SlideShare una empresa de Scribd logo

Anomali Detect 2016 - Borderless Threat Intelligence

•Descargar como PPTX, PDF•
•
Jason Trost
Jason Trost

The document discusses using external threat intelligence to monitor brands and supply chains. It recommends inventorying important external assets and integrating threat intelligence data sources. Specific sources discussed include suspicious domain registrations, network cleanliness data, social media/dark web monitoring, credential exposures, and phishing campaigns. Case studies show how these sources uncovered fraudulent procurement attempts, risky vendors, leaked credentials, and brand-targeting attacks. The document emphasizes that organizations must monitor beyond their own networks to identify supply chain threats.

Tecnología
1 de 27
Borderless Threat Intelligence Using External Threat Intelligence for Brand and Supply Chain Monitoring
© Anomali 2016 Confidential whoami • Jason Trost • VP of Threat Research • Anomali Labs
© Anomali 2016 Confidential Agenda • Overview • Supply Chain Monitoring • External Threat Intelligence • Suspicious Domains • Network Cleanliness • Social Media and DarkWeb • Credential Exposures • Phishing Campaigns • Operationalizing • Wrap up
© Anomali 2016 Confidential Overview • External threat intelligence based Breach Analytics • i.e. using intelligence about events that may not be observable on your network to detect breaches or other security events • We apply this beyond your borders to your supply chain • Types of threat intelligence covered include: • Suspicious Domains • Network Cleanliness • Social Media and DarkWeb • Credential Exposures • Spam and Phishing Campaigns
© Anomali 2016 Confidential Defining Your Supply Chain • Any vendor, partner, or customer that your organization relies on or trusts implicitly or explicitly • Supply chain members are a dependency in your vulnerable graph • Breaches within your supply chain may impact your organization • Supply chain examples: • Contractors or vendors • Software, Third Party Libraries, Remote Access Tools (VPN) • Environmental Control • Power, Utilities, and Telecomms • Computing, Hosting, and ISPs • SaaS Services
© Anomali 2016 Confidential On Premises Controls • On Premises Controls will only work for supply chain events within your network • Code / Library Reviews • Network Flow and Account Access Reviews • Internal Pivoting • Threat Feeds correlated with log events (DNS, web proxy, firewall, etc.) • They cannot detect events occurring outside your network
© Anomali 2016 Confidential Zero Premises Controls • How can you use Your Threat Intelligence solution to identify Supply Chain Threats? • Zero Premises Controls will extend your capabilities deep within your suppliers infrastructure! • Public Credential Exposures (Yourself, Partners, Suppliers) • Threat Feeds (External Organizations on Block lists) • Portscan/Web crawl Data Reviews (Shodan/Censys) • Suspicious Domain Registrations (Yourself, Partners, Suppliers) • Social Media / DarkWeb Monitoring • Spam and Phishing Campaigns
© Anomali 2016 Confidential Supply Chain Threat Intelligence • Document and Research • Supply chain company’s security posture? • Network cleanliness? Web footprint? (Services/Capabilities) • Supply chain company compromised? • How Recent? Repeated? May put you at risk • Supply chain company’s brand used to phish you? • Pay Special Attention to Service Desk Companies! • Supply chain company being targeted? • Examples may not be so obvious • DNS Registrars hold the keys
External Threat Intelligence
© Anomali 2016 Confidential Suspicious Domain Name Monitoring • Adversaries register domains mimicking the target’s brand • Techniques: • Transforms: Typosquat, Homoglyph, Character Omission/insertion/swap, etc • Deceptive domains: vpn-mycompany.com, portal-mycompany.com • Used to phish you, exploit you, or as C2 domains • Very effective social engineering tactic • Inventory Items: internal and external domain names, brand names • Data Sources: New Domain registrations, Passive DNS, Virustotal Hunting, URLCrazy, dnstwist • Operations: SIEM integration, Email alerts, IDS Signatures, DNS RPZ
