While this isn\u2019t a post on what threat intelligence is or is not I\u2019d be negligent if I didn\u2019t at least begin to put some scope and context around this term as the focus of this post is on making threat data and intelligence actionable.\u00a0 Not to mention, every vendor and their grandmother is trying to use this phase to sell products and services without fully understanding or defining its meaning.<\/p>\n
First, it is important to understand that there is a difference between data and threat intelligence.\u00a0 There are providers of data, which is generally some type of atomic indicator (i.e. IOC) that comes in the form of an IP address, URL, domain, meta data, email addresses or hash.\u00a0 This data, in its least useful form, is a simple listing of indicators without including attribution of the threat actor(s) or campaigns with which they are associated.\u00a0 Some providers include the malware\/malware family\/RAT that was last associated with the indicator (i.e. Zeus, cryptolocker, PlugX, njRAT, etc.) and the date associated with the last activity.\u00a0 Some other providers focus on telemetry data about the indicator (i.e. who registered the domain, geolocated IP, AS numbers, and so on).\u00a0 Moving up the maturity scale and closer to real intel are providers that track a series of indicators such as IP, domains\/subdomains, email addresses and meta data to a campaign and threat actor or group.\u00a0 If we add the atomic indicators plus the tactics (i.e. phishing campaigns that include a weaponized PDF that installs a backdoor that connects to C2 infrastructure associated with a threat actor or group) used by the threat actors we start to build a more holistic view of the threat.\u00a0 Now that we understand tactics, techniques and procedures (TTPs) and capability or our adversaries, we focus on the intent of the actors\/groups or personas and how their operations are, or are not, potentially being directed at our organization.\u00a0 The final piece of the equation, which is partially the focus of this post, is understanding how we take these data feeds, enrich them, and then use them in the context of our own organization and move towards providing actual threat intelligence \u2013 but that is a post on its own.<\/p>\n
Many organizations think that building a threat intelligence capability is a large undertaking.\u00a0 To some extent they are correct in the long term\/strategic view for a mature threat intel program that may be years down the road.\u00a0 However, the purpose of this post is to argue that even with just a few data and intel sources we can enable or enhance our current capabilities such as security monitoring\/analysis\/response and vulnerability management services.\u00a0 I honestly chose these services as they fit nicely in my reference model for a threat monitoring and response program as well as threat intel which is at the center of this reference model.\u00a0 So let\u2019s walk through a few examples\u2026<\/p>\n
Enrichment of Vulnerability Data<\/strong><\/p>\n Vulnerability assessment programs have been around for what seems like forever, but mature vulnerability management programs are few and far between.\u00a0 Why is this?\u00a0 It seems we, as security professionals, are good at buying an assessment technology and running it and that\u2019s about it.\u00a0 What we aren\u2019t very good at is setting up a full cycle vulnerability management program to assign and track vulnerability status throughout the lifecycle.\u00a0 Some of the reasons are due to historical challenges (outlined in more detail in a research paper I posted here: http:\/\/goo.gl\/yzXB4r<\/a>) such as poor asset management\/ownership information, history of breaking the infrastructure with your scans (real or imagined by IT), or way too many vulnerabilities identified to remediate.\u00a0 Let\u2019s examine that last challenge of having too many vulnerabilities and see if our data and intel feeds can help.<\/p>\n Historically what have security groups done when they were faced with a large number of vulnerabilities?\u00a0 The worst action I\u2019ve seen is to take the raw number of vulnerabilities and present them as a rolling line graph\/bar chart over time.\u00a0 This type of reporting does nothing to expose the true risk, which should be one of the main outputs of the vulnerability management program, and infuriates IT by making them look bad.\u00a0 Not to mention these \u201craw\u201d numbers generally tend to include the low severity vulnerabilities.\u00a0 Do I really care that someone can tell what timezone my laptop is set to?\u00a0 I don\u2019t know about you but I doubt that is going to lead to the next Target breach.\u00a0 Outside of raw numbers, the next type of action usually taken is to assign some remediation order or preference to the assessment results.\u00a0 While a good start, most security teams go into \u201clet\u2019s just look at sev 4 and sev 5 vulnerabilities\u201d mode which may result in what amounts to a still very large list.\u00a0 Enter our threat data\u2026<\/p>\n What if we were able to subscribe to a data feed where the provider tracked current and historical usage of exploits, matched the exploit with the associated vulnerabilities, and hence the required remediation action (i.e. apply patch, change configuration, etc.)?\u00a0 This data, when put into the context of our current set of vulnerabilities, becomes intelligence and allows us prioritize remediation of the vulnerabilities that impose the greatest risk due to their active use in attack kits as well as non 0-day exploits being used by nation state actors.\u00a0 As a side note, among a few vendors there is a myth being spread that most all nation-state attacks utilize 0-days, which I find to be an odd statement given that we are so bad at securing our infrastructure through patch and configuration management that it is likely that an Adobe exploit from 2012 is going to be effective in most environments.\u00a0 But I digress.<\/p>\n