In this episode, we're trying to cover a convergence of supply and check technology and how supply
chain impacts what you're trying to accomplish as a cybersecurity analyst, both in a SoC environment
and as your organization as a whole.
We're also going to discuss tactics, techniques, and procedures and how malicious actors are utilizing
this framework in order to pull off some of the more daring or intrinsic attacks against a specific
network or your enterprise environment.
Finally, we're going to discuss intelligence and how threat intelligence impacts your trends and how
to safeguard your networks.
Knowing that threat actors are using that intelligence or using those actions before they actually pull
off the different attacks, all of these combined are an assortment of different features within the
threat analyst that you need to be aware of in order to properly secure your environment and your network
against those specific threat actors that we talked about in the last episode.
Supply chain management affects how you're going to utilize different equipment and where you source
your equipment from, both from an IT standpoint as well as from a cybersecurity standpoint.
You need to be aware of that.
All supply chain is not created equally.
If you're buying servers off of eBay or maybe a third party vendor, they could inject malware and change
the intrinsic capabilities of that specific hardware to in order to move forward against a malicious
vector within your network.
That is to say, if I'm buying a third party equipment from a vendor, and even if it's Cisco or Linksys
or some well-known provider, yet it's going through maybe a shady third party vendor, it could have
malicious activity embedded upon the firmware, or even in the hardware that you wouldn't otherwise
be familiar with.
A lot of times we look at different third party vulnerabilities associated specifically to that hardware,
based on where you source that equipment from.
counterfeit software and hardware is often marked by those third party vendors.
I can tell you from my own experience that we purchased different hardware that we thought was Cisco
equipment, and it had all the the markings on there, had the serial numbers, even had the model number
that was appropriate to a real piece of equipment.
But once you opened up that box, you started to know some key differences and how that information
or how that hardware was laid out.
We later found out that that hardware had actually been infected with specific malware associated with
that firmware, because not only was the hardware counterfeit, but so was the software.
The malicious actor was able to get in there and change specific programs, change different, uh,
complexities of that hardware that allowed them to create a backdoor into that system.
Now, luckily, we were able to find that out because some of the different key influences, a part
of that hardware kind of led us down that trail to identify this as being counterfeit hardware Associated
with a known switch.
Because of that, we were able to remove that from our network and then buy the appropriate hardware
off the supply chain manager.
Now, that sounds like one of the once in a while things, but I want you to picture this way back in
the second Gulf War, there were specific vendors that the United States military utilized in order
to move forward against specific terrorist organizations.
GPS identification was brand new technology.
When it came to that.
People were starting to use digital cameras and digital phones at the time to record their videos,
and the United States military, along with the CIA, was able to then use those pictures that imprinted
a GPS, lat and long associated with that picture, and then were able to identify exactly where the
picture was taken when the terrorist organization published it online.
This is a form of supply chain management that was curtailed via an APT, i.e. the United States government,
to produce those concepts that we needed to know supply chain manipulation is another thing that you
need to be aware of.
Supply chain manipulation happens when you've got a carrier that moves products or services from one
point to another that may be intercepted along the route, meaning that if I have a piece of equipment
that's, say, going from a known good vendor, but it ends up in a warehouse somewhere that may be
a fraudulent threat.
Actor could go in and replace that piece of equipment with a known bad piece of equipment or a piece
of equipment that they were able to inject malicious software into.
This happens on occasion.
It is rare, but it does happen and you just need to be aware of that.
From my first example where we had supply chain management issues, just be aware that all your equipment
should have known good software, known good hardware, recognizable serial numbers and model numbers
and correspond with what you're getting from the actual vendor.
You don't want to use third party vendors when possible.
If I'm buying a piece of Cisco equipment, I need it to come from Cisco when possible.
Now that's not always possible, especially in lower end stuff.
Or if you're buying a used server.
And in those cases, just be aware that there is a certain amount of threat that comes with or a certain
amount of of vulnerabilities that come from buying software or hardware from a third party vendor,
especially if you can't 100% guarantee that that vendor is legit.
Tactics, techniques and procedures refer to the strategic goals, methodologies, and processes that
a threat actor uses in order to invade or exploit a network.
Strategic goals could encompass different aspects of the actual goals of the threat actor.
We just talked about, uh, apts and nation states and script kiddies in the last episode, but what
are their strategic goals?
If it's a specific crime organization, their strategic goal, too, could be to inject a network with
ransomware and then collect money from that ransomware.
That's their goal, right?
But what is their strategic goal?
What is how are they going to actually accomplish that task?
That's the methodology that comes into play.
A different methodology could be utilizing a PDF document or a word document or some other document
where the organization opens it.
They accidentally inject their system with malware that now sets up a botnet within the field.
Their command and control system then sends down the pipeline to upload a new malware form that then
projects ransomware across not just that machine, but worms out into other machines.
That would be their methodology.
And finally, their process.
Their process could be the step by step guide or execution of that specific technique, i.e. step one
find out through social engineering how or who is responsible with administrative privileges within
their network.
Step two send them a spear phishing email.
Step three inject that spear phishing email with a link specific to malware or injection of a specific
type of malware that will then open a communication process with our known servers.
Processes are just step by step directions that the threat actor could utilize in order to pull off
their overarching goal or methodology.
Intelligence sources are broken up into reliability, credibility, accuracy, timeliness, and, of
course, accessibility.
Now these all come into play when it talks about actual intelligence sources.
I could have my intelligence come from a reliable or accurate source, but the credibility may be very
low.
