Section 22.210 Threat Intelligence Feeds

Question 1

Threat Intelligence

Answer 1

Continual process used to understand the threats faced by an organisation

■ It focuses on analyzing evidence-based knowledge about existing or emerging hazards to an organization’s assets

■ Combines data from multiple sources to provide context, mechanisms, indicators, implications, and actionable information about threats

Question 2

Threat Intelligence Feeds

Answer 2

Provide valuable information about potential or current threats to an organization’s security

■ Continuous streams of data related to potential or current threats

■ Collected, analysed, and disseminated by security researchers, organizations, or automated tools

■ Provide real-time or near-real-time updates on aspects such as:
● Malware signatures
● Indicators of Compromise (IoC)
● Malicious IP addresses
● URLs

FIREEYE - a subscription service that allows you to stay up to date with latest attacks and vulnerabililties

Question 3

Evolution of Threats

Answer 3

Threat actors adapt their attack methods as technology changes

■ In the past, server-side attacks were common due to open ports and protocols on servers

■ With better server protection, threat actors shifted to client-side attacks,
targeting vulnerabilities in client applications

■ Enterprise networks implement Network Access Control (NAC) to secure clients

■ The mobile environment and cloud technology have also become targets for attacks

Question 4

Sources of Threat Intelligence

Open-Source Intelligence (OSINT)

Answer 4

Collected from publicly available sources like reports, forums, news articles, blogs, and social media

● Often available at no cost

● Valuable for insights into emerging threats and vulnerabilities

● Examples include feeds from AlienVault Open Threat Exchange, SANS Internet Storm Center, and security research forums

Question 5

Proprietary or Third-Party Feeds

Answer 5

Provided by commercial vendors under a subscription model

● Offer more refined, analyzed, and timely information

● Integratable into security tools for automated threat response

● Companies like FireEye, McAfee, and Symantec provide proprietary feeds

Question 6

Information-Sharing Organizations

Answer 6

Formed to facilitate the sharing of threat intelligence among members

● Includes Information Sharing and Analysis Centers and Information
Sharing and Analysis Organizations

● Collaboration among businesses in specific industries (e.g., finance,
healthcare) to share industry-specific threat information

Question 7

Dark Web

Answer 7

A hidden part of the internet inaccessible through standard browsers

● Can be a source of threat intelligence for security researchers

● Explored for information about hacking techniques, stolen data, and
emerging threats

● Provides insights ahead of public knowledge