© Anomali 2016 Confidential Suspicious Domain Examples threa4stream.edu th2eatdtream.com threatstrewqm.com threatsrraem.com thvaatstraam.com thbeaystream.com th2eatstreams.com threatstreal.se thpeatstreasm.com threatatream.se threadstrean.com theeatstreae.com threatrtrteam.com thraatstream.ru thr3atstraem.com threststram.com thruatsdtruam.com thhreatstrema.com threratstveam.com thrra4stream.com throatstroasm.com threutsatreum.com threitstreram.com thraetstrecm.com thteatstrgam.com threattstream.se threatsttteam.com threautsream.com threatst2eam.no threitstreasm.com thruatstzuam.com threatstreaen.com threatstreem.ru thruatctruam.com thretstreaam.com threatstrawm.com thrmatstream.ch threaystr3am.com theatsdream.com thhreatrstream.com threustreum.com theretstreem.com threatsvrewam.com threatstreal.us thr3atsvream.com threotstrreom.com threatstrgams.com threatsteram.cm threetstreel.com thgraatstream.com theeatstresm.com threatstrreal.com threattresm.com thvatstream.com threatwtreams.com threatstrtewam.com thgreatstreai.com thuatstream.com thraatsyraam.com thr3avstr3am.com threattreamm.com threatstreal.ru threatstr3m.com threat3trearn.com thrratsttream.com threatystream.ch thrrapstream.com threatstrea.de theatstrewam.com threatstreams.org threatstram.fr thseatstream.net thveatsttream.com threaustrwam.com threatsrreem.com threatstrr3am.com threatstr3qm.com threatsyzeam.com thpeatstreaam.com threatstteam.no threaststream.us thrratstrwam.com threatstrream.org threattstreamcom.com threatwtrem.com threaatstream.ca threattrgam.com threastsstream.com thrmatstreaam.com thrratstreams.com
© Anomali 2016 Confidential Don’t Forget About Dynamic DNS threatstream.gnway.net threatstream.rincondelmotor.com threatstream.pluginfree.net threatstream.estr.com.ru threatstream.teksunpv.com threatstream.gameyg.com threatstream.redbirdrestaurant.com threatstream.linkpc.net threatstream.support-microsoft.net threatstream.openoffcampus.com threatstream.keygen.com.ru threatstream.cu.cc threatstream.pornandpot.com threatstream.informatix.com.ru threatstream.fuentesderubielos.com threatstream.9wide.com threatstream.jaqan.cn threatstream.hyfitech.com threatstream.easyeatout.com threatstream.xicp.cn threatstream.xenbox.net threatstream.publicvm.com threatstream.ven.bz threatstream.meibu.com threatstream.aq.pl threatstream.m3th.org threatstream.lioha.com threatstream.meibu.net threatstream.kz.com.ru threatstream.gnway.cc threatstream.ircop.cn threatstream.igirl.ru threatstream.newsexstories.com threatstream.free-stuff.com.ru threatstream.leedichter.com threatstream.ggsddup.com threatstream.yooko.com.ru threatstream.za.pl threatstream.servercide.com threatstream.sxn.us threatstream.wmdshr.com
© Anomali 2016 Confidential Case Study: Suspicious Domain Registration • Abuse isn’t always about network compromises • Major US Based Cable and Telecommunications company • Fraudulent procurement attempt • Email sent from johnsmith@${company}-us.com, but with the correct letter head and markings • Discovered by SIEM scanning incoming email logs and flagged messages as suspicious • Security team prevented fraudulent transaction, fraud team seized domain
© Anomali 2016 Confidential Network Cleanliness Monitoring • Systems from your IP space or your supply chain’s showing up as … • Bot IPs • Scanning IPs • Brute force IPs • Spam IPs • Your webserver hosting malicious content? • Vulnerable or unexpected services running and discoverable? • Inventory Items: IP Address Space of organization and key executives (if possible) • Data Sources: Threat intelligence feeds, honeypot events, botnet sinkhole (esp. DGAs), Portscan/Web crawl data • Operations: SIEM integration, Email notifications, passive audits of portscan/webcrawl data
© Anomali 2016 Confidential Case Study: Network Cleanliness • Large Hi-tech firm evaluating IT staffing company for outsourcing some development and IT services • IT Staffing company would need VPN access and access to other internal IT resources • Passive vendor audit performed using threat intelligence data and public portscan repository • Upon inspection, IT staffing company had very poor network hygiene • tens of IPs regularly checked in to malware sinkholes • tens of IPs regularly scanned honeypot sensors • thousands of compromised credentials • IT staffing company deemed too risky
© Anomali 2016 Confidential Social Network and Darkweb Monitoring • Inventory Items: Brand names, key executive names, domain names, IP address space • Data Sources: Social media feeds, Crawling DarkWeb, analysts monitoring darkweb, Google Dorks • Operations: SIEM integration, Email notifications Credential Exposure Posting from the Hell Darkweb forum
