Training Deck - Recorded Future University Flashcards
What are the three Pillars of Security?
Confidentiality
Integrity
Availability
What is the “Triad” also called? Short version?
CIA Triad
What is the projected Value of Cyber Security in 2030?
over 500 Billion $ oder 500 Milliarden Euro
What does TTP stand for?
Tactics, Techniques and Procedures
What is Tactics
The overall objective of an attacker
What is Technique
A method used by an attacker
What is Procedure?
The Features and the Tools and Methods used by an attacker
What are iOc’s
Indicators of Compromise
What does NIST stand for?
The National Institute of Standards and Technology
What are the six deterring factors the NIST says defines Security?
Deterrence
Avoidance
Prevention
Detection
Recovery
Correction.
Wie wird Intelligence von Recorded Future definiert
data and information collected and analyzed to assist decision-makers.
What is Threat Intelligence?
Threat Intelligence is the knowlage that allows you to prevent or defend yourself against attacks
What are the two factors that define Threat Intelligence?
Threat Intelligence is all about understanding the bad guys—the hackers, malware, and techniques they use to attack. It looks at external threats that could harm your organization.
What is Security Intelligence?
Security Intelligence is broader. It looks at everything related to protecting your company—both from inside and outside. It combines data from your internal systems (like logs, firewalls, and alerts) with external information to give a full picture of your security posture.
What is Information Security?
The Protection of Information
What is Cyber Security?
Cybersecurity refers to the practices, measures, and controls designed to ensure the confidentiality, integrity, and availability (CIA) of data and systems in the digital realm.
It focuses exclusively on protecting digital assets, such as networks, applications, and data in cyberspace
What is the difference between Information Security and Cyber Security?
Information = Security of files in all forms - Digital and also hand written
Cyber Security = Security of digital information
What does APT mean
Advanced Persistant Threats
What does FAIR stand for
Factor Analysis of Information Risk
What is the FAIR Institute
The FAIR Institute is a research-driven not-for-profit organization dedicated to advancing the discipline of cyber and operational risk management through education, standards and collaboration.
What is the RISK formula
Vulnerability + Threat = RISK (Likelihood & Impact)
Give me three excamples for an IOC
Virus signatures
IP addresses
Hashes of malware files
URLs
Domain names of botnet command and control servers
What is Data?
Hashes, IP address etc. Data usually doesnt tell you much and needs to be investigated furtherW
What is Information?
Information is Data with Context!
What is the main difference between Data and Information?
The main difference between Data and Information is Context
What is Intelligence?
Intelligence is the outcome of the Analysis of Data and Information - It is actionable
What does SOAR stand for?
Security, Orchestration, Automation, and Response
What are the four Stages of Intelligence Process
Work together, collaborate
360 Degree visibility
Automatisation and Integration
Alignment with the Organization and Security Use Cases
What is Operational Intelligence
Its the “hands on” Intelligence
What is Strategic Intelligence
High-level analysis of an organization’s present and future threat landscapes
What is the difference between Operational Intelligence and Strategic Intelligence?
Operational Intelligence is knowing what to do in the moment.
Strategic Intelligence is knowing how to prevent those moments from happening.
What is an Attack Vector and give me 4 Attack Vectors
A specific paths, methods, or scenarios that can be exploited
Email
Software Vurnabilites
Insider Threats
What is an unknown Vulnerability called? As in unknown to the software Developers
Zero Day Vurneabilty
What is the difference between the Surface Web and the Deep Web?
Surface doesnt need login - Deep web needs login (excample - Go to www.recordedfuture.com - Will not get you access to the Platform that is on the deepweb / need username and password to access)
What are each Intelligence Life cycle called
Direction
Collection
Processing
Analysis
Dissemination
Feedback
Direction
What is the Direction phase also called?
This step is also known as the planning phase.
What are the three sources the collection Phase is taking their information?
Internal Sources
Technical Source
Human Source
What are Entities? In german
Ein Substantiv - Dinge, Personen, Plätze
Entität:
1. Objekte
2. Einheiten
3. Elemente
4. Instanzen
Was sind Ontologies?
English: Meaningful relationship between Entities
German: Beziehung zwischen Entitäten
Zb; USA, US, United States, New York, Statue of Liberty, White house
What are NLPs
Natural Language Processing - Computer Intelligence that takes large unstructured text and makes it readable to people
Where all these Entities coming from and how are the Ontologies created?
Automated Collection and Classification of Threat Data
Machine Learning and NLP National Language Processing and
We use both of these technologies to collecting and classify the Threat data
Tell me the 5 Steps of NLP
Text Extraction
Text Classification
Parts of Speech Tagging
Entity Recognicion
Event Extraction
What is the input of Risk Score.. from where?
700.000 Web Sources
30 Threat Feeds
Additional risk evidence will increase a Risk Score within the risk band, but no amount of additional evidence will move the score to a higher band
yes
What is an RFI
Request for Information
There are three types of reports you can generate with Recorded Future AI:
Ransomeware Reports
Threat Landscape Reports
General Reports
Where is Collective Insight being utilised
TI and SecOps
How does Brand check for Logo abuse?
It scans the Hasfiles of Logos and scans it with urlscan.ie
How many image hash files can you add to the watch list?
10
What is URLSCAN.IO
a powerful scanner technology that allows IT security and risk management professionals to analyze and understand the potential risks associated with a particular URL.
What are the two was RF is scanning for Logo Abuse
One: Via image hash that is scanned via URLScan.io
Two: If any of the currated logos apear on malicious webpage - this only works if the logo has been currated by RF
What is IAB
Initial Access Broker the first link of Threat Actors in a Ransomeware. The person that gains access to first and sells it on to the next line to the affiliates who than do the attack and either encrypt or steal data, after that the next link is the
