Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up
for free
Building Effective Threat Intelligence Sharing
Scott J. Roberts
July 23, 2017
Technology
1
65
Building Effective Threat Intelligence Sharing
A SANS Webex I did... awhile ago?
Scott J. Roberts
July 23, 2017
Tweet
Share
More Decks by Scott J. Roberts
See All by Scott J. Roberts
sroberts
2
180
sroberts
2
3.9k
sroberts
0
55
sroberts
1
160
sroberts
3
2.6k
sroberts
5
820
sroberts
1
11k
sroberts
2
750
sroberts
2
6.2k
Other Decks in Technology
See All in Technology
neo_analytics
0
990
kaga
0
190
hamadakoji
0
1.1k
kenya888
1
120
sat
1
980
sylph01
0
170
tzkoba
0
390
omn
0
570
tdys13
4
3.4k
layerx
1
750
greymd
0
600
kakka
0
3.3k
Featured
See All Featured
malarkey
119
16k
lynnandtonic
270
16k
trishagee
20
2k
keithpitt
401
20k
dotmariusz
94
5.1k
destraynor
223
47k
chriscoyier
145
19k
jnunemaker
PRO
40
4.5k
addyosmani
1348
190k
ammeep
656
54k
chriscoyier
684
180k
jonrohan
1021
380k
Transcript
Building Effective CTI Sharing
Scott J Roberts
Comments? Use #ctisharing and/or @sroberts
Table Stakes
Talk to Legal
TLP https://www.us-cert.gov/tlp
• WWWWH&W • Example: My Story • What To Do
Next?
Why?
Your Security Will Improve
You Will Improve Others Security
Share More Get More
A rising tide raises all boats
When?
Ingestion vs. Production
When You’re Ready to Act
When You’re Ready to Reciprocate
When You Can Be Confident
Who?
Formal Groups
Open Source Groups
Informal Groups
BONUS: Orgs With Similar Technology...
BONUS: Competitors
What?
Indicators of Compromise
Tactics, Techniques, & Procedures
Reports
Techniques, Methods, & Capabilities
(Legally Required) Pyramid of Pain https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
Sharing Hierarchy of Value* * The Author acknowledges this is
a rip off
How?
Don’t Ask to Join
Be Trusting
Be Trustworthy
Be Action Oriented
BONUS: The Best Groups Have A Written Set of Expectations
& Procedures
Where?
Mailing Lists
Chat
Semi Structured
Threat Intelligence Platform
Hybrid
Example: My Story
This is Kyle @kylemaxwell
Kyle & I started a Slack
We Invited Folks We Knew Shared Tools & Techniques We
Invited More Folks
Kyle Invited Mark @markpars0ns
Mark Invited Me to Another Slack
Met New Folks Shared Intelligence Collaborated On Investigations Demonstrated Value
to My Boss
So I Invited My Coworker John @swannysec
What To Do Next?
What To Do Next • • • • • •
Go Make Friends & Share Intelligence
Join Me @ SANS Rocky Mountain 2017 for FOR578