© Anomali 2016 Confidential Case Study: Social Media/Darkweb Monitoring • Brand monitoring for Major US Based Retailer • Discovered a custom built attack tool designed for the sole purpose of brute forcing a specific part of the retailer’s web infrastructure • Provided the sample and a report about what it did, how it worked and who built it to the retailer
© Anomali 2016 Confidential Credential Exposure Monitoring • Inventory Items: email domains, email addresses of key executives • Data sources: Paste sites, Google Dorks, Darkweb • Operations: SIEM integration / orchestration system – notify users/reset passwords, Email alerts
© Anomali 2016 Confidential Case Study: Credential Exposures • Brand monitoring for a Major Food and Beverage Company • Discovered leaked credentials from an internal IT wiki page that was accidently exposed • Company alerted and changed all passwords within 24 hours • No evidence that these credentials were abused in that time
© Anomali 2016 Confidential Spam and Phishing Campaigns • Are your brand names, company name, or logos being used in large-scale Spam or Phishing campaigns? • If you’re not monitoring outside your network, you may have no visibility • Discovering early allows notifying customers or other business units (customer support, legal, etc) • Inventory Items: external domain names, brand names, logo URLs • Data Sources: Spam honeypots, VirusTotal, DNS DMARC providers, Commercial phishing threat intelligence • Operations: SIEM integration, Email alerts
© Anomali 2016 Confidential Case Study: Spam & Phishing Campaigns Phish Domain: www[.]BANKNAME-login[.]ml/nl/prive/aanvraag-formulier/ Real Domain: www[.]BANKNAME[.]nl • Banking Phishing Campaign • Using the bank’s branding, logos • Mimicked bank’s domain name and URL structure • appended “-login” to domain • .ml ccTLD instead of .nl
Operationalizing
© Anomali 2016 Confidential Build an Inventory • Create an inventory • Yourself • Critical supply chain partners • The adversaries this, you should too  Email domains names  Internal and External domain names  Personal email addresses of key executives  Company’s IP address space  IP address space of key executives’ home networks  Names of key executives  Internal project code names  Brand names  Logos and Logo URLs
© Anomali 2016 Confidential Data Sources Integration Points Suspicious Domains • New domain registration data (Whois) • Passive DNS • Virustotal Hunting • Repeated reviews of DynDNS • URLCrazy / dnstwist DNS lookups • SIEM integrations • Email based alerting • IDS Signatures • DNS RPZ Network Cleanliness • Honeypots / C2 Sinkholes • Open source threat feeds • Spammer feeds • Commercial Threat intelligence providers • Portscan / Web crawl data • Search/Alert on your IP network or your supply chain’s network showing up on these lists. • SIEM integrations • Email based alerting • Periodic review of external internet facing assets Social Media and Dark Web • DarkWeb / DeepWeb Forums • Social Media Sites • Google Dorks • Search/Alert on your brand or your supply chains’ • SIEM integrations Data Sources and Integration Points (1 of 2)
© Anomali 2016 Confidential Data Sources Integration Points Compromised Credentials • Paste sites • DarkWeb / DeepWeb monitoring • Google dorks • Commercial Threat intelligence providers • Search/Alert on your email domains or those of your supply chain • Notify users • Reset passwords as needed Spam and Phishing Campaign Monitoring • Spam Honeypots • Virustotal Hunting • DNS DMARC providers • Commercial Threat intelligence providers • Search/Alert on your domains, brands, or logo URLs (or those of your supply chain) • SIEM integrations • Email based alerting Data Sources and Integration Points (2 of 2)
© Anomali 2016 Confidential Summary • Organizations must watch more than themselves and their industry vertical • High Tech Suppliers such as Web and Domain Services, Firewall and Desktop Application vendors are increasingly targeted • Chatter on social media and DarkWeb forums can provide early warning • Compromised Credentials may be used by third party contractors on your network • Passive vendors audits should be part of your procurement process • Spam/phishing campaign monitoring can help you get ahead of the fallout
© Anomali 2016 Confidential Questions?

