Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Building Effective Threat Intelligence Sharing

Ded29c7918dce50c65131df03c769004?s=47 Scott J. Roberts
July 23, 2017
Technology
1
69

Building Effective Threat Intelligence Sharing

A SANS Webex I did... awhile ago?

Ded29c7918dce50c65131df03c769004?s=128

Scott J. Roberts

July 23, 2017
Tweet

More Decks by Scott J. Roberts

See All by Scott J. Roberts
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
240
Ded29c7918dce50c65131df03c769004?s=48 sroberts
3
4.2k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
0
58
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
190
Ded29c7918dce50c65131df03c769004?s=48 sroberts
3
2.7k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
5
880
Ded29c7918dce50c65131df03c769004?s=48 sroberts
1
11k
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
780
Ded29c7918dce50c65131df03c769004?s=48 sroberts
2
7k

Other Decks in Technology

See All in Technology
96ae3b7224ad653bdcc80059fa10fd8a?s=48 kata_junn
1
110
2cf373725ded741824c50fd571eda6e1?s=48 udzura
0
100
65241d0356dc5a93b0fec68bcf7b42ac?s=48 yumulab
1
150
7cd783377515bdf8207062840b7b2f4e?s=48 soracom
PRO
0
240
2037978e199b5947c8304d0435de9944?s=48 irisuinwl
0
410
155865f5a03ecd18b3d3968a88efb41a?s=48 natsuki7777
0
110
D0f23208dff6d54a2a4305e65af569c8?s=48 shiozaki
0
290
842515eaf8fbb2dfcc75197e7797dc15?s=48 sat
2
270
B79e8f240b4b730fb692ab93ad42a89b?s=48 darquro
2
270
C4221ba79492601eb59a9ef5d4f4bbaa?s=48 nakamuuu
3
270
7cd783377515bdf8207062840b7b2f4e?s=48 soracom
PRO
0
210
1dceaa2dcea41c16004f430c1723b20e?s=48 miso
0
130

Featured

See All Featured
766b9746b59e6f09e280cd33cf4ed419?s=48 skipperchong
13
980
C7393b7ba7ec9c8890dd77d209fbb3c9?s=48 maltzj
504
37k
E4f5d494ebdc9e7cce1aecf3ce3e8bc1?s=48 shpigford
167
19k
465724d73fe3a92c0879fdfb43a3a6f3?s=48 philhawksworth
196
17k
B6a8f005f39d23ffc930508ac9da68b9?s=48 vanstee
122
5.1k
B3d6434763caa0ef5dc4b792662c49f7?s=48 smashingmag
287
47k
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
496
110k
245cee81a9c424266e5e401d844ea881?s=48 lara
595
62k
F383c6a4dc55e331bbe2987b622cee6b?s=48 stephaniewalter
263
11k
9375a9529679f1b42b567a640d775e7d?s=48 schacon
152
6.8k
719435d98d452de7ac367c828266cf01?s=48 erikaheidi
27
5k
1b8ad785acdd1ce1c99914b1c2a4e10e?s=48 sugarenia
235
950k

Transcript

  1. Building Effective CTI Sharing

  2. Scott J Roberts

  3. Comments? Use #ctisharing and/or @sroberts

  4. Table Stakes

  5. Talk to Legal

  6. TLP https://www.us-cert.gov/tlp

  7. • WWWWH&W • Example: My Story • What To Do

    Next?

  8. Why?

  9. Your Security Will Improve

  10. You Will Improve Others Security

  11. Share More Get More

  12. A rising tide raises all boats

  13. When?

  14. Ingestion vs. Production

  15. When You’re Ready to Act

  16. When You’re Ready to Reciprocate

  17. When You Can Be Confident

  18. Who?

  19. Formal Groups

  20. Open Source Groups

  21. Informal Groups

  22. BONUS: Orgs With Similar Technology...

  23. BONUS: Competitors

  24. What?

  25. Indicators of Compromise

  26. Tactics, Techniques, & Procedures

  27. Reports

  28. Techniques, Methods, & Capabilities

  29. (Legally Required) Pyramid of Pain https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

  30. Sharing Hierarchy of Value* * The Author acknowledges this is

    a rip off

  31. How?

  32. Don’t Ask to Join

  33. Be Trusting

  34. Be Trustworthy

  35. Be Action Oriented

  36. BONUS: The Best Groups Have A Written Set of Expectations

    & Procedures

  37. Where?

  38. Mailing Lists

  39. Chat

  40. Semi Structured

  41. Threat Intelligence Platform

  42. Hybrid

  43. Example: My Story

  44. This is Kyle @kylemaxwell

  45. Kyle & I started a Slack

  46. We Invited Folks We Knew Shared Tools & Techniques We

    Invited More Folks

  47. Kyle Invited Mark @markpars0ns

  48. Mark Invited Me to Another Slack

  49. Met New Folks Shared Intelligence Collaborated On Investigations Demonstrated Value

    to My Boss

  50. So I Invited My Coworker John @swannysec

  51. What To Do Next?

  52. What To Do Next • • • • • •

  53. Go Make Friends & Share Intelligence

  54. Join Me @ SANS Rocky Mountain 2017 for FOR578