so good and
selling credit cards we thought hey
let's sell sim cards they're both cards
right how hard could it be right so now
we're a business selling credit cards
and sim cards but the threat
intelligence landscape has changed a
little bit right like in 2012 we're
talking about feeds we're talking about
emails right like one of the one of the
questions i get asked a lot it's like oh
flashpoint you guys are a threat
intelligence feed
yeah sure we have that uh like every
that's par for the course everyone has
the the yara rules coming in everyone
has the domains coming in everyone has
ip addresses coming in but i want to
show you guys what it looks like a
little bit differently we're going to
start with an easy one again
it's another yara rule
right the same as last time 2012 to 2022
we need this stuff it gets into our
systems
what's interesting and there's a whole
other talk here is like the statistics
of all the yara rules that you put into
your firewalls how many of them actually
stop the breach on your system there's a
whole talk there but this is actionable
this can go straight into your device it
can definitely do the thing that it
needs to do
and i'm not sure if you guys can re can
you read it what kind of malware it is
trickbot are you guys familiar with
trickbot
it's a big one these days right so how
about this
what if i told you
i know a lot about trickbot
is this actionable
here's an information page i can tell
you
a little a little blurb about trickbot
how many iocs i have for trickbots when
it was first seen when it was last seen
i can tell you the attack tags and very
granular detail that you can put into
your misp instance or any other type of
tip and uh and and filter it down and i
can also tell you that uh among
communities on on on the on the internet
it's being discussed pretty actively
these days is that actionable
maybe
in our 200 person company
right like we have us and one other it
person this might be if that person has
a high turnover and it's a new security
analyst and they look at this it's like
it's good to know
but what if this what if this report has
the iocs attached to it and it's a
consumable via api
now it's now it's really actionable now
you're not not you're not only getting
one yara rule you're getting a whole
bunch you're getting a whole bunch of
events with a lot of context i'm telling
you about trick bots that hit health
care places i'm telling you about trick
bots that hit of financial services
places i'm also telling you about
checkpoints that hit aerospace places
and
these types of behaviors are very
different even though it's the same
piece of malware the context here
matters it's not just an ip address
anymore the yara rules are are a great
start but it's only after you're looking
at them in the aggregate that you can
start to make informed decisions about
how you really want to consume this type
of type of stuff what if you need more
context right in this example where two
hundred page we're 200 person org with
two it people a security person
we may not have
the budget or the team to consume more
context but we can give it to you
what if you have a reverse engineering
team
right you can look at the pe headers we
can give you context
that's freely available on the internet
osens regular stuff we all know about
this and we can add that to the report
and you can consume that via via an api
it's not just the feed anymore the
context matters
right and um and we're moving on uh now
how about
non-non-yara rule examples right it gets
a little boring with the r rules the
same thing everything how about this
what's what's going on here
we're issuing credit cards here right
like so that that's good i can show you
the amount of card not present fraud
versus card present fraud any msas in
the room
pci msas no
okay those are the guys that audit you
for pci compliance but
anyway card present versus card not
president fraud card not present fraud
in general in the industry is the higher
one that means people aren't physically
spoofing cards as much anymore they're
using them in online transactions right
and these vendors are getting breached
and these card numbers are being sold
all over the web for very cheap and i
can tell you
that
our cards in the last seven days account
for over 222 000 in potential fraud loss
if our card's minimum value is a 500 500
line of credit
so for this example for this
presentation i pulled a subset of the
bigger number this number is in the
billions when you talk about the major
card providers out there
right
this uh and we can and you can customize
what kind of bins you want to track in
your system what kind of bins you don't
want to track in your system apple may
come to you and say
i need a bunch of new credit cards all
right here are your bin numbers let's
track apple's bin numbers
across the web are they getting breached
more than other bin numbers so on and so
forth the context here matters but this
is not consumable but any of the devices
that are in our system what just
happened
how is this different than a yara rule
is it intelligence
right if you're coming from a world
