In this episode, we're going to talk about different collection methods that you can utilize as a Cysa
analyst.
What you need to understand when it comes to collection methodology is that it's not just about collecting
information inside your network.
If all we did as analysts was grab as much of the information coming into our network as humanly possible,
we really wouldn't have a good idea of what else is going on out there in the interweb.
We wouldn't understand that.
Hey, this organization that closely aligns to my own has this type of attack that is constantly occurring,
or that this thread over here is impacting other networks that could eventually impact my own collection.
Methodology really refers to the art of understanding.
Hey, I need to collect different information from different sources, so I have a bigger picture of
the world around me, so I'm better prepared to defend my network against different types of attacks.
We don't want this closed loop of information where all we're gathering is information that's coming
from our own network.
We need information from a lot of different sources so that we can better protect ourselves and our
networks against different threat actors and the different threat vectors that may challenge our specific
network infrastructure.
The first type of collection methodology I want to talk about is open source.
Open source methodologies are all those things that you've probably utilized throughout your entire
career.
We're talking about the social media out there.
Maybe it's Twitter or X Facebook.
It can be even Etsy.
Believe it or not, different open source and social media information come from various sources to
include different blogs.
It's not uncommon for people to get open source information.
Here's the problem with open source information, though.
Everybody knows about it, including the threat actor.
So once we publish something that says, hey, my network was attacked by this and be aware of it,
they could change what they're doing, even a slight minutia that would change the entire attack vector.
This poses problems to us as cybersecurity analysts, because once the threat actor knows that we're
onto their game, they're going to change their their game a little bit to, uh, get around our protective
measures.
So open source collection methodology, while it's very valuable, can also pose some problems with
the actual defense against that specific methodology as well.
There's also blogs where people write about it.
These are usually experts that write about a specific, uh, attack vector or a different threat actor
then how their network or a network that they gained privileged access to is associated to a specific
attack.
The problem with blogs is they're usually about a 3 or 4 days after the attack occurs.
So the information at best is 3 or 4 days old, at worst it's 2 or 3 months old, and this could cause
problems into what's going on.
There's often also government bulletins, government bulletins from, say, FBI's um Infragard systems.
They provide those bulletins to us on a weekly basis or a monthly basis that tells us what's going on.
And if you're an Infragard member, then you get access to those specific bulletins.
It's not just FBI's Infragard, though.
There's Cisa, there's other government bulletins that come out, and while they try their best to associate
those bulletins specifically to an organization, some of them are very open source, meaning, again,
threat actors have access to them.
And finally, there's the dark web.
The dark web is easy to access.
Most people have it, and even those people that are on the dark web are constantly monitoring the different
forums, the different aspects of those same blogs or social media posts, but they're just not provided
on Facebook or Twitter.
They're on the own version of the dark web sphere.
Now, this could be a specific website that constantly changes, or it could be an older website that
people are still active on.
It doesn't really matter, but that open source information, where the dark web serves the same problem
of the information usually being old or the attacker has access to it anyway.
So dark web information, however, does provide us a key look into what's going on sometimes before
the threat actor actually does the attack, which is obviously quite well for us because it gives us
a different outlook into what's going on.
Then we have what's called closed source information.
These are usually paid fees that are put on by a specific security organization, whether it's Cloudflare
or another organization that does their own security, vulnerability testing or research.
These paid fees usually fund that research.
Now, the great thing about closed feeds is most threat actors aren't subscribing to those types of
feeds, and most closed source feeds have a specific requirement of you have to have equipment or be
a network that is, uh, reliable and actually been validated before they provide those feeds to you.
Do those feeds sometimes end up in the general public?
Absolutely.
Do they try their best not to make that happen again?
Yes.
Paid fees provide us a pathway into a specific research company that is providing the research towards
a vulnerability or a known exploit, and giving us the most up to date information as it comes to bear.
They could have warnings or warnings where they come out and say, hey, we're seeing this new vulnerability
that's being exploited.
We don't have new information about it, but be aware of it.
That provides us a closed feed of information of an ongoing attack.
They like to do information sharing, which provides us the most up to date information as it's coming
by.