Recomendados

R-CISC Summit 2016 Borderless Threat Intelligence
R-CISC Summit 2016 Borderless Threat IntelligenceR-CISC Summit 2016 Borderless Threat Intelligence
R-CISC Summit 2016 Borderless Threat IntelligenceJason Trost
 
SANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceSANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceJason Trost
 
Anomali Product Brochure
Anomali Product BrochureAnomali Product Brochure
Anomali Product BrochureTodd Helfrich
 
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...Jason Trost
 
Distributed Sensor Data Contextualization for Threat Intelligence Analysis
Distributed Sensor Data Contextualization for Threat Intelligence AnalysisDistributed Sensor Data Contextualization for Threat Intelligence Analysis
Distributed Sensor Data Contextualization for Threat Intelligence AnalysisJason Trost
 
Modern Honey Network (MHN)
Modern Honey Network (MHN)Modern Honey Network (MHN)
Modern Honey Network (MHN)Jason Trost
 
BSidesNYC 2016 - An Adversarial View of SaaS Malware Sandboxes
BSidesNYC 2016 - An Adversarial View of SaaS Malware SandboxesBSidesNYC 2016 - An Adversarial View of SaaS Malware Sandboxes
BSidesNYC 2016 - An Adversarial View of SaaS Malware SandboxesJason Trost
 
Threat Intelligence Field of Dreams
Threat Intelligence Field of DreamsThreat Intelligence Field of Dreams
Threat Intelligence Field of DreamsGreg Foss
 

Recomendados

R-CISC Summit 2016 Borderless Threat Intelligence
R-CISC Summit 2016 Borderless Threat IntelligenceR-CISC Summit 2016 Borderless Threat Intelligence
R-CISC Summit 2016 Borderless Threat IntelligenceJason Trost
 
SANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceSANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceJason Trost
 
Anomali Product Brochure
Anomali Product BrochureAnomali Product Brochure
Anomali Product BrochureTodd Helfrich
 
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...Jason Trost
 
Distributed Sensor Data Contextualization for Threat Intelligence Analysis
Distributed Sensor Data Contextualization for Threat Intelligence AnalysisDistributed Sensor Data Contextualization for Threat Intelligence Analysis
Distributed Sensor Data Contextualization for Threat Intelligence AnalysisJason Trost
 
Modern Honey Network (MHN)
Modern Honey Network (MHN)Modern Honey Network (MHN)
Modern Honey Network (MHN)Jason Trost
 
BSidesNYC 2016 - An Adversarial View of SaaS Malware Sandboxes
BSidesNYC 2016 - An Adversarial View of SaaS Malware SandboxesBSidesNYC 2016 - An Adversarial View of SaaS Malware Sandboxes
BSidesNYC 2016 - An Adversarial View of SaaS Malware SandboxesJason Trost
 
Threat Intelligence Field of Dreams
Threat Intelligence Field of DreamsThreat Intelligence Field of Dreams
Threat Intelligence Field of DreamsGreg Foss
 
Combating Insider Threats – Protecting Your Agency from the Inside Out
Combating Insider Threats – Protecting Your Agency from the Inside OutCombating Insider Threats – Protecting Your Agency from the Inside Out
Combating Insider Threats – Protecting Your Agency from the Inside OutLancope, Inc.
 
An Adversarial View of SaaS Malware Sandboxes
An Adversarial View of SaaS Malware SandboxesAn Adversarial View of SaaS Malware Sandboxes
An Adversarial View of SaaS Malware SandboxesJason Trost
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Chi En (Ashley) Shen
 
The Anatomy of Comment Spam
The Anatomy of Comment SpamThe Anatomy of Comment Spam
The Anatomy of Comment SpamImperva
 
Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016Tony Cook
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsSpyglass Security
 
Webinar: Stopping evasive malware - how a cloud sandbox array works
Webinar: Stopping evasive malware - how a cloud sandbox array worksWebinar: Stopping evasive malware - how a cloud sandbox array works
Webinar: Stopping evasive malware - how a cloud sandbox array worksCyren, Inc
 