where intelligence is an ip address
this might not be useful to you
but our 200 person company is not the
same as
major credit card provider
out out there what we're looking at here
and the difference here is we're looking
outside the perimeter
for a potential impact
that rit team cannot control
but if you have a fraud team
if you have a fraud team now this this
becomes actionable if you can invest in
a fraud team and and you can say wait
wait wait how much of my cards are
breached
where are they breached where are they
being sold well i can tell you that i
can tell you exactly how much of your uh
uh how much of your cards are added per
breach on the top there one breach had
267 cards in it
the average price of all your cards
across all the marketplaces where
they're being sold
is 9.97
right
like and
and the total cards added across the
breaches in the last seven days is over
5188 cards only across
13 bin numbers
right so if you have a fraud team this
is very actionable but what do you need
what do you need in order to take action
on this on at a frost team
you might need the full card numbers
right
you might need a full card numbers and
that that's something that modern threat
intelligence vendors have as well
we can get that card cancelled before a
threat actor can sell it to some to a
willing buyer
that's threat intelligence it's not an
ip address everyone has ip address
that's threat intelligence your card
you're as a consumer you're safe because
these fraud departments that's what they
do 24 7.
that's not a hyperbole they're they're
365 24 7. it's like a sock it's like a
knock that's always staffed this stuff
is happening all the time what about
card present fraud moving on card
present fraud is when people are making
fake copies of your credit cards and
they're then then they're going places
and then they're using those credit
cards now
uh that's a little bit harder to stop
but i have all this breach data about
your cards what if i can tell you
i can localize
where these cards are being breached
where these skimmers are where is the
highest volume of skimmers for your
particular cards
i can tell you that
i can tell you the exact zip codes where
your cards got breached or where right
so
now you can work with your liaisons in
law enforcement to get these skimmers
out offline and everyone know what i'm
talking about when i'm talking about a
credit card skimmer like you pull it off
your normal you put it into an atm but
there's a place on it to read your card
like we have a lot of information uh uh
in in this space around where this stuff
is localized that's intelligence it's
not just an ip address it's not just a
feed it's it's far more than that all
right getting back to more traditional
stuff
this is what's called a finished
intelligence report
in in the physical world in the law
enforcement world this would be on a
piece of paper
and it would go to somebody who's an
informed policy or decision maker
right in our world in the digital world
it might go to a cso a director or or
something like that based on this report
just in it of itself just on the title
and the stock photo picture
uh is this is this actionable
like
it's a it's a it's a report right a
physical report it can be actionable
it's it's a trick question you how could
you possibly answer the question without
knowing what's in the report right
so the the report does have more data in
it right and the report tells you these
are the trendings uh these are the
trending vulnerabilities that are
happening as of may 2022 and deep in
dark web communities where people are
trying to find exploits and some of them
have confirmed remote code execution
uh
problems with them and over here we have
the number of mentions whether it has
remote code the actual name of the cve
so on and so forth now this is a little
bit more actionable right we all have a
vulnerability scanner we can check if
we're exposure well you know what i find
interesting about this this is this is
real data right so this is as of may
2022 look at that look at that bottom
one cve 2017 1188.2
why are people today
talking about a cve from 2017
that's interesting
right that oh that that requires a
little bit more investigation
right that that's something that uh
that you can definitely look into and
you can click in and see what's
happening these type of these type of
reports exist in modern threat
intelligence vendors it's par for the
course another thing and all of them are
available via api and there's also
free and open source versions of these
things right vulnerability researchers
are really giving this back to the
community just like we are right there
there's a lot of ways that because at
the end of the day we want to protect
people we want to protect consumers um
next again is this threat intelligence
first of all before even before it's
actionable i'm giving you a lot of data
here march 20th may may 6th
right
this is a conversation happening on a
closed forum somebody asks originally in
russian uh does anyone know how to
launch your payload with this exploit
startup not visible in ah xml 64. any
