Building Effective Threat Intelligence Sharing

A SANS Webex I did... awhile ago?

Transcript

1. Building Effective
   CTI Sharing
   

   View Slide

2. Scott J Roberts
   

   View Slide

3. Comments? Use
   #ctisharing
   and/or
   @sroberts
   

   View Slide

4. Table Stakes
   

   View Slide

5. Talk to Legal
   

   View Slide

6. TLP
   https://www.us-cert.gov/tlp
   

   View Slide

7. ● WWWWH&W
   ● Example: My Story
   ● What To Do Next?
   

   View Slide

8. Why?
   

   View Slide

9. Your Security
   Will Improve
   

   View Slide

10. You Will Improve
    Others Security
    

    View Slide

11. Share More
    Get More
    

    View Slide

12. A rising tide
    raises all boats
    

    View Slide

13. When?
    

    View Slide

14. Ingestion vs.
    Production
    

    View Slide

15. When You’re
    Ready to Act
    

    View Slide

16. When You’re Ready
    to Reciprocate
    

    View Slide

17. When You Can Be
    Confident
    

    View Slide

18. Who?
    

    View Slide

19. Formal Groups
    

    View Slide

20. Open Source Groups
    

    View Slide

21. Informal Groups
    

    View Slide

22. BONUS: Orgs With
    Similar Technology...
    

    View Slide

23. BONUS: Competitors
    

    View Slide

24. What?
    

    View Slide

25. Indicators of
    Compromise
    

    View Slide

26. Tactics, Techniques,
    & Procedures
    

    View Slide

27. Reports
    

    View Slide

28. Techniques,
    Methods, &
    Capabilities
    

    View Slide

29. (Legally Required) Pyramid of Pain
    https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
    

    View Slide

30. Sharing Hierarchy of Value*
    * The Author acknowledges this is a rip off
    

    View Slide

31. How?
    

    View Slide

32. Don’t Ask to Join
    

    View Slide

33. Be Trusting
    

    View Slide

34. Be Trustworthy
    

    View Slide

35. Be Action Oriented
    

    View Slide

36. BONUS: The Best
    Groups Have A Written
    Set of Expectations &
    Procedures
    

    View Slide

37. Where?
    

    View Slide

38. Mailing Lists
    

    View Slide

39. Chat
    

    View Slide

40. Semi Structured
    

    View Slide

41. Threat Intelligence
    Platform
    

    View Slide

42. Hybrid
    

    View Slide

43. Example:
    My Story
    

    View Slide

44. This is Kyle
    @kylemaxwell
    

    View Slide

45. Kyle & I
    started a Slack
    

    View Slide

46. We Invited Folks We Knew
    Shared Tools & Techniques
    We Invited More Folks
    

    View Slide

47. Kyle Invited
    Mark
    @markpars0ns
    

    View Slide

48. Mark Invited
    Me to Another
    Slack
    

    View Slide

49. Met New Folks
    Shared Intelligence
    Collaborated On Investigations
    Demonstrated Value to My Boss
    

    View Slide

50. So I Invited
    My Coworker
    John
    @swannysec
    

    View Slide

51. What To
    Do Next?
    

    View Slide

52. What To Do Next
    ●
    ●
    ●
    ●
    ●
    ●
    

    View Slide

53. Go Make Friends &
    Share Intelligence
    

    View Slide

54. Join Me @
    SANS Rocky
    Mountain 2017
    for FOR578
    

    View Slide