However, this also poses the problem of not being readily accessible or very thought through.
Meaning that while the information is up to date, it's only the information they have access to, which
means sometimes it's a little off.
It could be attacking, say, port 443, but on the back end we didn't realize there was a malware going
into effect that caused that port to be vulnerable to attack.
All we may know is that, hey, something's happening on port 443.
We know that it's happening, but that's all the information we have.
However, some information is usually better than no information.
It usually comes also from internal sources.
For instance, if I have a firewall and I'm part of that vendor, then that vendor may have their own
security research.
And they're sending out to everybody that owns their firewall the latest paid information that comes
with that firewall.
This is great for us if you own the firewall, but if you don't, sometimes you don't have access to
it.
This would be a closed source information.
Now I'm going to show you a open source of information that you have readily accessible to you, as
long as you sign up.
Let's take a look at that.
Now, this is OT Alienvault open source of threat identification, meaning it's a threat feed that is
open source to anybody that signs up for it.
It didn't take much.
I signed up, it literally took two minutes and it gave me access to this information.
You can see here right here we have Coin miner 7181, meaning that's the number of counts that they've
seen and that we have feature of one.
We can see related pulses associated with it on different websites.
For instance, Seaborg provides us one month ago, and it was modified 26 minutes ago by this person.
And it tells us exactly what's going on.
If I right click on this and open a new tab, it brings me up to a new feature.
This feature goes on to tell me that, hey, it's in reference to CVE 2024, meaning it's recent today
and it's the 32,000th version of that feed.
I can copy that, but I can also go down to a more relevant one.
If we scroll down to a.
Historically we can see all the way down to 2022 and you get the point.
It really goes down all the way.
So this has been around, uh, related to the CVE since as early as 20, probably 2021.
If I kept on scrolling, I can go all the way back here, actually.
And you can see again 2021.
Right.
So the most up to date information is going to be right here on the CVE 2024 32,000.
I can see the indicator of compromises.
And it tells me that the CVE is 15,000.
It tells me other the URLs associated with it and then the domain as well.
And it's only showing the last ten entries.
If I scroll down, I can see other information like the file hash associated with the specific one.
So if I see this on my network, I can actually rule it out and go through and identify anything associated
with that specific hash.
Again, I can go down to the more, uh, recent information of 32,003, and you can see the related
pulses If I go here, I can look at the different comments that somebody that's already associated with
this specific feed has identified as part of this.
Now, comments are like anything else, you have to take that with a grain of salt, but sometimes it
provides us some good information.
By drop down we can see see link for common Windows Services Update and it provides me some link and
some valuable information.
This is just an example of one threat feed that maybe you should subscribe to, but there's various
ones out there.
There's ones on Cloudflare, there's other ones associated with sticks or taxi.
Those are more well known.
But for this one, Alienvault does a pretty good job.
And this episode we talked about open and closed source threat feeds and what you should be aware of
as a threat analyst.
In your Cisa exam, you're going to be asked specific questions about whether a feed is open source
or closed source, but it should be fairly high level.
You shouldn't see any direct questions about paid feeds versus information sharing or internal sources,
or even the different feeds that are associated with open source versus closed source.
Most of your questions are going to be very rudimentary when it comes to threat intelligence feeds,
and maybe why they're important.
Usually the answers are common sense.
To give you some relation to this type of questions that you might see, I would really understand that
a closed source is paid feed.
It provides information sourcing and it's usually from internal sources, usually from a vendor with
open source feeds.
We're really talking about information that's available freely on the internet, and it's shared across
the different aspects of that specific threat feed.
You really need to understand that the big difference between a closed source and an open source feed,
and how they provide reliability versus subjectivity when it comes to those types of feeds.
You might see scenarios based questions asking you specifically if a feed is closed source.
Maybe it'll ask something like you paid for a feed and this feed provides you X, Y, and Z.
Is this a closed source, an open source, or just a regular source?
You kind of get the picture.
I wouldn't expect to see any truly in-depth questions when it comes to Sisa about open source versus
closed source, but I would expect to see some rudimentary high level questions and why they may be
important for you as a cybersecurity analyst.