Open Source Malware Lab
Open Source Malware LabOpen Source Malware Lab
Open Source Malware LabThreatConnect
 
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception saconPriyanka Aash
 
Treat Detection using Hadoop
Treat Detection using HadoopTreat Detection using Hadoop
Treat Detection using HadoopDataWorks Summit
 
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)Practical White Hat Hacker Training - Passive Information Gathering(OSINT)
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)PRISMA CSI
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Spyglass Security
 
Anatomy of the Compromised Insider
Anatomy of the Compromised InsiderAnatomy of the Compromised Insider
Anatomy of the Compromised InsiderImperva
 
Honeynet architecture
Honeynet architectureHoneynet architecture
Honeynet architectureamar koppal
 
Fighting cyber fraud with hadoop v2
Fighting cyber fraud with hadoop v2Fighting cyber fraud with hadoop v2
Fighting cyber fraud with hadoop v2Niel Dunnage
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationRaffael Marty
 
November 2013 HUG: Cyber Security with Hadoop
November 2013 HUG: Cyber Security with HadoopNovember 2013 HUG: Cyber Security with Hadoop
November 2013 HUG: Cyber Security with HadoopYahoo Developer Network
 
DNS Measurement Activity on ITB 2010
DNS Measurement Activity on ITB 2010DNS Measurement Activity on ITB 2010
DNS Measurement Activity on ITB 2010Affan Basalamah
 
User and entity behavior analytics: building an effective solution
User and entity behavior analytics: building an effective solutionUser and entity behavior analytics: building an effective solution
User and entity behavior analytics: building an effective solutionYolanta Beresna
 
Burning Down the Haystack to Find the Needle: Security Analytics in Action
Burning Down the Haystack to Find the Needle: Security Analytics in ActionBurning Down the Haystack to Find the Needle: Security Analytics in Action
Burning Down the Haystack to Find the Needle: Security Analytics in ActionJosh Sokol
 
Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...
Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...
Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...Jason Trost
 
SOC 3.0: strategic threat intelligence May 2016
SOC 3.0: strategic threat intelligence May 2016SOC 3.0: strategic threat intelligence May 2016
SOC 3.0: strategic threat intelligence May 2016Sarah Bark
 

Más contenido relacionado

La actualidad más candente

Combating Insider Threats – Protecting Your Agency from the Inside Out
Combating Insider Threats – Protecting Your Agency from the Inside OutCombating Insider Threats – Protecting Your Agency from the Inside Out
Combating Insider Threats – Protecting Your Agency from the Inside OutLancope, Inc.
 
An Adversarial View of SaaS Malware Sandboxes
An Adversarial View of SaaS Malware SandboxesAn Adversarial View of SaaS Malware Sandboxes
An Adversarial View of SaaS Malware SandboxesJason Trost
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Chi En (Ashley) Shen
 
The Anatomy of Comment Spam
The Anatomy of Comment SpamThe Anatomy of Comment Spam
The Anatomy of Comment SpamImperva
 
Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016Tony Cook
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsSpyglass Security
 
Webinar: Stopping evasive malware - how a cloud sandbox array works
Webinar: Stopping evasive malware - how a cloud sandbox array worksWebinar: Stopping evasive malware - how a cloud sandbox array works
Webinar: Stopping evasive malware - how a cloud sandbox array worksCyren, Inc
 
Open Source Malware Lab
Open Source Malware LabOpen Source Malware Lab
Open Source Malware LabThreatConnect
 
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception saconPriyanka Aash
 
Treat Detection using Hadoop
Treat Detection using HadoopTreat Detection using Hadoop
Treat Detection using HadoopDataWorks Summit
 
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)Practical White Hat Hacker Training - Passive Information Gathering(OSINT)
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)PRISMA CSI
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Spyglass Security
 
Anatomy of the Compromised Insider
Anatomy of the Compromised InsiderAnatomy of the Compromised Insider
Anatomy of the Compromised InsiderImperva
 
Honeynet architecture
Honeynet architectureHoneynet architecture
Honeynet architectureamar koppal
 
