https://retiari.us/categories/intelligence/ Recent content in Intelligence on Alex Maestretti Hugo -- gohugo.io en-us Sat, 22 Sep 2018 16:59:48 +0000 https://retiari.us/posts/ti_for_vuln_mgmt/ Sat, 22 Sep 2018 16:59:48 +0000 https://retiari.us/posts/ti_for_vuln_mgmt/ Effective patch management remains as much a challenge today as it was a decade ago. The missing foundational piece is asset inventory - I would argue the biggest security gap most organizations have. Even assuming good inventory challenges remain for Threat Intelligence (TI) to identify new vulnerabilities in the supply chain - to include vendor products, open source libraries, software tool-chains, etc. There are frequent race conditions between what is known and the emerging unknown. Rapidly identifying those emerging unknowns - eg. zero days - is a key part of a threat intelligence program. Currently the one-stop-shop for vulnerability information is MITRE’s Common Vulnerabilities and Exposures (CVE) program. There are a number of smart dedicated people working on this tough problem space, but still the program has significant shortcomings as called out recently by the US House Energy and Commerce committee. Among the issues are that they provide at once too much information on inconsequential vulnerabilities causing fatigue, and too little information on those you do care about. This is compounded with a lack of structure or consistency to the reported information that is available. Perhaps most concerning is the significant delays between discovery and CVE release. For the most impactful vulnerabilities, those that provide remote execution and are ‘worm-able’ (allow for self propagation or mass scanning), the announcement of the vulnerability kicks off a race between defenders seeking to identify and remediate their systems, and attackers trying to weaponize the vulnerability then discover and exploit vulnerable systems. https://retiari.us/posts/attribution_and_threat_models/ Thu, 20 Sep 2018 16:58:39 +0000 https://retiari.us/posts/attribution_and_threat_models/ Thank you for joining us on article two of our series about the Future of Threat Intelligence at Netflix. Early in my career I liked to imagine myself locked in a battle of wits with a Karla of somesort. The reality is less literary archrival and more diverse set of ne’er-do-wells, but equally challenging. Absent a specific villian, what is the role of attribution in a corporate threat intelligence program? As with most things it turns on business value delivered - if knowing the name of the person targeting your systems helps reduce risk for your organization then discovering that information should be a goal of your intelligence program; however, this is seldom relevant to business risk reduction outside the rare cases where one might cooperate with law enforcement to target a particularly problematic fraud actor, or, as we will discuss later, in the world of physical and information security convergence. While law enforcement needs individual attribution, most often corporate security programs can work at a coarser granularity without losing impact. The goal is to better understand the intent and capabilities that comprise a threat. Attribution is valuable during an incident inasmuch as it provides leads on how to scope the intrusion or detect the attacker. https://retiari.us/posts/future_of_iocs/ Thu, 13 Sep 2018 16:56:00 +0000 https://retiari.us/posts/future_of_iocs/ Thank you for joining us for our series on Threat Intelligence. This is the first of our content posts, linked from our introductory post. The one constant in the information threat landscape is that it is always changing. Yet too often, when the term ‘threat intelligence’ is used, it is in reference to static Indicators Of Compromise (IOCs). Are these traditional indicators still relevant or useful today? How about in the near future? Most importantly, how adept is your Threat Intelligence (TI) program at dealing with these constant shifts in landscape? Can your current TI detect a black swan event, or a black swan hatching? IOCs or “Oh, I see” While there is still a great deal of commodity malware that can be found using file hashes, DNS names and IP addresses, many modern attacker techniques render these indicators unusable. For example, malware can be repacked thus changing the resulting hash, IP addresses are largely communal and interchangeable in today’s virtual hosting environments, and otherwise legitimate domains can be hijacked (or in the case of sites with user generated content, simply repurposed) to serve as malicious command and control infrastructure. A common shortcoming in TI programs is an outsized focus on malware. https://retiari.us/posts/future_of_intelligence/ Wed, 12 Sep 2018 16:54:43 +0000 https://retiari.us/posts/future_of_intelligence/ UPDATE: I am pleased to announce that Chris Cochran has joined the team to lead our intelligence program. He will be posting the rest of the articles in this series and I will link over to his work from here! I have been chatting with Mary Landesman, our intelligence lead, about how best to derrive business value from threat intelligence in Netflix’s unique culture and modern technology stack. Threat intelligence can be a slippery concept. While we have seen it work well, we have also seen it struggle to keep up with changing technologies and observed uneven return on investment across industries and organizations. We came up with a bunch of questions and a few promising theories. I will share those in a series of posts in the hope of drawing out debate and new ideas. Mary is looking towards retirement! So we are looking for the next generation intelligence leader to continue our momentum for Netflix, and the broader community. If that sounds interesting please get in touch: amaestretti@netflix.com Thanks to Mary for the insights and rewrites. Some of the topics (I will add links as they post): The evolution of IOCs Attribution Intelligence for Vulnerability Management