Cyber Threat Intelligence - Martin Lee

. .

Résumé :

Preface xi

About the Author xiii

Abbreviations xv

Endorsements for Martin Lee's Book xix

1 Introduction 1

1.1 Definitions 1

1.1.1 Intelligence 2

1.1.2 Cyber Threat 3

1.1.3 Cyber Threat Intelligence 4

1.2 History of Threat Intelligence 5

1.2.1 Antiquity 5

1.2.2 Ancient Rome 7

1.2.3 Medieval and Renaissance Age 8

1.2.4 Industrial Age 10

1.2.5 World War I 11

1.2.6 World War II 13

1.2.7 Post War Intelligence 14

1.2.8 Cyber Threat Intelligence 15

1.2.9 Emergence of Private Sector Intelligence Sharing 19

1.3 Utility of Threat Intelligence 21

1.3.1 Developing Cyber Threat Intelligence 23

Summary 24

References 24

2 Threat Environment 31

2.1 Threat 31

2.1.1 Threat Classification 33

2.2 Risk and Vulnerability 35

2.2.1 Human Vulnerabilities 38

2.2.1.1 Example - Business Email Compromise 39

2.2.2 Configuration Vulnerabilities 39

2.2.2.1 Example - Misconfiguration of Cloud Storage 40

2.2.3 Software Vulnerabilities 41

2.2.3.1 Example - Log4j Vulnerabilities 43

2.3 Threat Actors 43

2.3.1 Example - Operation Payback 46

2.3.2 Example - Stuxnet 47

2.3.3 Tracking Threat Actors 47

2.4 TTPs - Tactics, Techniques, and Procedures 49

2.5 Victimology 53

2.5.1 Diamond Model 55

2.6 Threat Landscape 56

2.6.1 Example - Ransomware 57

2.7 Attack Vectors, Vulnerabilities, and Exploits 58

2.7.1 Email Attack Vectors 59

2.7.2 Web-Based Attacks 60

2.7.3 Network Service Attacks 61

2.7.4 Supply Chain Attacks 61

2.8 The Kill Chain 62

2.9 Untargeted versus Targeted Attacks 64

2.10 Persistence 65

2.11 Thinking Like a Threat Actor 66

Summary 66

References 67

3 Applying Intelligence 75

3.1 Planning Intelligence Gathering 75

3.1.1 The Intelligence Programme 77

3.1.2 Principles of Intelligence 78

3.1.3 Intelligence Metrics 81

3.2 The Intelligence Cycle 82

3.2.1 Planning, Requirements, and Direction 83

3.2.2 Collection 84

3.2.3 Analysis and Processing 84

3.2.4 Production 85

3.2.5 Dissemination 85

3.2.6 Review 85

3.3 Situational Awareness 86

3.3.1 Example - 2013 Target Breach 88

3.4 Goal Oriented Security and Threat Modelling 89

3.5 Strategic, Operational, and Tactical Intelligence 91

3.5.1 Strategic Intelligence 91

3.5.1.1 Example - Lazarus Group 92

3.5.2 Operational Intelligence 93

3.5.2.1 Example - SamSam 93

3.5.3 Tactical Intelligence 94

3.5.3.1 Example - WannaCry 94

3.5.4 Sources of Intelligence Reports 94

3.5.4.1 Example - Shamoon 95

3.6 Incident Preparedness and Response 96

3.6.1 Preparation and Practice 99

Summary 100

References 100

4 Collecting Intelligence 105

4.1 Hierarchy of Evidence 105

4.1.1 Example - Smoking Tobacco Risk 107

4.2 Understanding Intelligence 108

4.2.1 Expressing Credibility 109

4.2.2 Expressing Confidence 110

4.2.3 Understanding Errors 114

4.2.3.1 Example - the WannaCry Email 114

4.2.3.2 Example - the Olympic Destroyer False Flags 114

4.3 Third Party Intelligence Reports 115

4.3.1 Tactical and Operational Reports 116

4.3.1.1 Example - Heartbleed 117

4.3.2 Strategic Threat Reports 118

4.4 Internal Incident Reports 118

4.5 Root Cause Analysis 119

4.6 Active Intelligence Gathering 120

4.6.1 Example - the Nightingale Floor 122

4.6.2 Example - the Ma...

Biographie:
.

Sommaire:
..