(4) Proprietary Intelligence and/Accessing Threat Intelligence

Question 1

Describe closed source intelligence

Answer 1

Closed source intelligence is where an org does their own gathering of information and research, custom tools, analysis models, or other methods to obtain information

This information may be shared as paid feeds or may be held for internal use only.

Question 2

Why use closed source intelligence instead of OSINT?

Answer 2

There are a few reasons. The org might want to keep threat data secret, they might want to license it and to keep their methods and sources as trade secrets, and they might not want threat actors to know about the data that they are gathering

Question 3

When considering threat intelligence, what standards of quality need to be assessed to determine if the information should be used?

Answer 3

-Is the information timely?

-Is the information accurate?

-Is the information relevant?

Question 4

Describe how a confidence score helps with threat intelligence data

Answer 4

A confidence score lets an organization filter and put threat intelligence data to use depending on how much it can be trusted.

Lower confidence data doesn’t mean its useless, but it shouldn’t be given too much weight either

Question 5

What are the six levels of confidence that ThreatConnect uses to grade threat intel?

Answer 5

Confirmed (90-100)

Probable (70-89)

Possible (50-69)

Doubtful (30-49)

Improbable (2-29)

Discredited (1)

Question 6

What areas of security operations can stand to benefit from Threat Intelligence Sharing?

Answer 6

-Incident Response

-Vulnerability Management

-Detection and Monitoring

-Security Engineering efforts

Question 7

What is Structured Threat Information Expression (STIX)?

Answer 7

STIX is an XML language originally sponsored by the U.S. Department of Homeland Security.

It helps share threat information through the use of objects that are related to each other by one of two STIX Relationship object models

Question 8

What is the Trusted Automated Exchange of Indicator Information (TAXII)?

Answer 8

STIX is meant to let cyber threat information be communicated at the app layer via HTTPS.

TAXII is meant to support STIX data exchange

Question 9

What is the Open Indicators of Compromise (OpenIOC) framework?

Answer 9

OpenIOC is XML based.

It uses the indicators from Mandiant for its base framework.

IOC metadata includes author, name, description, reference to investigation or case and information about the maturity of the IOC