MODULE 20 - CERTIFICATION CYBER OPS ASSOCIATE

Question 1

Information Sources Network Intelligence Communities

To effectively protect a network, security professionals must stay informed about threats and vulnerabilities as they evolve.

There are many security organizations which provide network intelligence.

They provide resources, workshops, and conferences to help security professionals.

These organizations often have the latest information on threats and vulnerabilities.

Answer 1

Below are few important network security organizations.

– SANS

– Mitre

– FIRST

– SecurityNewsWire

– (ISC)2

– CIS

Question 2

Below are few important network security organizations.

– SANS

– Mitre

– FIRST

– SecurityNewsWire

– (ISC)2

– CIS

Answer 2

SANS Organisation SysAdmin, Audit, Network, Security (SANS) Institute resources are largely free upon request and include:

The Internet Storm Center - the popular internet early warning system NewsBites, the weekly digest of news articles about computer security.

@RISK, the weekly digest of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked Flash security alerts

Reading Room - more than 1,200 award-winning, original research papers. SANS also develops security courses.

Question 3

Below are few important network security organizations.

– SANS

– Mitre

– FIRST

– SecurityNewsWire

– (ISC)2

– CIS

Answer 3

Mitre Organisation:

The Mitre Corporation maintains a list of common vulnerabilities and exposures (CVE) used by prominent security organizations.

Question 4

Below are few important network security organizations.

– SANS

– Mitre

– FIRST

– SecurityNewsWire

– (ISC)2

– CIS

Answer 4

FIRST Organisation:

Forum of Incident Response and Security Teams (FIRST) is a security organization that brings together a variety of computer security incident response teams from government, commercial, and educational organizations to foster cooperation and coordination in information sharing, incident prevention and rapid reaction.

Question 5

Below are few important network security organizations.

– SANS

– Mitre

– FIRST

– SecurityNewsWire

– (ISC)2

– CIS

Answer 5

SecurityNewsWire Organisation :

A security news portal that aggregates the latest breaking news pertaining to alerts, exploits, and vulnerabilities.

Question 6

Below are few important network security organizations.

– SANS

– Mitre

– FIRST

– SecurityNewsWire

– (ISC)2

– CIS

Answer 6

(ISC)2 Organisation :

International Information Systems Security Certification Consortium (ISC2) provides vendor neutral education products and career services to more than 75,000+ industry professionals in more than 135 countries.

Question 7

Below are few important network security organizations.

– SANS

– Mitre

– FIRST

– SecurityNewsWire

– (ISC)2

– CIS

Answer 7

CIS Organisation :

The Center for Internet Security (CIS) is a focal point for cyber threat prevention, protection, response, and recovery for state, local, tribal, and territorial (SLTT) governments through the Multi-State Information Sharing and Analysis Center (MS-ISAC).

The MS-ISAC offers 24x7 cyber threat warnings and advisories, vulnerability identification, and mitigation and incident response.

Question 8

Network Intelligence Communities

To remain effective, a network security professional must:

Answer 8

Keep abreast of the latest threats – This includes subscribing to real-time feeds regarding threats, routinely perusing security-related websites, following security blogs and podcasts, and more.

Continue to upgrade skills – This includes attending security-related training, workshops, and conferences.

Note: Network security has a very steep learning curve and requires a commitment to continuous professional development.

Question 9

Cisco Cybersecurity Reports Resources to help security professionals stay abreast of the latest threats are the Cisco Annual Cybersecurity Report and the Mid-Year Cybersecurity Report.

These reports provide an update on the state of security preparedness, expert analysis of top vulnerabilities, factors behind the explosion of attacks using adware, spam, and more.

Answer 9

Cybersecurity analysts should subscribe to and read these reports to learn how threat actors are targeting their networks, and what can be done to mitigate these attacks.

Question 10

Security Blogs and Podcasts Another method for keeping up-to-date on the latest threats is to read blogs and listen to podcasts.

Blogs and podcasts also provide advice, research, and recommended mitigation techniques.

Answer 10

There are several security blogs and podcasts available that a cybersecurity analyst should follow to learn about the latest threats, vulnerabilities, and exploits.

Question 11

There are several security blogs and podcasts available that a cybersecurity analyst should follow to learn about the latest threats, vulnerabilities, and exploits.

Answer 11

Cisco provides blogs on security-related topics from a number of industry experts and from the Cisco Talos Group.

Search for Cisco security blogs to locate them.

You can also subscribe to receive notifications of new blogs by email.

Cisco Talos also offers a series of over 80 podcasts that can be played from the internet or downloaded to your device of choice.

