Lesson 2 Threat Actors and Threat Intel

Question 1

Vulnerability

Answer 1

A weakness in a system that can be exploited

Question 2

Threat

Answer 2

actors willing to exploit a vulnerability

Question 3

risk

Answer 3

impact and likelihood of vulnerability being exploited by a threat

Question 4

attributes of threat actors

Answer 4

known threat vs adversary behaviors
can be internal not just external to local network
intentions can be malicious, opportunistic, accidental, or unintentional
levels of sophistication depends on resources, funding, capability levels

Question 5

Type of hackers

Answer 5

Lone hacker - white vs black hats vs grey hats
Scipt kiddies - unprofessional, just using scripts, etc, not sophisticated
Hacktivists - usually politically or socially motivated to make a statement

Question 6

State Actors

Answer 6

State backed, military/secret, and highly sophisticated
Advanced Persistent Threat (APT) - ability to access and stay connected to a network without authorization
Done for espionage and strategic advantage
deniability - able to cover tracks during attack
False flag operations - diversions, other minor attacks or overwhelm a system to cover real operations

Question 7

Criminal Syndicates

Answer 7

Operate across legal jurisdictions
Threat Actors out to make money/profit
Well funded and resourced

Question 8

Competitors

Answer 8

Cyber espionage to gain advantage over
Gain financial info on competitors
Can combine with insider threat

Question 9

Insider Threat

Answer 9

Malicious

• has or had authorized access
• employees, contractors, partners
• motivated by sabotage, financial gain, business advantage

Unintentional

• weak policies and procedures
• weak adherence to policies and procedures
• lack of training/security awareness
• shadow IT

Question 10

attack surface

Answer 10

points where an attacker can discover/exploit vulnerabilities to access a network or application

Question 11

attack vectors

Answer 11

parts of a system which can be exploited to gain access to a network
direct access
removable media
email
remote and wireless
supply chain
web and social media
cloud

Question 12

Threat research sources

Answer 12

Counter intelligence
Threats, Techniques, and Procedures (TTP)
Threat Research Sources

Question 13

Threat Intelligence Providers

Answer 13

narrative analysis and commentary
Reputation/threat data feeds - cyber threat intelligence (CTI)
Platforms and feeds
-closed/proprietary
-vendor websites
-public/private information sharing centers
-open source intelligence (OSINT) threat data sources
OSINT as reconnaissance and monitoring

Question 14

TTP

Answer 14

Tactics, Techniques and Procedures are a generalized statement of adversary behavior (of known attacks)

tactics - campaign strategy and approach

techniques - generalized attack vectors

procedures - specific intrusion tools and methods

Question 15

Threat Data feeds

Answer 15

STIX - structured threat info exchange - uses xml for description of attack
TAXII - transport method using STIX
AIS - Automated Indicator of Sharing
Threat maps
file/code repos
Vulnerability DBs and feeds

Question 16

Artificial Intelligence and Info Security

Answer 16

Used to correlate security intelligence and security event monitoring with threat data from threat feeds, databases, etc
Are expert Systems
Use Artificial Neural Networks (ANN)
- inputs, outputs and feedback
- objectives and error states

Question 17

Predictive Analysis of threats

Answer 17

Used to correlate security intelligence and security event monitoring with threat data from threat feeds, databases, etc
Predictive Analysis
- threat forecasting
- monitors ‘chatter’ on social media sites

Question 18

ISAC

Answer 18

Information and Sharing Center

• Entities which share intelligence data about threats and attacks
• good for critical infrastructure providers

Question 19

OSINT

Answer 19

Open Source Intelligence

• harvesting cybersecurity information from public websites and data records
• for threat intel, refers to research and data feeds which are publicly available

Question 20

AIS

Answer 20

Automated Indicator Sharing (AIS)

• service offered by the Department of Homeland Security (DHS) for participating in threat intelligence sharing
• uses the Trusted Automated eXchange of Indicator Information (TAXII) protocol as a means of transmitting CTI data between servers and clients.

Question 21

MITRE ATT&CK

Answer 21

A global knowledge DB documenting real-world adversary tactics and techniques
good source of OSINT

Question 22

OWASP

Answer 22

Open Web Application Security Project