Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Building Effective Threat Intelligence Sharing

Ded29c7918dce50c65131df03c769004?s=47 Scott J. Roberts
July 23, 2017
Technology
1
66

Building Effective Threat Intelligence Sharing

A SANS Webex I did... awhile ago?

Ded29c7918dce50c65131df03c769004?s=128

Scott J. Roberts

July 23, 2017
Tweet

More Decks by Scott J. Roberts

See All by Scott J. Roberts
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
200
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
4k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
0
57
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
180
Ded29c7918dce50c65131df03c769004?s=48 sroberts
3
2.6k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
5
850
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
11k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
750
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
6.6k

Other Decks in Technology

See All in Technology
842515eaf8fbb2dfcc75197e7797dc15?s=48 sat
8
7.5k
573d75e1a72107ff5c806d7e70a9e67d?s=48 michimani
0
120
3e8f61263f14a620f21d5f3f89c4b846?s=48 gamella
0
760
Ef3b48913ea26665c25b2ad78e449d16?s=48 larchanjo
0
120
4b2f3a64637b51e81813accbe8a98083?s=48 miura55
0
190
C3cff54931c85fc209f4d58c9b843b5b?s=48 hagifoo
0
100
Ad449f3f4e595ade283a30c4f66010be?s=48 seto_hi
3
990
525442fc70ca92f82ae503f826956137?s=48 finengine
0
280
97d180294474e9df01503148f3b11f39?s=48 lambda
0
130
14d83dc17e2c893d7564b609ff8da4ca?s=48 techharmony
0
210
380bcd2ab751f5838abd8219df53e5fe?s=48 tomoki10
0
730
091dd27febe18fcb155ffbdb0dd63e02?s=48 hatumeika
0
120

Featured

See All Featured
7c8469ee8c9e594c65c59b919626c08d?s=48 scottboms
252
11k
88bc30284c6a424b63a92aad27d0ba36?s=48 jnunemaker
PRO
40
4.7k
8ec1383b240b5ba15ffb9743fceb3c0e?s=48 philnash
10
680
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
146
19k
F68cb25ae3e5c2106997454b13b7737d?s=48 brad_frost
157
6.5k
32de0bd2ba869609d26fd052a4622778?s=48 cromwellryan
104
6.3k
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
28
2.1k
06f8b41980eb4c577fa40c41d5030c19?s=48 keathley
20
770
433acaea1012b25d97ae66da9b998dad?s=48 malarkey
392
61k
Be9caeb9d4ef9944d151af909063ed6e?s=48 samlambert
237
10k
Ded01cdab114abe4ec13511e4c25b9bb?s=48 andyhume
64
3.8k
78b475797a14c84799063c7cd073962f?s=48 holman
288
130k

Transcript

  1. Building Effective CTI Sharing

  2. Scott J Roberts

  3. Comments? Use #ctisharing and/or @sroberts

  4. Table Stakes

  5. Talk to Legal

  6. TLP https://www.us-cert.gov/tlp

  7. • WWWWH&W • Example: My Story • What To Do

    Next?

  8. Why?

  9. Your Security Will Improve

  10. You Will Improve Others Security

  11. Share More Get More

  12. A rising tide raises all boats

  13. When?

  14. Ingestion vs. Production

  15. When You’re Ready to Act

  16. When You’re Ready to Reciprocate

  17. When You Can Be Confident

  18. Who?

  19. Formal Groups

  20. Open Source Groups

  21. Informal Groups

  22. BONUS: Orgs With Similar Technology...

  23. BONUS: Competitors

  24. What?

  25. Indicators of Compromise

  26. Tactics, Techniques, & Procedures

  27. Reports

  28. Techniques, Methods, & Capabilities

  29. (Legally Required) Pyramid of Pain https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

  30. Sharing Hierarchy of Value* * The Author acknowledges this is

    a rip off

  31. How?

  32. Don’t Ask to Join

  33. Be Trusting

  34. Be Trustworthy

  35. Be Action Oriented

  36. BONUS: The Best Groups Have A Written Set of Expectations

    & Procedures

  37. Where?

  38. Mailing Lists

  39. Chat

  40. Semi Structured

  41. Threat Intelligence Platform

  42. Hybrid

  43. Example: My Story

  44. This is Kyle @kylemaxwell

  45. Kyle & I started a Slack

  46. We Invited Folks We Knew Shared Tools & Techniques We

    Invited More Folks

  47. Kyle Invited Mark @markpars0ns

  48. Mark Invited Me to Another Slack

  49. Met New Folks Shared Intelligence Collaborated On Investigations Demonstrated Value

    to My Boss

  50. So I Invited My Coworker John @swannysec

  51. What To Do Next?

  52. What To Do Next • • • • • •

  53. Go Make Friends & Share Intelligence

  54. Join Me @ SANS Rocky Mountain 2017 for FOR578