Fighting cyber fraud with hadoop v2
Fighting cyber fraud with hadoop v2Fighting cyber fraud with hadoop v2
Fighting cyber fraud with hadoop v2Niel Dunnage
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationRaffael Marty
 
November 2013 HUG: Cyber Security with Hadoop
November 2013 HUG: Cyber Security with HadoopNovember 2013 HUG: Cyber Security with Hadoop
November 2013 HUG: Cyber Security with HadoopYahoo Developer Network
 
DNS Measurement Activity on ITB 2010
DNS Measurement Activity on ITB 2010DNS Measurement Activity on ITB 2010
DNS Measurement Activity on ITB 2010Affan Basalamah
 
User and entity behavior analytics: building an effective solution
User and entity behavior analytics: building an effective solutionUser and entity behavior analytics: building an effective solution
User and entity behavior analytics: building an effective solutionYolanta Beresna
 
Burning Down the Haystack to Find the Needle: Security Analytics in Action
Burning Down the Haystack to Find the Needle: Security Analytics in ActionBurning Down the Haystack to Find the Needle: Security Analytics in Action
Burning Down the Haystack to Find the Needle: Security Analytics in ActionJosh Sokol
 

La actualidad más candente (20)

Combating Insider Threats – Protecting Your Agency from the Inside Out
Combating Insider Threats – Protecting Your Agency from the Inside OutCombating Insider Threats – Protecting Your Agency from the Inside Out
Combating Insider Threats – Protecting Your Agency from the Inside Out
 
An Adversarial View of SaaS Malware Sandboxes
An Adversarial View of SaaS Malware SandboxesAn Adversarial View of SaaS Malware Sandboxes
An Adversarial View of SaaS Malware Sandboxes
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
 
The Anatomy of Comment Spam
The Anatomy of Comment SpamThe Anatomy of Comment Spam
The Anatomy of Comment Spam
 
Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark Arts
 
Webinar: Stopping evasive malware - how a cloud sandbox array works
Webinar: Stopping evasive malware - how a cloud sandbox array worksWebinar: Stopping evasive malware - how a cloud sandbox array works
Webinar: Stopping evasive malware - how a cloud sandbox array works
 
Open Source Malware Lab
Open Source Malware LabOpen Source Malware Lab
Open Source Malware Lab
 
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
 
Treat Detection using Hadoop
Treat Detection using HadoopTreat Detection using Hadoop
Treat Detection using Hadoop
 
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)Practical White Hat Hacker Training - Passive Information Gathering(OSINT)
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
 
Anatomy of the Compromised Insider
Anatomy of the Compromised InsiderAnatomy of the Compromised Insider
Anatomy of the Compromised Insider
 
Honeynet architecture
Honeynet architectureHoneynet architecture
Honeynet architecture
 
Fighting cyber fraud with hadoop v2
Fighting cyber fraud with hadoop v2Fighting cyber fraud with hadoop v2
Fighting cyber fraud with hadoop v2
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
 
November 2013 HUG: Cyber Security with Hadoop
November 2013 HUG: Cyber Security with HadoopNovember 2013 HUG: Cyber Security with Hadoop
November 2013 HUG: Cyber Security with Hadoop
 
DNS Measurement Activity on ITB 2010
DNS Measurement Activity on ITB 2010DNS Measurement Activity on ITB 2010
DNS Measurement Activity on ITB 2010
 
User and entity behavior analytics: building an effective solution
User and entity behavior analytics: building an effective solutionUser and entity behavior analytics: building an effective solution
User and entity behavior analytics: building an effective solution
 
Burning Down the Haystack to Find the Needle: Security Analytics in Action
Burning Down the Haystack to Find the Needle: Security Analytics in ActionBurning Down the Haystack to Find the Needle: Security Analytics in Action
Burning Down the Haystack to Find the Needle: Security Analytics in Action
 

Destacado

Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...
Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...
Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...Jason Trost
 
SOC 3.0: strategic threat intelligence May 2016
SOC 3.0: strategic threat intelligence May 2016SOC 3.0: strategic threat intelligence May 2016
SOC 3.0: strategic threat intelligence May 2016Sarah Bark
 
Reduce the Attacker's ROI with Collaborative Threat Intelligence
Reduce the Attacker's ROI with Collaborative Threat IntelligenceReduce the Attacker's ROI with Collaborative Threat Intelligence
Reduce the Attacker's ROI with Collaborative Threat IntelligenceAlienVault
 
