Collective intelligence: Crowdsourcing Cyber Threat Intel Successes, Challenges and Opportunities
•
0 gefällt mir•35 views
My second edition presentation on the challenges and opportunities of crowdsourcing CTI.
Empfohlen
Weitere ähnliche Inhalte
Ähnlich wie Collective intelligence: Crowdsourcing Cyber Threat Intel Successes, Challenges and Opportunities
Ähnlich wie Collective intelligence: Crowdsourcing Cyber Threat Intel Successes, Challenges and Opportunities (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Collective intelligence: Crowdsourcing Cyber Threat Intel Successes, Challenges and Opportunities
- 1. Collective Intelligence: Crowdsourcing CTI Challenges and Opportunities Rob Fry February 22th 2020 BSides Bryan/College Station 2020
- 2. • CTI Ground Rules • What is Crowdsourcing? • CTI Background • The “Waze” Analog • Challenges to Make It Real • Customer Interest Level Agenda 2
- 3. ! The facts expressed here belong to everybody, the opinions to me. The distinction is yours to draw. ! Any similarity to actual companies or technology, living or dead, is purely coincidental. ! Every statement in this presentation is probably true when stated, but truth changes over time. ! Any disclaimer issued by me is subject to change without notice or reason or anything else. ! Disclaimer does not cover misuse, accident, lightning, flood, tornado, tsunami, volcanic eruption, earthquake, hurricanes, or other acts of God, neglect, damage from improper use, incorrect line voltage, unauthorized use, unauthorized repair, improper installation, typos, broken antenna or marred cabinet, missing or altered serial numbers, electromagnetic radiation from nuclear blasts, sonic boom vibrations, customer adjustments that are not covered in this list, and incidents owing to an airplane crash, ship sinking or taking on water, motor vehicle crashing, dropping the item, falling rocks, leaky roof, broken glass, disk failure, accidental file deletions, mud slides, forest fire, hitting of a deer, milk coming out of your nose due to laughing while drinking, or projectiles, which can include, but are not limited to, arrows, bullet shots, BBs, shrapnel, lasers, napalm, torpedoes, emissions of X-rays, Alpha, Beta and Gamma rays, knives, stones, etc. Disclaimer! 3
- 4. About Me 4 Vice President Software Engineer Co-Founder Advisor Mentor Pain-in-the-Ass Inventor Internet Streaming Architect Docker Containers Orchestration Public Cloud Board Member CASB Microservices Venture Cloud SIEM Public Speaker Open Source CTO RASP SAAS Momentum Cyber Virtual Reality
- 5. About Me 5
- 9. Prelude 9 Evolution of Threat Intel
- 10. Prelude 10 Evolution of Threat Intel It was probably here.
- 11. Prelude 11 Evolution of Threat Intel Email IM Msg Boards
- 12. Prelude 12 Evolution of Threat Intel Email IM Msg Boards Sidenote: For Many of Us, This is Still Standard Operating
- 14. 14 CTI Ground Rules What’s In Scope?
- 15. CTI Ground Rules 15 Artifacts of Love & Disdain Hash
- 17. CTI Ground Rules 17 Not going to touch it. Attribution Sidenote:
- 22. Crowdsourcing? 22 With Without In Theory, The Problem It Solves
- 23. Crowdsourcing? 23 • Consumption• Contribution With Without In Theory, The Problem It Solves
- 24. Crowdsourcing? 24 • Consumption • Indicators • Contribution • Context With Without In Theory, The Problem It Solves
- 25. Crowdsourcing? 25 • Consumption • Indicators • Quantity • Contribution • Context • Quality With Without In Theory, The Problem It Solves
- 26. Crowdsourcing? 26 • Consumption • Indicators • Quantity • One to One • Contribution • Context • Quality • Many to Many With Without In Theory, The Problem It Solves
- 27. CTI Background 27 More Time travel
- 28. CTI Background 28 The Year is: 2012-ish
- 29. CTI Background 29 Evolution of Threat Intel Anubis
- 30. CTI Background 30 Evolution of Threat Intel
- 31. CTI Background 31 Evolution of Threat Intel Hash Is Bad? Yes No Binary Return
- 32. CTI Background 32 Mandatory Conference Meme Sidenote:
- 33. CTI Background 33 Evolution of Threat Intel Product Market Cost Product/Market Fit
- 34. CTI Background 34 Evolution of Threat Intel Startups! Open Source &
- 35. CTI Background 35 Evolution of Threat Intel
- 36. CTI Background 36 Evolution of Threat Intel
- 38. CTI Background 38 I Hate Syslog Sidenote:
- 39. CTI Background 39 Evolution of Threat Intel DATA!
