-: Intelligence sources.
This is important because we have to consider
the sources of our intelligence.
Now there are lots of different sources to our intelligence
that we can get out there, but not all are created equal.
And so we have to be able to identify some factors
to weigh the value of the intelligence that we're getting.
Now, there are several factors that we can use.
There is timeliness, relevancy, accuracy,
and confidence level.
When we talk about timeliness,
this is the property of an intelligence source
that ensures that it is up-to-date
because over time,
the information is not nearly as valuable.
If I know that somebody
has been attacking your network today,
and I don't tell you about it for three years,
it's not going to be very useful to you.
It'd be a lot more useful if I told you today.
And so that's the idea with timeliness,
because once an adversary understands
they've been identified, they're going to change tactics
and they're going to change the way they do things.
And that means your report that you wrote today
may not be valid in a week, three weeks, three months,
or three years from now because things change
and so timeliness is important.
Our second factor is relevancy.
Now this is the property of an intelligence source
that ensures it matches the use case it was intended for.
Let's go back to my example
of working for a large auto manufacturer.
If I start seeing that there's a lot of attacks
going against the Mac OSX operating system,
does that really apply to me
as somebody who is running a car company
and is using Windows machines,
or is using Linux in my embedded systems?
Probably not.
And so it's not nearly relevant to me
for the use case I have.
And so you need to consider that
as you're looking at all the different information out there
because it can be overwhelming,
and you have to think what affects me and my organization
so I can defend against it.
The third area is accuracy.
Now accuracy is the property of an intelligence source
that ensures that it produces effective results.
Now this means that the information
needs to be valid and true.
If you tell me that I've been attacked
and I look, and I can't find anything,
well, was I really attacked, or was your information bad?
We really don't know.
And so it's really important
to make sure the information we're getting is accurate.
This means we want to try to eliminate
as many false positives as possible,
especially when using automated software,
and machine learning, and artificial intelligence,
and make sure that we're getting the right information
so that we can do our analysis properly on good information
and create good decisions.
The fourth and final factor we have to consider
is confidence levels.
Now, this is the property of an intelligence source
that ensures it produces qualified statements
about reliability.
When an analyst publishes a report,
they don't have 100% of the facts,
it's just the way this works.
We are trying to guess our way through this,
and we're getting lots of different pieces of information
and lots of different indicators,
and we try to put together the best report we can.
Well, when we deal with this
and we start taking all these sources,
we have to look at these sources
and figure out, are they reliable, are they accurate,
are they relevant, and are they timely?
And when we start talking about confidence level,
we are going to actually put a grade on it
of how good we think that information is.
For example, the MISP Project codifies the use
of the admiralty scale for grading data
and estimative language.
Now you can choose any scale you want
but the admiralty scale is one of the more common ones.
The way this works is that it breaks it down into two areas.
It evaluates you based on source reliability
and information content.
If I look at the source reliability,
this is going to get a letter grade from A through F.
It tells you if it's reliable
all the way down to I can't judge the reliability.
For example, if I got this piece of data
from my own sensors and I trust them,
then there's no doubt, this is reliable
give it a grade of A.
Next we have the information content,
and when we grade this, we do it on a scale of 1 to 6.
Now, when we grade this from 1 to 6
we're going to say that this could be confirmed
or it cannot be judged.
When I confirm it,
this means that I had multiple independent sources
that told me this information,
it's not just hearsay from one person.
Now, as I go down the scale, I get less and less stringent
on how well I can confirm that information,
all the way down to cannot be judged
which means it's basically just a best guess.
Now this is useful,
especially when reporting up to higher authorities
or up to your bosses,
because you can say, "Hey, I have this information,
I heard there's this threat
but I'm not real confident about it,
it only has a grade letter of C."
And you can take less actions against that maybe
than something that has a strength of A
because A is much more certain.
And this is the idea when you deal with the admiralty scale.
For the exam, you do not need to know
the admiralty scale in depth,
but it is something I wanted to make you aware of
because you may see it out in the workplace.
