Threat Intelligence and Sources

Question 1

Timeliness

Answer 1

Property of an intelligence source that ensures it is up-to-date

Question 2

Relevancy

Answer 2

Property of an intelligence source that ensures it matches the use cases intended for it.

Question 3

Accuracy

Answer 3

property of an intelligence source that ensures it produces effective results

Question 4

Confidence Levels

Answer 4

Property of an intelligence source that ensures it produces qualified statements about reliability.

Question 5

Proprietary

Answer 5

Threat Intelligence is very widely provided as a commercial service offering, where access to updates and research is subject to a subscription fee.

Question 6

Closed-Source

Answer 6

Date that is derived from the provider’s own research and analysis efforts, such as data from honeynets that they operate, plus information mined from its customers systems, suitably anonymized

Question 7

Open-Source

Answer 7

Data that is available to use without subscription, which may include threat feeds similar to the commercial providers and may contain reputation lists and malware signature databases.

1. US-CERT
2. UK’s NCSC
3. AT&T Security (OTX)
4. MISP
5. VirusTotal.
6. Spamhaus
7. SANS ISC Suspicious Domains

Question 8

Open-Source Intelligence (OSINT)

Answer 8

Methods of obtaining information about a person or organization through public records, websites, and social media.

Question 9

Threat Hunting

Answer 9

A cyber security technique designed to detect presence of threat that have not been discovered by a normal security monitoring. Threat Hunting has less impact than a penetration test.

Question 10

Establishing a Hypothesis

Answer 10

A hypothesis is derived from the threat modeling and is based on potential events with higher likelihood and higher impact

Question 11

Profiling Threat Actors and Activities

Answer 11

Involves the creation of scenario that show how a prospective attacker might attempt an intrusion and what their objectives might be.

Question 12

Threat hunting relies on the usage of the tools developed for regular security monitor and incident reponse

Answer 12

• Analyze network traffic
• Analyze the executable process list.
• Analyze other infected host.
• identify how the malicious process was executed

Question 13

Threat Hunting consumes a lot of resources and time to conduct, but can yield a lot of benefits

Answer 13

• improve detection capabilities.
• integrate intelligence.
• reduces attack surface.
• Block attack vectors.
• identify critical assets.