Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Building Effective Threat Intelligence Sharing

Ded29c7918dce50c65131df03c769004?s=47 Scott J. Roberts
July 23, 2017
Technology
1
65

Building Effective Threat Intelligence Sharing

A SANS Webex I did... awhile ago?

Ded29c7918dce50c65131df03c769004?s=128

Scott J. Roberts

July 23, 2017
Tweet

More Decks by Scott J. Roberts

See All by Scott J. Roberts
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
180
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
3.9k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
0
55
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
160
Ded29c7918dce50c65131df03c769004?s=48 sroberts
3
2.6k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
5
820
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
11k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
750
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
6.2k

Other Decks in Technology

See All in Technology
Dd23bc768f5ebe8a01126aaa8f0c86cf?s=48 neo_analytics
0
990
6e910ea53b24d30c3fb5cf6ae0e313f5?s=48 kaga
0
190
C47bda32c8455a59471cd7e19c32c074?s=48 hamadakoji
0
1.1k
96de66872f54da75c05c881c7a3713ce?s=48 kenya888
1
120
842515eaf8fbb2dfcc75197e7797dc15?s=48 sat
1
980
404139d782ec666acea93dffc86e089f?s=48 sylph01
0
170
Cd891a89dfec6ca7bd278b5f5bd87c90?s=48 tzkoba
0
390
0edbcf49de5aed437e279402dc0c6a7e?s=48 omn
0
570
835671ae91e49b2637313b91dacda1db?s=48 tdys13
4
3.4k
D683c1df0b6584c3f1e279ef6c8c04f9?s=48 layerx
1
750
F082484f19b518225501fafa28d05b93?s=48 greymd
0
600
56d7bcf9b5071512c65e753a1619987a?s=48 kakka
0
3.3k

Featured

See All Featured
433acaea1012b25d97ae66da9b998dad?s=48 malarkey
119
16k
D67fff74178013024d833b3eec6cf27f?s=48 lynnandtonic
270
16k
3d6ace9554821d552146413bcdf874f6?s=48 trishagee
20
2k
E14f55d3f939977cecbf51b64ff6f861?s=48 keithpitt
401
20k
651dcfe41723207fbb0aa044a4f7c07f?s=48 dotmariusz
94
5.1k
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
223
47k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
145
19k
E13c31390e0369fcd5972292ce0e7b92?s=48 jnunemaker
PRO
40
4.5k
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
1348
190k
B83d5b590577969ee79a5ad845411a7d?s=48 ammeep
656
54k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
684
180k
64827b31aef81498662e8af4bd6d5157?s=48 jonrohan
1021
380k

Transcript

  1. Building Effective CTI Sharing

  2. Scott J Roberts

  3. Comments? Use #ctisharing and/or @sroberts

  4. Table Stakes

  5. Talk to Legal

  6. TLP https://www.us-cert.gov/tlp

  7. • WWWWH&W • Example: My Story • What To Do

    Next?

  8. Why?

  9. Your Security Will Improve

  10. You Will Improve Others Security

  11. Share More Get More

  12. A rising tide raises all boats

  13. When?

  14. Ingestion vs. Production

  15. When You’re Ready to Act

  16. When You’re Ready to Reciprocate

  17. When You Can Be Confident

  18. Who?

  19. Formal Groups

  20. Open Source Groups

  21. Informal Groups

  22. BONUS: Orgs With Similar Technology...

  23. BONUS: Competitors

  24. What?

  25. Indicators of Compromise

  26. Tactics, Techniques, & Procedures

  27. Reports

  28. Techniques, Methods, & Capabilities

  29. (Legally Required) Pyramid of Pain https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

  30. Sharing Hierarchy of Value* * The Author acknowledges this is

    a rip off

  31. How?

  32. Don’t Ask to Join

  33. Be Trusting

  34. Be Trustworthy

  35. Be Action Oriented

  36. BONUS: The Best Groups Have A Written Set of Expectations

    & Procedures

  37. Where?

  38. Mailing Lists

  39. Chat

  40. Semi Structured

  41. Threat Intelligence Platform

  42. Hybrid

  43. Example: My Story

  44. This is Kyle @kylemaxwell

  45. Kyle & I started a Slack

  46. We Invited Folks We Knew Shared Tools & Techniques We

    Invited More Folks

  47. Kyle Invited Mark @markpars0ns

  48. Mark Invited Me to Another Slack

  49. Met New Folks Shared Intelligence Collaborated On Investigations Demonstrated Value

    to My Boss

  50. So I Invited My Coworker John @swannysec

  51. What To Do Next?

  52. What To Do Next • • • • • •

  53. Go Make Friends & Share Intelligence

  54. Join Me @ SANS Rocky Mountain 2017 for FOR578