Now, the next thing we need to talk about
is the three places you can get information from.
You can find information that's proprietary,
closed-sourced, or open-source.
The first source we have is what's known as proprietary.
Proprietary is threat intelligence
that comes as a commercial service offering,
where you're going to pay for access
to these updates and research based on a subscription fee.
Now, some of these commercial services
are really just repackaging information that's available
in free public registries,
without providing any of their own data inside of it.
And these aren't nearly as useful.
This brings us to the second type,
which is closed-source data.
Now closed-source data is data that's derived
from the provider's own research and analysis efforts,
such as data from honeynets as they operate,
plus information that's mined
from their other customer systems and suitably anonymized.
So for example if you, and 100,000 other people
all subscribed to a certain service,
and they're monitoring your networks,
they can collect all that data from the 100,000 users
and then be able to make analysis and reports
based off of that in an anonymized fashion
back to those 100,000 users
so you all can share the information.
Now, a good example of this is FireEye.
FireEye is a proprietary information source
that is closed-source.
They provide their own data, and you can subscribe
using their threat intelligence subscription service
to get data and updates from them.
Now, the third type we have is what's known as open-source.
Open-source is data that's available for use
without a subscription, and this may include threat feeds
similar to commercial providers,
and it can contain reputation lists,
and malware signature databases too.
There are a lot of great sources
of open-source intelligence out there.
And so if your organization is a little weary
about spending a lot of money
on commercial sourced information,
they can start out with open-source information
and then upgrade from there later on.
Now, when you talk about open-source intelligence
there are lots of different sources.
First, we have the US-CERT,
which is the United States
Computer Emergency Readiness Team.
This provides you with feeds of current activity
and alert news, plus regular bulletins and analysis reports.
They also have a bi-directional threat feed
called the automated indicator service that you can use.
The next one we have
is the UK's National Cyber Security Center
which provides similar services to the US-CERT.
There are some other ones out there as well, though.
We have AT&T Security, which was actually alien vault
open threat exchange previously,
but it was bought out by AT&T.
After that we have MISP, which we talked about before.
This is the malware information sharing project.
And again, it's an open-source intelligence feed
that you can use.
We also have VirusTotal, which is a great place
to upload any file you're not sure of.
If you upload this file,
it will check across 40 to 50 different antivirus products
to see if any of them know if it's a virus or not,
and it's a public repository for malware.
Another one we have is Spamhaus
which is very focused on spam and email.
And finally, we have SANS ISC Suspicious Domains,
which, as the name implies,
is focused on providing a feed of suspicious domains
that they think might be malicious.
Now all of these feeds are really great,
and they provide you with what's known
as explicit knowledge,
which is knowledge you can write down, see, feel, and touch.
But there's another great source of knowledge out there too,
and it's known as implicit knowledge.
Implicit knowledge is really useful,
but you can only get it
from experienced practitioners in the field.
This is kind of that sense that they have
that they just go, "Ah, I know something is wrong here
because of my 20 years of experience."
Now they may not always have
the latest trends in cybersecurity,
although most of the time they do,
but they also have the ability
to give you that attitude and instinct
because of their career as a cybersecurity professional.
Over time, you're going to develop this
as you become a senior cybersecurity analyst
where you just know this is wrong
because you've seen it 100 times before,
and you start getting this feeling
of what is going to come next based on your experience.
And that is something that we call implicit knowledge
because you can't write it down,
you can't codify it in a procedure,
it's just something you know
based on your years of experience.
Now, the last thing I want to mention here
is what's known as OSINT.
Now open source intelligence or OSINT
is a very popular thing these days.
This is a method of obtaining information
about a person or organization
through public records, websites, and social media.
As you go out and you look at your organization
from the outside looking in,
anything people can find out about you
on Google, on Facebook, by doing enumeration scans,
that is all considered OSINT.
It's ways for you to get information
from public records, websites, and social media.