reverse engineers in the room you know
exactly what's going on here they're
looking for an entry point right
right you know exactly what's going on
here and then
a couple months later who can who can
make it workable dm me i'm ready to buy
through s girl right these are real
conversations happening dude like people
are buying this stuff in order to have
remote code executable stuff
vulnerabilities that they're putting
into ransomware that they're putting
into their
different type of attack campaigns and
there's money behind this people are
buying this right there's a financial
transaction taking place there are
escrow vendors for this type of stuff if
you if you start talking about escrow
vendors the community here is so big
that you need escrow vendors right just
the
just the existence of escrow for buying
exploits is a huge huge deal
all right a little a little bit of
vocabulary does anyone know what any
means not related to anatomy
does anyone has anyone heard this term
before the slang term here
any no hands
it means
insider
we have our own lexicons when you're
following these communities these
communities have their own lexicons that
they use and these and when somebody
says i'm an innie that means i'm an
insider
right so in our hypothetical uh business
here um we are now selling credit cards
and we're now selling sim cards has
anyone heard of sim swapping
that's a big one right that's a huge one
what if i told you that people every day
look at the dates look at the dates of
when i pulled this data june 16th 2022
that's when i added the screenshot into
the prezzo i waited specifically i could
have done it this morning but what
people are saying here and i'm not sure
if you can read this on your screen any
up any up means i'm an insider and i'm
up for business that's literally what it
means
and i can tell you that this guy middle
of the page any up pm me if you need a
sim swap only number and new sim
required that guy doesn't know what he's
doing that guy is new i can tell you
because all you need to say is in the up
and if you've been doing this long
enough that's the code any up is the
code i'm ready to go you dm this person
and they'll do a sim swap for you
is this actionable
depending who you are
right let's say uh you're a 200 person
company that now sells sim cards uh i
don't know what if you're a
major telco provider
and you have locations all over the
all over the world maybe that is a
little bit more actionable now
and you can see what time this was
posted these people usually post this
stuff when they're starting their shift
they're charging 50 bucks a swap
right so you can get really narrow with
pattern of life you can see what their
handles are you can see when it's posted
those these blackouts in the middle of
the screen here
replace that blackout with your cell
phone provider that's what they're
saying
right it's a big deal it's happening
every single day and it's creating a big
big business
so we're so
these were all examples of our fake
business of selling credit cards and sim
cards right um how about this one
no political statements here just
looking at a at a picture first of all
first question is it intelligence
it's a picture it can be what's the
context right i'm going to put my my
intel hat on a little bit i see a
ukrainian vehicle two soldiers with a
russian flag some propaganda some
propaganda decals that were obviously
photoshopped on there right like there
you can tell a story without much
context here this was pulling from an
osn source if you put this
if you put this picture in image search
you'll find it
um also on the intel uh uh on the intel
hat here if you know what kraken 13 is
kraken war 13 it's a special ops unit
out of russia
and they're showing off that way we're
doing a good job here but is it intel
it's a picture is it intel right and
these type of propaganda posts happen
all the time hundreds of thousands of
images
right what are what kind of context can
you grab from this
right if you were here for the previous
talking about anomalies there's a lot of
talk about aiml models right
these are critical to modern threat
intelligence how about now what if i can
tell you
exactly what the image is showing
right what if i can
read
first of all going back here does anyone
see the word crack in here
it's not it's it's there
in the middle
right it's you can barely see it
but
over here it was off you can it's barely
readable but uh our ai ml model picked
it up we can also search for cars
camouflage so on and so forth again at a
scaled level this is a massive problem
right we're we have thousands of images
coming in per second an analyst can't
look at all those images all at once and
get a day's work done on anything you
need help you need ai you need ml you
need a good team and you need a team
that knows what they're doing to find
out false positives you also need a team
that doesn't have an inherent bias right
these are hard problems to solve they're
incredibly hard problems to solve but
this in it of itself i wouldn't call it
intelligence but when you derive stuff