What do I mean by credibility versus reliability?
Because I have a lot of students that kind of get intermingled or muddied when they start talking about
this.
I can have a reliable source, meaning that they're providing Intel on a weekly basis every Friday,
just like they're supposed to be.
However, the information they're providing me isn't actually credible, meaning they're 50 over 50
hit ratio is pretty low.
I could get reliable information from them, meaning that the information is coming every Friday, but
the credibility could be that 50 over 50 structure where?
Yeah, some of it is really on target, but some of it isn't.
This is where credibility comes into play versus reliability.
Then we talk about accuracy.
How accurate is the information that they're giving us.
Is that accuracy 100%.
Meaning that every time they give me data and it's credible data, the accuracy is on point.
We know, hey, they're going to attack this IP address or this piece of malware is directed to this
specific system.
How accurate is the information they're actually giving me.
Then there's timeliness.
Timeliness comes into play with how reliable or how credible the information is coming in at a specific
time.
Now, I just talked about that and I kind of muddied up the waters, but let's take it back into further
step.
If I have credible information that's highly reliable, but it was reliable and credible and accurate
a year ago, it does me no good now, because it was over a year ago that it was actually credible,
meaning that the timeliness is completely off.
However, let's talk about a zero day attack.
If I'm getting credible, reliable information today that hasn't been released to the public or hasn't
been actually constituted out to a network, that's very timely information.
However, if my system has already been injected with the malware and you're just now feeding me the
information, the timeliness is all off.
It really doesn't make sense.
It's like, thank you for telling me something I already know.
And finally, there's accessibility of the information.
How accessible is the information?
What do we mean by that?
Is sometimes the federal government or different government organizations or even threat intelligence
organizations will send us information, or they knew about the information a week ago, and they're
just now giving that to us now, that kind of slues that line between timeliness versus accessibility.
But let's kind of break it out a little bit more by that.
They've given us the information.
It's timely, and the attack hasn't hit our system yet, but we're not telling anybody else within our
IT and framework, which means the CISO and maybe the director has it, but the technicians don't because
they're trying to keep that information very tight lipped.
That means that the technicians that are working on the information and hardening up our system, they
don't have access to the information, but we're fixing the problems.
That's where accessibility really comes into play.
Sometimes we get information at a high level, and we have to do things on our network that we don't
really understand.
The reasons why?
Because management or the type level people that have access to it aren't filtering that information
down to us.
And the reason they're not doing that is because the attack could occur without notice.
Or maybe they're not entirely sure about the credibility or the accuracy.
Accessibility regularly comes into play of how accessible is the information and how far is it getting
passed down to the line of where our technicians or the people that need it, actually have it?
This can be from the company perspective, all the way down to the employee perspective.
This is where accessibility really comes into play.
Finally, let's talk about confidence levels within the chart.
Here you can see specific chart or framework that we utilize in different confidence levels associated
with intelligence or with the information that's coming down the pipeline.
For instance, if our confidence level is zero, we don't have a very good confidence level that the
information is accurate or reliable.
Or maybe it's not timely, meaning that our confidence level is very low.
On the flip side, maybe we have a report of malware that's being developed on the dark web, and we've
seen past sources come from this or past information from this source coming down the pipeline where
it's highly reliable, highly accurate, and it's very time sensitive, meaning that we have a very
high confidence level.
Confidence level really is kind of a judgment call.
It's not all logic based, but what you really need to understand about it is that we need to utilize
that in terms of a real world number.
When associated to an enterprise environment, sometimes we get intelligence that's unreliable but highly
accurate and highly timely.
Sometimes we get highly accurate information, but the reliability is very low.
This sort of confidence level has really come into play, where there's a different chart or flow that
comes into it.
It's more of an art form than logic.
But just realize for Siza that you need to understand that our confidence is either going to be low,
moderate, or high.
And if I have a high confidence level, then I need to act on that information.
That doesn't mean that I have low confidence in the information that I shouldn't act.
We may take predetermined levels, but if I have high confidence levels, I'm going to act before the
low confidence levels on that same information.
Throughout this episode, we talked about supply chain management and how it can be utilized by malicious
actors.
We talked about tactics, techniques, and procedures that malicious actors can utilize across our enterprise
environment.
And finally, we talked about intelligent sources and how intelligent sources interact with those Ttps.
For Cisa, you need to have a high level overview and understanding of tactics, techniques, procedures,
supply chain, and intelligence source.
You're going to see questions about scenario based across different arcs of not only confidence levels,
but how intelligent sources are rated versus the reliability versus accuracy.
You should have a good breadth of knowledge when it comes to high accuracy versus timeliness.
Versus the other concepts that we discussed.
You may get a scenario based question that says, I have highly accurate and reliable information,
but the trustworthiness of the information has been spotty in the past.
How would you rate your confidence level?
That would be expected?
Uh, question that you might see in one Sisa.
You might also see a different question that talks about confidence levels of being very low, but then
the information is highly reliable or, uh, very accurate.
This is where you kind of really have to shave that art form into logic and really look at it from a
perspective of an analyst in your real world position.
Like I said, there's no one tried and true reason to it.
There's a lot of art form associated with it, but you should know the principles and use your judgment
as best you can.
Most of the time, the questions are going to be very slanted in such a way that you can easily identify
whether it's a high confidence level versus a low confidence level, and where the accuracy versus timeliness
versus reliability come into play.
If you can do that, you should be fine with the exam.