>> Threat management. The learning objectives
for this lesson are to define threat intelligence,
to differentiate the different types of threat actors,
and to describe supply chain attacks.
Let's get started. Threat intelligence.
This is the continual process that is designed to help
organizations understand the threats that they may face.
Because the threats are always evolving,
we need to make sure that our processes for
identifying those threats are also evolving.
CISA has designated 16 critical sectors to
help identify the different types
of issues that they may face.
These sectors would include energy,
health care, financial, etc.
You can find out more information
at the URL on the screen.
Keep in mind the purpose of threat intelligence is
to help us stay ahead as much
as we can of the new threats
that are emerging and what we need to
be able to do to defend against
those threats for our own organization.
Let's talk about the different types
of threat intelligence.
First, we have tactical.
This is focused on the tactics,
techniques, and procedures or TTPs.
This is data that can be used by
an organization to perform vulnerability remediation,
infrastructure hardening and etc.
For this, we have the different tactics
that a threat actor might use,
their techniques, and their procedures.
But these are more about every group
or every specific threat actor
has their own way of doing things.
We want to make sure that those that we've
identified as being the likely threats for us,
that we are hardening our systems to be
able to defend against those known TTPs.
If your risk assessment has identified that you are
a likely target for
a specific type of threat attacker such as say,
just a hacktivist, then you want to make sure that
your websites are hardened
and that your web servers are protected.
You don't really need to worry about
nation-state-level attackers if you
haven't identified that as a threat.
The tactical intelligence will help you to make sure that
you are using the correct TTPs
to harden your organization.
Then strategic intelligence is
focused on the bigger picture.
This is used to identify the motivations, capabilities,
the intentions of the threat actors
so that we can develop midterm plans.
This is a step
above tactical where we want to make sure that
we understand why the threat actors
we've identified are doing what they're doing,
just how good are their capabilities and
we want to make sure that we
factor that into our planning for the future.
Then also we have operational intelligence,
and this is collected from
the organization's own infrastructure,
such as our SIEM devices or logs.
This will identify the current attacks
and the indicators of compromise.
This is real-time information.
This is what's going on in
your organization right now
so you can read your firewall logs,
your SIEM logs, your event logs on your servers.
All of that information is letting you
know the things that are going on now.
You can use that to craft your own response and in turn,
harden your system against those types of attacks.
Threat and adversary emulation.
Threat emulation is when we use the known TTPs to
emulate how an attacker may operate in a realistic way.
We do this so that we can test our current defenses.
If we go and use the TTPs and use the actual tools
that an attacker that we think is
going to be a likely attacker against us,
we can simulate those attacks against ourselves to make
sure that we are already hardened against those.
Now adversary emulation is a
little different because it uses
the TTPs of a specific threat actor in a realistic way.
We're not using all the tools that are
available to us or all the TTPs.
We're using those that we think are specific
to one specific adversary.
We're going to get into the different types of
adversaries in just a little bit.
Threat hunting. Threat hunting is
using threat intelligence to help us develop
hypothesis and analytics that is
based on what threat actors are known to do
so that the threats can be
proactively found rather than passively detected.
If we already know what their tools
are using or what their procedures
are and all of their tactics,
we can turn around and use that information to help
us harden our own defenses before something happens.
We don't have to wait around for
it and detect the attack.
We can actively harden our systems and
our defenses against them because we
already know what's happening outside in the real world.
We can get this information
from advisories and bulletins.
This is information that's been released by
vendors and researchers about
new TTPs and vulnerabilities
that have been detected in the wild.
These are usually the ones that are zero-day or
really freshly found live on the web.
We really want to pay attention to these because while
our organization might not be a target
for zero days and that type of thing,
we want to make sure that
we go ahead and harden those because when they
eventually filter down to other threat actors
who might use them against us, we're already protected.
We can also make use of
intelligence fusion and threat data.
This is SIEM and threat
analytics platforms that can apply
intelligence fusion techniques to
the collected information to locate threats.
This is gathering all the information
on our network and then
using that intelligence fusion system to help
look at that collected information and try to find
the needle in the haystack of
maybe things that we didn't notice,
but by taking all this information
together and making a new big picture out of it,
we can see things in a different way
and find new threats.
Let's discuss intelligence collection methods.
First, we have our intelligence feeds.
These provide data such as known phishing IPs and URLs,
malware, ransomware, or that type of thing.
These are really good for firewalls
because you can put these in and
they will block outgoing connections
to these IP addresses of these URLs,
for example, for phishing so that if your users receive
an email that has one of these known links
in it, it's going to get blocked.
When they go to click on it, it's not going to
be allowed to go out of the firewall.
That's a very helpful feature.
Then we also can find information from the deep web.
The deep web is the parts of
the web that are not indexed and are generally hidden.
But this also includes the so-called dark web.
The dark web is a component of the deep web.
A lot of times what will happen is
a company will be breached and their data will be stolen,
and then information will be put
up for sale on the dark web.
Once that is done,
they'll usually provide samples
so that people can prove that
this is real information from
the company they're claiming it to be from.
If you see that information through
your own dark web monitoring or
a third-party service that you
found that locates that information,
that's a way for you to know that
you've been breached and you
need to look into starting to find the cause of that.
We can also use open-source intelligence or OSINT.
This is publicly available information
such as social media,
DNS records, websites, that type of thing.
A lot of times attackers
will post their information on social media.
If we're monitoring for those,
then we can get signs of different attacks.