from this some this you know this
picture might have exif data with
location data for example location data
is it actionable for us even in our
little example here we're a sim card
company it's not even relevant to us
right unless we're selling sim cards
into ukraine
unless we're selling credit cards in
ukraine and even then it might be
relevant to us but isn't actionable
no this is actionable for a different
type of a whole different type of client
how about mentions
if you're if you're on these forums if
you're in these public communities
people talk about stuff that's happening
in real time the war that's happening
currently in eastern europe has a lot of
chatter going about it you type in tick
tock in ukraine and the war is being
fought on tick tock people are showing
off and doing all this other stuff and
they're mentioning a whole bunch of
stuff but there are a lot of public
sources that are unobstructed meaning
you don't need a username and password
to get into it to to glean conversation
data propaganda data so on and so forth
so
how do you turn that into intelligence
well
you know using aiml you can you
absolutely can the size of the circle
here means the number of mentions that
big red circle that's the don esque
region of ukraine a lot of fighting is
happening in the donetsk region of
ukraine a lot of people are mentioning
it but what the mouse is hovering on and
apologies for the pronunciation i can't
pronounce that uh yes nevada the locale
of yes nevada
the this does has anyone heard of yes
nevada before
i haven't i have no idea what yes nevada
is but 817 people are talking about it
right so if you're an all-source intel
analyst and you're looking for key
pieces of intelligence why are
817 people talking about yes nevada
within the last 24 hours is something
happening there
right is this actionable
maybe not for my credit card sim card
company but there are people where this
is actionable if there's an artillery
strike happening we can get people out
of there right like that's that that's
real that's real stuff that's real
intelligence how do we tie this all back
to
our sim cards our credit cards our
firewalls
i don't think people understand the toll
that geopolitical
conflict takes on the digital world
the digital world
uh
usually it ebbs and flows with the
geopolitical situation that's happening
because of the conflict that's happening
in eastern europe we're seeing attacks
from both sides we're seeing ifc's
coming out of the the the regions from
both sides we're seeing
different types of
actor groups claiming responsibility for
different types of attacks again
this is actionable this is going
directly into our firewalls if we are
selling credit cards in the ukraine
and we see a spike in these particular
iocs that are coming out of ukraine we
can tie that particular attack to what's
going on in the geopolitical world
whenever there's a massive geopolitical
conflict this happens whether you see it
or not this was happening before there
were boots on the ground in ukraine we
were seeing this type of activity
happening before these people were going
in
right that's
intelligence threat intelligence how
about
well let's move it back a bit because
you know physical conflict it's super
sad and all this other stuff
how about a problem we all kind of kind
of understand
identity management
right anyone here
have an account that they have to log
into with a password and mfa token
show hands everyone that's what i
thought okay so so
this is a problem right uh and in our in
our theoretical company we have strong
we're enforcing strong user names and
passwords we have mfa in our boxes and
on our apps and we have
and we have everything that we can have
in place what about
uh that bottom line we'll get to that in
a second right so in our theoretical
company we're pretty good on the
internal management of of credentials
right not not that bad but one of the
problems that we always have is shadow
i.t somebody with a corporate credit
card wants to use this new calendar app
that looks really cool and it takes all
their contacts out of google and outlook
and puts us in the new calendar and now
they can do their meetings and they used
the password one two three four five six
all right that happens the shadow i.t
stuff happens how do we how do we even
begin to solve that problem it's a hard
one also does anyone know how i can take
over your account even if you have the
top three things in place
what if i stole your cookie
with all your device information on it
it's possible you can have all this
stuff in place if i have your cookie
i can get your access to your account
even if you have all the stuff in place
what if i can tell you
that your
your company's cookies are out in the
wild and are being stolen by malware
that's threat intelligence not only
resetting usernames and passwords when
they've been breached because of shadow
i.t
but revoking cookies in real time
before malware authors can utilize your
boxes to farm bitcoin or or whatever but
going back to the shadow i.t problem
uh can everyone see that top password
this is real data from 2022.