Question 12

Threat Intelligence Services Cisco Talos Threat intelligence services allow the exchange of threat information such as vulnerabilities, indicators of compromise (IOC), and mitigation techniques.

This information is not only shared with personnel, but also with security systems.

As threats emerge, threat intelligence services create and distribute firewall rules and IOCs to the devices that have subscribed to the service.

https://snipboard.io/BSw0YN.jpg

Answer 12

Threat Intelligence Services Cisco Talos Threat intelligence services allow the exchange of threat information such as vulnerabilities, indicators of compromise (IOC), and mitigation techniques.

This information is not only shared with personnel, but also with security systems.

As threats emerge, threat intelligence services create and distribute firewall rules and IOCs to the devices that have subscribed to the service.

https://snipboard.io/BSw0YN.jpg

Question 13

Threat Intelligence Services Cisco Talos Threat intelligence services allow the exchange of threat information such as vulnerabilities, indicators of compromise (IOC), and mitigation techniques.

This information is not only shared with personnel, but also with security systems.

As threats emerge, threat intelligence services create and distribute firewall rules and IOCs to the devices that have subscribed to the service.

https://snipboard.io/BSw0YN.jpg

Answer 13

One such service is the Cisco Talos Threat Intelligence Group, shown in the figure.

Talos is one of the largest commercial threat intelligence teams in the world, and is comprised of world-class researchers, analysts and engineers.

The goal of Talos is to help protect enterprise users, data, and infrastructure from active adversaries.

The Talos team collects information about active, existing, and emerging threats. Talos then provides comprehensive protection against these attacks and malware to its subscribers.

Question 14

One such service is the Cisco Talos Threat Intelligence Group, shown in the figure.

Talos is one of the largest commercial threat intelligence teams in the world, and is comprised of world-class researchers, analysts and engineers.

The goal of Talos is to help protect enterprise users, data, and infrastructure from active adversaries.

The Talos team collects information about active, existing, and emerging threats. Talos then provides comprehensive protection against these attacks and malware to its subscribers.

Answer 14

Cisco Security products can use Talos threat intelligence in real time to provide fast and effective security solutions.

Cisco Talos also provides free software, services, resources, and data.

Talos maintains the security incident detection rule sets for the Snort.org, ClamAV, and SpamCop network security tools.

Question 15

FireEye FireEye is another security company that offers services to help enterprises secure their networks.

FireEye uses a three-pronged approach combining security intelligence, security expertise, and technology.

Answer 15

FireEye FireEye offers SIEM and SOAR with the Helix Security Platform, which uses behavioral analysis and advanced threat detection and is supported by the FireEye Mandiant worldwide threat intelligence network.

Helix is cloud-hosted security operations platform that combines diverse security tools and threat intelligence into a single platform.

Question 16

FireEye FireEye offers SIEM and SOAR with the Helix Security Platform, which uses behavioral analysis and advanced threat detection and is supported by the FireEye Mandiant worldwide threat intelligence network.

Helix is cloud-hosted security operations platform that combines diverse security tools and threat intelligence into a single platform.

Answer 16

The FireEye Security System blocks attacks across web and email threat vectors, and latent malware that resides on file shares.

It can block advanced malware that easily bypasses traditional signature-based defenses and compromises the majority of enterprise networks.

It addresses all stages of an attack lifecycle with a signature-less engine utilizing stateful attack analysis to detect zero-day threats.

Question 17

The FireEye Security System blocks attacks across web and email threat vectors, and latent malware that resides on file shares.

It can block advanced malware that easily bypasses traditional signature-based defenses and compromises the majority of enterprise networks.

It addresses all stages of an attack lifecycle with a signature-less engine utilizing stateful attack analysis to detect zero-day threats.

Answer 17

The FireEye Security System blocks attacks across web and email threat vectors, and latent malware that resides on file shares.

It can block advanced malware that easily bypasses traditional signature-based defenses and compromises the majority of enterprise networks.

It addresses all stages of an attack lifecycle with a signature-less engine utilizing stateful attack analysis to detect zero-day threats.

Question 18

Automated Indicator Sharing The U.S. Department of Homeland Security (DHS) offers a free service called Automated Indicator Sharing (AIS).

AIS enables the real-time exchange of cyber threat indicators (e.g., malicious IP addresses, the sender address of a phishing email, etc.) between the U.S. Federal Government and the private sector.

Answer 18

AIS creates an ecosystem where, as soon as a threat is recognized, it is immediately shared with the community to help them protect their networks from that particular threat.