>> A lot of times they'll post how they went
about doing their attacks
with the tools and things that they've used,
and we can use that information
to craft our own response.
Finally, we have human intelligence or HUMINT.
This is collecting intelligence by
actually interacting with people.
This might be interacting with
the hacker himself or herself,
it might be going through with
other different types of
groups that are posting information online.
Regardless, as long as you're
interacting with people to collect information,
this is considered human intelligence.
Let's move on to the actual threat actor groups.
The first level is the script kiddie.
This is a person that we'll be using
a hacker tool and they'll have
no knowledge of how that tool works,
they just click and run.
Their goals are usually doing this for the fun of it,
either gaining attention or proving their skills.
These are the lowest level attacker.
Now, that doesn't mean that they're not dangerous
because a lot of times they can
cause a massive amount of damage to an organization
because they don't understand
these tools and what they're doing.
This especially true when someone's
using denial-of-service attacks on an organization,
it doesn't take a lot to be able to do that.
Insider threat is the next level.
This is an employee or a contractor,
that's the key thing to keep in mind.
They're already on the inside,
so they're inside the castle,
and they might be a threat,
whether it's intentional or unintentional.
This could be where an individual
accidentally does something and causes
a lot of problems or damage to
your company because they are on the inside.
This is also a reason we want to make sure we're
looking at permission creep
where a user doesn't
have more access rights than they need,
because if they have those rights and then they make
a mistake then the damage can even
spread a lot further on the inside.
The next level are competitors.
You may be a victim of cyber espionage
to steal your information.
This is far more common than most people realize,
and we want to make sure that we are
protecting ourselves from this.
Next up is organized crime.
If there's money to be made,
you're going to find organized crime there.
Now organized crime has shifted to using
cyber to help them facilitate their crimes.
Ransomware gangs are a good example of this,
but they're also getting into cyber espionage.
There's a lot of money to be made in cyber,
and again, anytime there's money to be made,
you're going to find organized crime.
These groups can be from all over the world,
they can be small groups all the way up
to the groups that everyone typically
associates with organized crime like Russian mafia
or organized crime from South or Central America,
or even inside the United States.
Again, if there's money to be made,
they're going to be there.
Next up are hacktivists.
These will use a cyber attack
for a specific political agenda.
They often target corporations because of
the actions of the corporation
or maybe their social stance.
Anonymous is a good example of this.
Then finally we have nation-states.
These are the truly skilled attackers
that come from government organizations.
These are also known as advanced
persistent threats or APTs.
Good examples of these are whenever you
hear about the attacks from China or from Russia,
they always have an APT number with them and they
have really funny names that go along with it.
These are the groups that are really
good at getting into things
because they've got the resources,
they've got the financial backing to make sure,
they've got the knowledge,
and you put all those things together and you
develop a truly skilled attacker.
Again, most companies or most organizations
are not going to be targeted
by this level of threat actor,
but if you are, then you
really need to make sure you're doing
everything possible to lock everything down.
Then let's go over supply chain access.
This is a form of attack that is
becoming far more common and has to
go after third party contractors
to gain access to a target.
For example, again,
we've talked about this in the lesson before,
but Target had this happen to them,
where their third-party HVAC vendor
was connected directly into the Target's network.
The HVAC vendor was breached
and the attacker pivoted over inside to
the Target network and was able to compromise
their payment system and then
steal credit card information.
Target itself did not actually get hacked,
their third party vendor did and then they pivoted over.
Now, yes, Target should have done a better job of
making sure that that third-party access was limited,
but this is something that often goes overlooked,
is we put something in and we make sure that
that third party vendor is able to do
their work and we don't really give
any thought to anything else.
I'll give you an example of this that happened with
us is that one of the sites that we
took over had a Raspberry Pi there for
HVAC control and no one
in the business knew what it was for,
they just had always seen this little device there,
and when we finally got into the device,
we found out that it hadn't been updated in years
and it was on a very old version
of the Raspberry Pi software.
We contacted the HVAC vendor and helped
them to get it updated because
this is not their specialty,
they're not an IT company,
they're just trying to make sure they're able to monitor
the HVAC controls for this particular customer of theirs.
But by doing that,
they had pretty much introduced
a huge vulnerability to
the network that had been there for years.
You want to make sure that your third-party vendors
are properly segregated from your network,
that you don't give them access to anything
more than what they actually need,
and to make sure that you give
due consideration to what it is that they
actually need on your network so that it doesn't become
a privileged creep where they just
keep getting more and more information or heaven forbid,
that once they're connected,
that's as far as it goes and you
don't give it any other thought.
This is a huge problem and
oftentimes these guys are easier targets
because an HVAC vendor maybe
doesn't have an IT department or if they do,
they may not have a security department.
It's not on their radar because
it's not their primary focus of
their business. Let's summarize.
We went over the different types of
threat actors and then we also
discussed the types of threat
intelligence and threat hunting,
we went over the different types of
intelligence collection methods,
and we discuss supply chain attacks.
Let's do some example questions.
Question 1, this tactic allows organizations to simulate
a specific threat actor to
the organization and how they may attack.
Adversary emulation. Question 2,
this type of intelligence is focused on
the big picture and is used to make mid-range plans.
Strategic intelligence. Question 3,
this threat actor type is focused on a political agenda.
Activist. Finally, Question 4,
this threat actor type is deeply
funded and uses sophisticated techniques.
Nation-state or advanced persistent threat, APT.
I hope this lesson was helpful
for you, and I'll see you in the next one.