SANS CTI Summit 2020: Developing CTI Skills and Effective Communication
•
0 gefällt mir•35 views
Since the publication of Mandiant's APT1 report in 2013, cyber threat intelligence (CTI) has been widely adopted by private organizations all over the world. There have been both successes and failures in trying to develop cyber threat capabilities and add value to businesses. As a community, it is critical to capture the relevant lessons learned from these experiences and conduct a status check on these first years of applied CTI. This presentation aims to identify areas where organizations should put more focus in order to stop tilting at windmills. We will deep dive into three major areas where most current CTI teams struggle: (1) intelligence direction (specifically, stakeholder identification and collection of intelligence requirements); (2) intelligence reporting and dissemination; and (3) the skills sets of CTI analysts. Takeaways for attendees will include recognizing the significance of requirements for the intelligence cycle; identifying key stakeholders; understanding how classic intelligence approaches can be applied to CTI production/reporting; learning from success stories on disseminating intelligence products and capturing feedback; understanding the variety of competencies of CTI teams; and improving ways to work within CTI teams comprised of analysts with different backgrounds and experience levels. Andreas Sfakianakis, @asfakian, Cyber Threat Intelligence Analyst
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Ähnlich wie SANS CTI Summit 2020: Developing CTI Skills and Effective Communication
Ähnlich wie SANS CTI Summit 2020: Developing CTI Skills and Effective Communication (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
SANS CTI Summit 2020: Developing CTI Skills and Effective Communication
- 1. SANS CTI Summit 2020 Andreas Sfakianakis CTI Professional
- 2. § CTI and IR in Financial and Oil & Gas sectors § ENISA CTI, FIRST.org CTI, European Commission § Twitter: @asfakian § Website: www.threatintel.eu tilting at windmills
- 3. §Original authors are referenced within the slide deck §References for this presentation http://bit.ly/ctisummit2020 §Views are my own
- 4. § Setting the scene § Lesson #1 § Lesson #2 § Lesson #3 § Final Remarks Image from hp-comic.com
- 6. 1989 Cuckoo’s Egg 2009 Operation Aurora 2010 Stuxnet 2011 LM Kill Chain 2013 APT1 Report 2013 Pyramid of Pain 2013 Snowden Leaks 2014 Heart Bleed 2015 ATT&CK 2016 The Shadow Brokers / US Elections 2017 Wanna Cry / Petya APT Becomes Mainstream Wider CTI Adoption
- 10. §Stakeholders and their pain points §Operational landscape §Business processes and risk reduction “CTI teams should not do intelligence for intelligence’s sake, it costs money and time” - Lauren Zabierek
- 11. Tactical Intelligence Security Engineers SOC Team Operational Intelligence Incident Responders Threat Hunters Vulnerability Management Red Team Fraud Team Sys Admins IT Managers Strategic Intelligence C-Suite / Executives Group Security Risk Managers Business Stakeholders Regional Stakeholders IT Architects
- 12. § Intelligence requirements are enduring questions that consumers of intelligence need answers to. § Answer critical questions intelligence customers care about (not whatYOU care about). Reference: Sergio Caltagirone
- 13. Reference: SANS
- 14. § US Military - Joint Publication 2-0 § SANS CTI Summit 2018 - I Can Haz Requirements? - Michael Rea § CTI SquadGoals—Setting Requirements - Scott J Roberts § SANS - Threat Intelligence: Planning and Direction - Brian Kime § SANS - Defining Threat Intelligence Requirements – Pasquale Stirparo § FIRST CTI 2019 -Your requirements are not my requirements – Pasquale Stirparo § SANS CTI Summit 2018 - Intelligence Preparation of the Cyber Environment – Rob Dartnall § ThreatIntel.eu - Intelligence Requirements: the Sancho Panza of CTI References for this presentation: http://bit.ly/ctisummit2020
- 15. § Identification of relevant stakeholders § Connection with business and enterprise risk management cycles § Identification of operational environment (crown jewels) § Capturing and documenting the intelligence requirements
- 17. §Importance of CTI reporting §Embedding of intelligence tradecraft (cross-pollination) §Means of dissemination
- 19. Collection Analysis ? ACTION Reference: Christian Paredes §Intelligence and production requirements
- 20. Collection Analysis ? ACTION Reference: Christian Paredes §Intelligence and production requirements §Structure - Report template