- 40. CTI Background 40 + Many, Many More.
- 41. CTI Background 41 The Year is: 2013
- 42. You CTI Background 42 Aggregated Data One-way Vendor or Community Aggregated Good Start But “Context”
- 51. CTI Background 51 Company “A” Company “B”Exchange Channel Community
- 53. CTI Background 53 Hold That Thought
- 54. The Waze Analog 54Courtesy of Google
- 55. The Waze Analog 55Courtesy of Google
- 56. The Waze Analog 56Courtesy of Google
- 57. The Waze Analog 57 Crowdsourced Methodology Yes ? No Courtesy of Google
- 58. The Waze Analog 58 Crowdsourced Methodology Yes ? No Security Analyst Indicator “The Crowd” Courtesy of Google
- 59. The Waze Analog 59 Crowdsourced With Curation Methodology Anne Marie Steve Ronald 99% 85% 65% Courtesy of Google
- 60. The Waze Analog 60 Crowdsourced With Curation Methodology ? True Positive True Negative False Positive False Negative Courtesy of Google
- 61. 61 Individual Company Business Vertical Community • The Individual • The Team • The Company • Business Vertical • The Community The Waze Analog
- 63. The Waze Analog 63 : • Identify Subjective Data • Isolate Subjective Data • User Simple Measures • Measure & Score Users
- 64. The Waze Analog 64 Crowdsourced With Curation Methodology Courtesy of Google
- 65. Challenges/Opportunities to Make it Real 65 ?What Would it Take?
- 66. The Challenges - Concept 66 Mind Blown!
- 67. The Challenges - Concept 67 Mind Blown! Company “A” Company “B”Exchange Channel Community
- 68. The Challenges - Concept 68 Wait a minute…
- 69. The Challenges - Concept 69 • How Much Data? • How Many Customers? • What Business Verticals?
- 70. The Challenges - Concept 70 • How Much Data? • How Many Customers? • What Business Verticals?
- 71. The Challenges - Concept 71 + Volume + Velocity + Relevance
- 72. The Challenges - Concept 72 How Many Customers? • 5% - 10% Contribute Back • Ex: 1000 Customers = 50-100 Contributors • What is Quality of Contributors?
- 73. The Challenges - Concept 73 How Much Data? • 5% - 10% Contribute Back • What Type of Data? • How Much Data?
- 74. The Challenges - Concept 74 What Business Verticals? • Channel Approach Shows Promise • PCI, HIPAA, Web, Oil, Healthcare, Etc
- 75. 75 The Challenges - Customer Side ?
- 76. 76 What is Your Team’s Posture? The Challenges - Customer Side
- 77. The Challenges - Customer Side 77 Efficacy Measure History Curation What’s Your Ability To:
- 78. The Challenges - Customer Side 78 Context CTI Pipeline
- 79. The Challenges - Customer Side 79 You Aggregated Data Two-way Open The Pipe
- 80. The Challenges - Product Side 80 History
- 81. The Challenges - Product Side 81 What Specific Customer Problem Are You Solving?
- 82. The Challenges - Product Side 82 What Specific Customer Problem Are You Solving? People Data Expertise
- 83. The Challenges - Product Side 83 Curation Update Look Back History Tombstone
- 84. The Challenges - Product Side 84 The “Presentation” Problem
- 85. The Challenges - Product Side 85 • Automatic Aggregate • New Methodologies • Easier Potential for Sharing • Private Channels • Ownership Dilemma The “Cloud” Challenge
- 86. The Challenges - Product Side 86 The “Data” Challenge • Data Protection • Anonymization • Secure Point-to-Point • Business Risk • Authorization/Legal (Opt-in or Opt-out?) • T&Cs With Product Vendor
- 87. 87 Feedback Loop The Challenges - Product Side
- 88. • What Problems Does This Solve For Us? • What Other Problems Would I Rather You Solve? • Can We Share? Are We Capable of Sharing? • Which Products Are Most Suited to Support? • What Product(s) or Organizations Have Been Successful? • What Have We Learned From Previous Shortcomings Customer Interest Level 88 “Brass Tacks”
- 89. • Value… We Must Continue to Iterate • Volume, Velocity, Relevance • Contribution, Context, Quality, Many to Many • Remove Subjectiveness • Measure All The Things • Security Team Maturity • Feedback Loops • Data, et al. Wrap-up 89