MIST 5775 Quiz 1: Fundamental CTI Concepts

Threat

A set of circumstances that exploits vulnerabilities to cause loss or harm

Vulneribilities

A weakness in the system These can be exploited to cause loss or harm.

How to recognize them?

Also dubbed indicators of compromise (IOC) or artifacts, these technical telltales (IP addresses, hashes, etc.) provide clear information that can be used to detect and signal a malicious presence.

Control/countermeasure

An action/device/procedure/technique that eliminates or reduces a vulnerability

Who is attacking?

CTI helps defenders attribute attacks/malicious activities to certain groups (cyber criminals, hacktivists, government/national agencies, etc.)

just an automated data feed, waiting for an attack, or cleaning up a breach.

CTI is NOT:

Timely: catching threats and pending attacks as early as possible Informative: improving threat, attack, and threat actor identification to enable decision making Adaptive: customizing and tuning intel for your organization, not just buying intel feeds

CTI is:

Where do they come from?

Correlating an adversary's country of origin with its geopolitical situation can help defenders understand their enemies.

How to mitigate them?

Information about the steps a company can take to protect itself.

CTI Lifecycle

Intelligence Strategy -> Intelligence Aggregation -> Threat Analytics -> Operational Intelligence

Adversary based Risk Focused Process oriented Tailored for diverse consumers

Key characteristics of CTI

Why are they doing it?

Knowing who is behind an attack helps defenders understand their adversary's motivations, how much effort they would put into an attack (advanced persistent threat [APT] vs opportunistic attacks), and how business/industry-specific such attacks could be.

How are they proceeding?

The so-called tactics, techniques, and procedures (TTPs) give insight about the way adversaries typically proceed, the tools and infrastructures they use, and more.

Intelligence Strategy

Threat trending •Asset Identification •Indicators of Compromise •Threat Modeling •Intelligence Buy-in

Confidentiality, Integirty, Avaliability

What do we mean by "protect?"

To protect cyber infastructure

What is the main goal of cybersecurity

What are they after?

With this information defenders can prioritize their actions based on the importance of the asset or assets the attackers are targeting.

Distributed Denial of Service (DDoS)

a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. Denial of service is typically accomplished by flooding the targeted machine or resource with superfluous requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled.

Decryption

a process that decodes a message or file so that it can be read by the right people

Encryption

a process that encodes a message or file so that it can be only be read by certain people

Advanced Persistent Threat (APT)

a stealthy threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an

NIST Framework

consists of standards, guidelines and best practices to manage cybersecurity risk

Proper identity and access management

enables the right individuals to access the right resources at the right times and for the right reasons

Cyber Threat Intelligence

knowledge about adversaries and their motivations, intentions, and methods that is collected, analyzed and disseminated in ways that help security and business staff at all levels protect the critical assets of the enterprise

Ransomware

malicious software that infects your computer and displays messages demanding a fee to be paid in order for your system to work again

Threat

often utilize the word _____ to refer to a risk.

Integrity

the ability of a cyber infrastructure to ensure that assets are modifiable only by authorized parties.

Avaliability

the ability of a cyber infrastructure to ensure that assets are usable by and accessible to all authorized parties.

Confidentiality

the ability of a cyber infrastructure to ensure that assets are viewable only by authorized parties.

NICE Framework

the blueprint to categorize, organize, and describe cybersecurity work

Phishing/spoofing

the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.

Social Engineering

the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes.

Structure of CTI Lifecycle

• Focus on understanding the organization first, then collecting relevant data, analyzing, using and disseminating intelligence.

Operational Intelligence

•Actionable intelligence •Course of action •Proactive defense •Intelligence dissemination

Threat Analytics

•Cyber kill chain •Hacker profiling & tracking •Fundamental analytics •Visualization

Intelligence Aggregation

•Intelligence Sources •Internal Intelligence •Open Source Intelligence