right so
in the previous slide
look at number one we enforce strong
usernames and passwords we absolutely do
in our business it's we gotta use our
password manager the whole thing some
online vendor for 99 cents a month where
you can link your calendars does not you
can put a password that says one two
three four five six that doesn't have
oauth that's not doesn't have facebook
sign in it doesn't have any saml or sso
on it and you can have
all the crown jewels of your pii and
personal information on this vendor
what's blacked out here on the bottom
right is a list
of vendors that are not our company and
these are
example it's example.com but just
replace your domain in there because we
have that data i promise you uh you put
your domain in there and you'll see the
top 100 passwords that your users are
using not within your environment
that's a real problem is this actionable
is this intelligence
remember collection
analysis production this is intelligence
one username and password does not
intelligence make
an aggregate across what's happening the
entire web now you can start having a
conversation
so let's dig into this problem a little
bit more
so over here have uh some pull outs of
from the previous slide where people
have their passwords what i want to call
your attention to
is this meets organizational profile
so
when a two slides ago when i said we
enforce strong passwords that's your
organizational profile i can tell you
whether the passwords that we find at
your vendors meet your organizational
profile why is that
i important somebody said it
same password somebody's reusing their
password at a vendor they're reusing
your their own corporate password at
another vendor
it's i feel that that's pretty
actionable
right like that's that's a good one
happens all the time
it happens every single day
so
let's uh let's go to indirect matches
because indirect matches is a little bit
of a harder problem to solve
right
uh with indirect matches you're not
finding uh your passwords you're not
finding uh things that call out your
little company by name this is a problem
that when you're starting out in the
threat intelligence space and you're a
small medium business like it's really
hard to start that threat intelligence
practice because you might log into some
vendor you might put in your company
name and nothing pops up
right and they're like damn i can't even
do research on my own company we're too
small is this even useful to me
right but i bet you're using salesforce
right
so
here's here's a ransomware dashboard
right and we can tell you
where the top 10 targeted industries by
different ransomware authors remember
when we were talking about a couple
slides ago ukraine certain types of iocs
come out of certain types of
geopolitical conflicts ransomware actors
like going around certain industries
because there are certain standards in
certain industries that everyone knows
rest in peace internet explorer it's
been a good it's been a good 27 years
thank you very much for my career and
everybody else's career in this room but
there's that swift terminal at that bank
with the bloomberg terminal on it that's
running ie7 i guarantee you right and
and there are a lot of uh uh
targeted industries meat packing from
aerospace to retail they use kind of the
same software across all these types of
industries what this is telling me as a
small vendor where i can't find my own
name here
i can tell you
your supply chain
is borked
right i can tell you
not only
if your supply chain is hit the
something like this has the power and
this is a very real example
we can tell our vendors that they've
been breached before they know that they
have been breached
because ransomware actors put this stuff
up for public consumption they like to
brag
right they zip these files and say i
breached this company right and we and
that happens even if you're not finding
your name in a threat intelligence
vendor i guarantee you that threat
intelligence vendor has the password of
your supply chain i guarantee you that
threat intelligence
intelligence vendor has information
about ransomware that is reaching your
supply chain supply chain is very
important in the last few years how many
people have to wait for a car for the
next three years these days right
formula shortage toilet paper sorted so
on and so forth right these are
uh
these are things that we're all dealing
with that have some sort of digital
impact right uh going back to stocks
next it's not like plc's aren't being
attacked anymore on major ships
that's still happening right so your
supply chain is super important how
about
vulnerability intelligence
that's that's another one what if i told
you there are three vulnerabilities in
your supply chain that don't have cves i
guarantee you that i can tell you that
there are vulnerabilities in your supply
chain that don't have cves and i can
also tell you that one of them has a
remote code execution
there's a difference between data and
intelligence this is intelligence this
is vulnerability intelligence if any of
