{"id":25,"date":"2023-01-12T22:38:59","date_gmt":"2023-01-12T22:38:59","guid":{"rendered":"https:\/\/justatrainingblog-co-uk.preview-domain.com\/?p=25"},"modified":"2023-08-02T20:44:48","modified_gmt":"2023-08-02T20:44:48","slug":"threat-intelligence-sources","status":"publish","type":"post","link":"https:\/\/justatrainingblog.co.uk\/?p=25","title":{"rendered":"Threat Intelligence Sources"},"content":{"rendered":"\n

Notes from Security 601+ – Module 1.5<\/p>\n\n\n\n

<\/p>\n\n\n\n

threat intelligence is an essential tool for cyber security practitioners. While it’s all well and to have a system in place to react to threats additional work needs to be done to proactively prepare for threats BEFORE it happens. <\/p>\n\n\n\n

The issue is, how can a single researcher or even a whole department hope to keep up with the myriad number of bad actors out there all intent on breaching their systems?<\/p>\n\n\n\n

The answer of course is Threat Intelligence Source.<\/p>\n\n\n\n

Threat Intelligence Sources allows Security Practitioners to build adaptive security measures which protect against threats.<\/p>\n\n\n\n

\"\"
Source: evaluating-threat-intelligence-sources-whitepaper.pdf (kaspersky-labs.com)<\/a><\/figcaption><\/figure>\n\n\n\n

According to the Comptia Security+ syllabus the essential sources to review are Open Source Intelligence (OSINT), Closed or Propietary Intelligence and Vulnerability Databases. I will however be expanding on a few other options which are not covered as they seem valuable sources which shouldn’t be overlooked. <\/p>\n\n\n\n

<\/p>\n\n\n\n

Open Source Intelligence (OSINT)<\/span><\/p>\n\n\n\n

Open Source Intelligence (aka. OSINT) is a type of intelligence which is open to all. It is publicly available information which while useful to practitioners is also available to malicious actors to exploit. <\/p>\n\n\n\n

The three key main sources of OSINT are the open internet, governmental data and open source commercial data<\/p>\n\n\n\n

CSSonline<\/a> state that open source intelligence activities an organisation should be as follows:<\/p>\n\n\n\n

    \n
  1. Discovering Public Facing Assets –<\/strong> This relates to IT discovering and manging public facing assets to ensure that information isn’t provided which can assist bad actors.<\/li>\n\n\n\n
  2. Discovering relevent information from outside the organisation –<\/strong> Keeping tabs on data sources such as Social Media, forum posts and the like to ensure there isn’t anything in the public domain that can provide entry.<\/li>\n\n\n\n
  3. Collate discovered information into actionable form – <\/strong> This usually uses OSINT tools to format data in a way which is easily actionable<\/li>\n<\/ol>\n\n\n\n

    There are a vast variety of OSINT tools which can help greatly. Many of them have specialisations in specific areas which equal to a formidable package if combined. <\/p>\n\n\n\n

    With regards to point two above, this is the obvious definition which comes to mind when performing threat intelligence research. The common places reviewed for information is: <\/p>\n\n\n\n

      \n
    1. Vendor Websites<\/li>\n\n\n\n
    2. Vulnerability Feeds < — Definition page to Add<\/li>\n\n\n\n
    3. Conferences<\/li>\n\n\n\n
    4. Academic Journals<\/li>\n\n\n\n
    5. Requests for comment (RFC) <- Definition page to add<\/li>\n\n\n\n
    6. Local Industry Groups<\/li>\n\n\n\n
    7. Social Media<\/li>\n\n\n\n
    8. Threat Feeds<\/li>\n<\/ol>\n\n\n\n

      Closed & proprietary Intelligence<\/span><\/p>\n\n\n\n

      While OSINT is free for all if you know where to look, closed and proprietary data is data collected by private organisations and provided for a fee. While this may seem like a downside it’s got it’s own up and downsides compared to OSINT. <\/p>\n\n\n\n

      The upsides of this intelligence type is:<\/p>\n\n\n\n

        \n
      1. It’s convenient. Organisations don’t have to expend resources or maintain and update their gathering methods to stay up to date with current intelligence. <\/li>\n\n\n\n
      2. It’s constantly updated. The companies providing this information have the teams, the resources and the tools to keep data constantly up to date and available.<\/li>\n\n\n\n
      3. Many companies provide methods for their data to be integrated into automated solutions. <\/li>\n<\/ol>\n\n\n\n

        The downside, of course as expected is that there is a cost premium to these upsides for the organisation. <\/p>\n\n\n\n

        <\/p>\n\n\n\n

        Vulnerability Database<\/span><\/p>\n\n\n\n

        Vulnerability databases are <\/span>resources, often government provided which provide massive sources of data on threats, vulnerabilities and current intelligence. These are often maintained by security professionals and are a valuable resource for any organisation. <\/p>\n\n\n\n

        Some of the most well known vulnerability databases are: <\/p>\n\n\n\n

          \n
        1. CVE (Common Vulnerabilityies and Exposures)<\/li>\n\n\n\n
        2. US national vulnerability dastabase<\/li>\n<\/ol>\n\n\n\n

          Sharing Vulnerabilities<\/span><\/p>\n\n\n\n

          Say you discover a vulnerability, previous reference can’t be found anywhere, what should you do?<\/p>\n\n\n\n

          Convention states that it should be submitted for addition to vulnerability databases to make others aware of the issue. This may be a vulnerability in your own software or one found in a piece of software you’re using. <\/p>\n\n\n\n

          Most people will share these vulnerabilities in either a Public Threat Database, a Private Threat Database or the Cyber Threat Alliance (CTA). The accepted format for sharing these vulnerabilities is AIS (Automated Indicator Sharing) and includes descriptions, motivations, abilities, capabilities and response management. <\/p>\n\n\n\n

          Finally AIS data is shared using the Trusted Automated Exchange of Indicator Information (TAXII)<\/p>\n\n\n\n

          <\/p>\n\n\n\n

          So what other areas can information be gathered from?<\/span><\/p>\n\n\n\n

          So now we’ve covered the main methods it’s time to briefly review the other places threat information can be gathered.<\/p>\n\n\n\n

            \n
          1. The Dark Web – part of OSINT this is part of the dark web and adds a layer of complexity to information gathering due to the anonomous nature of it. It is however useful for finding if there has been a breach or to find evidence of successful attacks. <\/li>\n\n\n\n
          2. File \/ Code Repositories – Github is a heaven in that a large chunk of open source code is published here. Researchers have found they can often monitor and as such pre-empt upcoming hacks are being created by attackers. <\/li>\n\n\n\n
          3. Local Industry Groups – This is a collection of researchers from the same industry which gathers to discuss and share information on threats which can be actioned at each respective company. <\/li>\n<\/ol>\n\n\n\n

            <\/p>\n","protected":false},"excerpt":{"rendered":"

            Notes from Security 601+ – Module 1.5 threat intelligence is an essential tool for cyber security practitioners. While it’s all…<\/p>\n","protected":false},"author":1,"featured_media":26,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[5,2,11,4,1],"tags":[],"class_list":["post-25","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cysa","category-learning","category-osint","category-security","category-uncategorized"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/25","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=25"}],"version-history":[{"count":3,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/25\/revisions"}],"predecessor-version":[{"id":30,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/25\/revisions\/30"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/media\/26"}],"wp:attachment":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}