Question 19

Common Vulnerabilities and Exposures (CVE) Database

The United States government sponsored the MITRE Corporation to create and maintain a catalog of known security threats called Common Vulnerabilities and Exposures (CVE).

The CVE serves as a dictionary of common names (i.e., CVE Identifiers) for publicly known cybersecurity vulnerabilities.

Answer 19

Common Vulnerabilities and Exposures (CVE) Database The MITRE Corporation defines unique CVE Identifiers for publicly known information-security vulnerabilities to make it easier to share data.

Question 20

Threat Intelligence Communication Standards

https://snipboard.io/dEroNu.jpg

Network organizations and professionals must share information to increase knowledge about threat actors and the assets they want to access.

Several intelligence sharing open standards have evolved to enable communication across multiple networking platforms.

These standards enable the exchange of cyber threat intelligence (CTI) in an automated, consistent, and machine readable format.

Answer 20

Three common threat intelligence sharing standards include the following: :

– Structured Threat Information Expression (STIX)

– Trusted Automated Exchange of Indicator Information (TAXII)

– CybOX

Question 21

Three common threat intelligence sharing standards include the following: :

– Structured Threat Information Expression (STIX)

– Trusted Automated Exchange of Indicator Information (TAXII)

– CybOX

Answer 21

Structured Threat Information Expression (STIX) :

This is a set of specifications for exchanging cyber threat information between organizations.

The Cyber Observable Expression (CybOX) standard has been incorporated into STIX.

Question 22

Three common threat intelligence sharing standards include the following: :

– Structured Threat Information Expression (STIX)

– Trusted Automated Exchange of Indicator Information (TAXII)

– CybOX

Answer 22

Trusted Automated Exchange of Indicator Information (TAXII) :

This is the specification for an application layer protocol that allows the communication of CTI over HTTPS.

TAXII is designed to support STIX.

Question 23

Three common threat intelligence sharing standards include the following: :

– Structured Threat Information Expression (STIX)

– Trusted Automated Exchange of Indicator Information (TAXII)

– CybOX

Answer 23

CybOX :

This is a set of standardized schema for specifying, capturing, characterizing, and communicating events and properties of network operations that supports many cybersecurity functions.

Question 24

Three common threat intelligence sharing standards include the following: :

– Structured Threat Information Expression (STIX)

– Trusted Automated Exchange of Indicator Information (TAXII)

– CybOX

Answer 24

The Malware Information Sharing Platform (MISP) is an open source platform for sharing indicators of compromise for newly discovered threats.

MISP is supported by the European Union and is used by over 6,000 organizations globally.

MISP enables automated sharing of IOCs between people and machines by using STIX and other export formats.

Question 25

Threat Intelligence Platforms As we have seen, there are many sources of threat intelligence information, each of which may have its own data format.

Accessing and using multiple threat intelligence sources can be very time-consuming.

To help cybersecurity personnel make the best use of threat intelligence, threat intelligence platforms (TIP) have evolved.

Answer 25

A threat intelligence platform centralizes the collection of threat data from numerous data sources and formats. There are three major types of threat intelligence data. The first is indicators of compromise (IOC).

The second is tools, techniques, and procedures (TTP). The third is reputation information about internet destinations or domains.

The volume of threat intelligence data can be overwhelming, so the threat intelligence platform is designed to aggregate the data in one place and–most importantly–present the data in a comprehensible and usable format.

Question 26

A threat intelligence platform centralizes the collection of threat data from numerous data sources and formats. There are three major types of threat intelligence data. The first is indicators of compromise (IOC).

The second is tools, techniques, and procedures (TTP). The third is reputation information about internet destinations or domains.

The volume of threat intelligence data can be overwhelming, so the threat intelligence platform is designed to aggregate the data in one place and–most importantly–present the data in a comprehensible and usable format.

Answer 26

Organizations can contribute to threat intelligence by sharing their intrusion data over the internet, typically through automation.

Many threat intelligence services use subscriber data to enhance their products and to keep current with the constantly changing immerging threat landscape.

Question 27

Organizations can contribute to threat intelligence by sharing their intrusion data over the internet, typically through automation.

Many threat intelligence services use subscriber data to enhance their products and to keep current with the constantly changing immerging threat landscape.

Answer 27

Honeypots are simulated networks or servers that are designed to attract attackers.

The attack-related information gathered from honeypots can then be shared with threat intelligence platform subscribers.

However, hosting honeypots can itself be a risk.

Basing a honeypot in the cloud isolates the honeypot from production networks.

This approach is an attractive alternative for gathering threat intelligence.