you guys talked to jake coons in the
last 10 years he'll tell you all about
this
right this is
very real stuff this is not only for
your vendor supply chain so you can you
can
discover in your own stack
where these vulnerabilities uh are and
is this even actionable if you're
waiting on microsoft to patch something
that has an rce
is this even actionable for you guys
can it be
yeah maybe you can take that system off
the internet unless it's a money making
system then you have to migrate it how
long do you have to wait for a patch
there are compensating and remediating
controls that you can take but this is
actionable depending on your budget
right like maybe for our small 200
person company this might be a little
hard
but for bigger organizations it has to
be actionable
so
that is uh that is what threat
intelligence looks like in 2022
it came from a world of understanding
hint
again call out to mark arnold's talk
from 2018 on hacking intelligence
when has has anyone seen these terms
before human geowent finance osint
siegent these are common terms used in
the physical industry
in law enforcement agencies and
in federal agencies human intelligence
remember i gave the example of the case
officer going to the factory worker
that's human intelligence how about this
is this human intelligence me having a
conversation with a threat actor on the
forum
right it's not human in the same way as
me talk paying some factory worker for
some from for some data but with enough
context here
you can you can glean a lot here
how about how about that doughnut regen
stuff is that geo intelligence
when when these guys are talking about
geo intelligence they're moving
satellites my sim card company my credit
card company can't move a satellite it's
a little bit out of our budget
but uh but i can tell you what mentions
are happening where we're selling credit
cards
that might be genuine how about mass
ends mass is measurement intelligence
and this is an oversimplification but i
can measure how much loss you have in
your credit cards in the last seven days
it's a real oversimplification but it's
kind of analogous
o ascent is something we all use is a
super important how about this picture
is it even intelligence right is that
cyber intelligence is it finn
intelligence
right again with the raw analyst hat
with the right context and uh and a mass
of these things it can be the right
intelligence but what i want to propose
here
is that these end concepts don't
translate very well to the digital world
we have to start thinking of the digital
world in a little bit of a different way
and i have to give a shout out to jake
coons and matt howell people i work with
and we've been thinking about how we
have to change the ontologies of the
stuff that we're talking about
right it's all intelligence
but these are broken down into way
different intelligence threat
intelligence it's not the source it's
not the same as open source intelligence
awesome
it's it's it's still here it's a good
one it is its own thing but deep and
dark web intelligence is not the same as
regular threat intelligence if you have
to get through a password or to an onion
site that's a way different collection
profile than if you just go to a new
site and scrape it very different
vulnerability intelligence i can tell
you you have a vulnerability before nvd
can that's intelligence identity
intelligence we just did password attack
surface management that could be
physical that could be digital financial
intelligence i can tell you how much
fraud loss you have in your credit cards
etc etc we have to start thinking about
intelligence as concepts and ontologies
in a different way this physical stuff
it's useful there's very there's a lot
of overlap we have customers and and
client clients and
uh and people that we help using these
types of concepts but in our digital
world we have to
start thinking about it a little bit
different because there's always going
to be overlap there's always going to be
a human element i want to call out that
last one so your security community
intelligence the best type of
intelligence you can get is hi i'm a
bank i got hit with this piece of
ransomware that uh
that's a trick bot that's a like tiny
banker and i'm going to give you the
yara rules and signatures to every other
bank in my mailing list that's one of
the best kind of intelligence sharing
intelligence is probably the best way
that our digital communal immune system
works right we can't keep the stuff to
ourselves we have to share this stuff so
it's not is threat intelligence
actionable in 2022. that was that's kind
of a joke the real question is is
intelligence
is intelligence
actionable i think all intelligence is
actionable data may not be actionable
intelligence is actionable
and
that's time thank you very much
everybody
[Applause]
so i think we have a couple minutes for
questions
easy right no questions all right that's
what i thought
all right thank you everybody i'll be
around if you guys want to talk to me
thanks again cheers
[Applause]
you