- 21. Collection Analysis ? ACTION Reference: Christian Paredes §Intelligence and production requirements §Structure - Report template §Style - Style guide document
- 22. Collection Analysis ? ACTION Reference: Christian Paredes §Intelligence and production requirements §Structure - Report template §Style - Style guide document §Tradecraft – IC Analytic Standards (ICD 203)
- 23. Collection Analysis ? ACTION Reference: Christian Paredes §Intelligence and production requirements §Structure - Report template §Style - Style guide document §Tradecraft – IC Analytic Standards (ICD 203) §Constant feedback loop
- 24. §Title §Executive Summary (BLUF) § What? § So what? § So what of the so what? What next? § References § Appendix § Indicators (machine readable?) § Tradecraft used Report Structure
- 25. § Internal Communications / Email marketing application § Store the CTI products in SharePoint
- 26. Reference: Robert M. Lee Reference:VB – Martijn Grooten Reference: Casey Brooks (2019 Thanksgiving edition)
- 27. §SANS SEC402 - Cybersecurity Writing: Hack the Reader (Lenny Zeltser) §Effective Information Security Writing (Chris Sanders) §Write it or didn’t happen. Happy reporting! J (Yourself)
- 28. § Intelligence Community Directive (ICD) 203 - Analytic Standards § CIA - Analytic Thinking and Presenting for Intelligence Producers § CIA - Compendium of Analytic Tradecraft Notes § CIA - Style Manual and Writers' Guide for Intelligence Publications § The Economist Style Guide § SANS CTI Summit 2017 - Pen-To-Paper and The Finished Report:The Key To Generating Threat Intelligence - Christian Paredes § SANS CTI Summit 2019 - Analytic Tradecraft in the Real World - Amy R. Bejtlich § Sergio Caltagirone - 15 Things Wrong with Today’s Threat Intelligence Reporting § Lenny Zeltser - Top 10 Writing Mistakes in Cybersecurity and HowYou Can Avoid Them References for this presentation: http://bit.ly/ctisummit2020
- 29. § CTI needs to be better communicated to business at a strategic (and operational) level. § Communication competencies are key for CTI teams. § Report writing as a critical CTI skill. § Cross-pollination - Intelligence tradecraft wasn't invented yesterday
- 31. § CTI skills shortage § SANS CTI Survey 2018:“62% of respondents cited a lack of trained CTI professionals and skills as a major roadblock,an increase of nearly 10 percentage points over 2017 (53%)” § Organizational challenges § Challenges for CTI teams
- 32. §What is the skillset needed for a CTI team? § “Do I need a reverse engineer for my CTI team?” § “Do I need non-technical analysts in my team?” §How we develop the skillset of (junior) CTI analysts? §How do we streamline day to day CTI work? § “How do I reduce CTI analyst dependency?”
- 33. Reference:
- 34. Reference:
- 35. Reference:
- 36. § Core CTI curriculum and CTI training roadmap § Documented Standard Operating Procedures § Everyday learning culture § Periodic exercises with your team § Knowing your biases?
- 37. § INSA - Cyber Intelligence: Preparing Today’s Talent for Tomorrow’s Threats § Sergio Caltagirone - 15 Knowledge Areas and Skills for Cyber Analysts and Operators § EclecticIQ – On the Importance of Standard Operating Procedures in Threat Intelligence § CIA – Fifteen Axioms for Intelligence Analysis § ENISA CTI-EU 2017 - Lessons Learned from Teaching CTI All Over the World - Jess Garcia § ComradeCookie - What is CTI and what makes a good CTI analyst? § Richards J. Heuer - Psychology of Intelligence Analysis § Richards J. Heuer - Structured Analytic Techniques for Intelligence Analysis § NIST - National Initiative for Cybersecurity Education Cybersecurity Workforce Framework § SEI Carnegie Mellon University - Cyber Intelligence Tradecraft Report References for this presentation: http://bit.ly/ctisummit2020
- 38. § Use a competency-based framework to assess your CTI team’s skill coverage. § Invest on internal/external CTI training opportunities, especially on analysis and thinking. § Streamline BAU CTI tasks, make them repeatable. § Build a working environment for knowledge sharing (sharing is caring, huh?)
- 39. Dulcinea Watches as Don Quixote Wins Battles For Her Image from elladocomicodedonquijote.wordpress.com
- 40. §Intelligence direction phase is of utmost importance to your intelligence cycle process. §CTI needs to be better communicated. §Focus on CTI analyst’s skillset.
- 41. Andreas Sfakianakis @asfakian threatintel.eu References for this presentation: http://bit.ly/ctisummit2020 Sharing is caring