Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Building Effective Threat Intelligence Sharing

Ded29c7918dce50c65131df03c769004?s=47 Scott J. Roberts
July 23, 2017
Technology
1
73

Building Effective Threat Intelligence Sharing

A SANS Webex I did... awhile ago?

Ded29c7918dce50c65131df03c769004?s=128

Scott J. Roberts

July 23, 2017
Tweet

More Decks by Scott J. Roberts

See All by Scott J. Roberts
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
290
Ded29c7918dce50c65131df03c769004?s=48 sroberts
3
4.3k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
0
60
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
210
Ded29c7918dce50c65131df03c769004?s=48 sroberts
3
2.8k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
5
920
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
11k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
810
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
7.3k

Other Decks in Technology

See All in Technology
6d161fe47f36ac295189c3b6a0db2a9a?s=48 masahirokawahara
3
3.3k
93dcbac1a838bbec898747bb92aa47cc?s=48 sadonosake
0
1.7k
4c5769c58c5b504cd196dbc51d1d3858?s=48 dmiyamoto
0
250
6fd3816c016ce40c400cca3a3d3e8040?s=48 hamham1004
1
140
79dcb04101764d7bf66f898dd446838e?s=48 tsukubachallenge
0
300
154d77627bc95f4eb226c722023b5168?s=48 a1a
2
340
Ef779e9bc420affeb93b274cba74ef7c?s=48 hageyahhoo
3
1.9k
E83ff81bc5a881c33dcff37eb160ce12?s=48 kochizufan
0
1.6k
842515eaf8fbb2dfcc75197e7797dc15?s=48 sat
1
220
9eca6d3a5658ef22998083a3d8e7ec44?s=48 shigeruoda
0
120
29fc9602e0ed9cca544d677266dadd68?s=48 hikarut
1
21k
A64ac825509279a770c13c6fc517f11a?s=48 kawaguti
PRO
4
2.9k

Featured

See All Featured
5b6a2bd86ef643786a381a212e0ef2f1?s=48 geoffreycrofte
44
3.7k
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
224
48k
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
1352
200k
B47b288784fda77a94aeb234ca743c24?s=48 keavy
112
15k
A16eb159db895e3b01d3dc95767ad595?s=48 jonyablonski
40
2k
D67fff74178013024d833b3eec6cf27f?s=48 lynnandtonic
277
17k
C620790ae5bf5b50c245b2e0ef95f338?s=48 deanohume
294
28k
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
499
110k
0bce06bd06ee7a2c4f5500f25dcf7f18?s=48 paulrobertlloyd
73
4k
053e75a5b48b44d6dd0612795dfb326d?s=48 notwaldorf
56
3.6k
39488f9d172ab92fd352f2cd7b73258d?s=48 mza
82
4.5k
Ae14cc4491ac334f9cd23f9f93b4305e?s=48 orderedlist
PRO
333
37k

Transcript

  1. Building Effective CTI Sharing

  2. Scott J Roberts

  3. Comments? Use #ctisharing and/or @sroberts

  4. Table Stakes

  5. Talk to Legal

  6. TLP https://www.us-cert.gov/tlp

  7. • WWWWH&W • Example: My Story • What To Do

    Next?

  8. Why?

  9. Your Security Will Improve

  10. You Will Improve Others Security

  11. Share More Get More

  12. A rising tide raises all boats

  13. When?

  14. Ingestion vs. Production

  15. When You’re Ready to Act

  16. When You’re Ready to Reciprocate

  17. When You Can Be Confident

  18. Who?

  19. Formal Groups

  20. Open Source Groups

  21. Informal Groups

  22. BONUS: Orgs With Similar Technology...

  23. BONUS: Competitors

  24. What?

  25. Indicators of Compromise

  26. Tactics, Techniques, & Procedures

  27. Reports

  28. Techniques, Methods, & Capabilities

  29. (Legally Required) Pyramid of Pain https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

  30. Sharing Hierarchy of Value* * The Author acknowledges this is

    a rip off

  31. How?

  32. Don’t Ask to Join

  33. Be Trusting

  34. Be Trustworthy

  35. Be Action Oriented

  36. BONUS: The Best Groups Have A Written Set of Expectations

    & Procedures

  37. Where?

  38. Mailing Lists

  39. Chat

  40. Semi Structured

  41. Threat Intelligence Platform

  42. Hybrid

  43. Example: My Story

  44. This is Kyle @kylemaxwell

  45. Kyle & I started a Slack

  46. We Invited Folks We Knew Shared Tools & Techniques We

    Invited More Folks

  47. Kyle Invited Mark @markpars0ns

  48. Mark Invited Me to Another Slack

  49. Met New Folks Shared Intelligence Collaborated On Investigations Demonstrated Value

    to My Boss

  50. So I Invited My Coworker John @swannysec

  51. What To Do Next?

  52. What To Do Next • • • • • •

  53. Go Make Friends & Share Intelligence

  54. Join Me @ SANS Rocky Mountain 2017 for FOR578