Threat Intelligence is a Journey; Not a Destination
Threat Intelligence is a Journey; Not a DestinationThreat Intelligence is a Journey; Not a Destination
Threat Intelligence is a Journey; Not a DestinationThreatConnect
 
Infosecurity Europe 2016: Operationalizing Threat Intelligence
Infosecurity Europe 2016: Operationalizing Threat IntelligenceInfosecurity Europe 2016: Operationalizing Threat Intelligence
Infosecurity Europe 2016: Operationalizing Threat IntelligenceSplunk
 
Infosec 2015 - Using threat intelligence to improve security response
Infosec 2015 - Using threat intelligence to improve security responseInfosec 2015 - Using threat intelligence to improve security response
Infosec 2015 - Using threat intelligence to improve security responseHuntsman Security
 
2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philAPhil Agcaoili
 
Embracing Threat Intelligence and Finding ROI in Your Decision
Embracing Threat Intelligence and Finding ROI in Your DecisionEmbracing Threat Intelligence and Finding ROI in Your Decision
Embracing Threat Intelligence and Finding ROI in Your DecisionCylance
 
Mirai botnet
Mirai botnetMirai botnet
Mirai botnetOWASP
 
MIRAI: What is It, How Does it Work and Why Should I Care?
MIRAI: What is It, How Does it Work and Why Should I Care?MIRAI: What is It, How Does it Work and Why Should I Care?
MIRAI: What is It, How Does it Work and Why Should I Care?Memoori
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsMark Arena
 
Honeycon2016-honeypot updates for public
Honeycon2016-honeypot updates for publicHoneycon2016-honeypot updates for public
Honeycon2016-honeypot updates for publicJulia Yu-Chin Cheng
 
Honeypot honeynet
Honeypot honeynetHoneypot honeynet
Honeypot honeynetSina Manavi
 
IBM Security AppExchange Spotlight: Threat Intelligence & Monitoring Microso...
IBM Security AppExchange Spotlight: Threat Intelligence & Monitoring Microso...IBM Security AppExchange Spotlight: Threat Intelligence & Monitoring Microso...
IBM Security AppExchange Spotlight: Threat Intelligence & Monitoring Microso...IBM Security
 
M-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security GapM-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security GapFireEye, Inc.
 

Destacado (15)

Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...
Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...
Lessons Learned from Building and Running MHN, the World's Largest Crowdsourc...
 
SOC 3.0: strategic threat intelligence May 2016
SOC 3.0: strategic threat intelligence May 2016SOC 3.0: strategic threat intelligence May 2016
SOC 3.0: strategic threat intelligence May 2016
 
Reduce the Attacker's ROI with Collaborative Threat Intelligence
Reduce the Attacker's ROI with Collaborative Threat IntelligenceReduce the Attacker's ROI with Collaborative Threat Intelligence
Reduce the Attacker's ROI with Collaborative Threat Intelligence
 
Threat Intelligence is a Journey; Not a Destination
Threat Intelligence is a Journey; Not a DestinationThreat Intelligence is a Journey; Not a Destination
Threat Intelligence is a Journey; Not a Destination
 
Infosecurity Europe 2016: Operationalizing Threat Intelligence
Infosecurity Europe 2016: Operationalizing Threat IntelligenceInfosecurity Europe 2016: Operationalizing Threat Intelligence
Infosecurity Europe 2016: Operationalizing Threat Intelligence
 
Infosec 2015 - Using threat intelligence to improve security response
Infosec 2015 - Using threat intelligence to improve security responseInfosec 2015 - Using threat intelligence to improve security response
Infosec 2015 - Using threat intelligence to improve security response
 
2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA
 
Embracing Threat Intelligence and Finding ROI in Your Decision
Embracing Threat Intelligence and Finding ROI in Your DecisionEmbracing Threat Intelligence and Finding ROI in Your Decision
Embracing Threat Intelligence and Finding ROI in Your Decision
 
Mirai botnet
Mirai botnetMirai botnet
Mirai botnet
 
MIRAI: What is It, How Does it Work and Why Should I Care?
MIRAI: What is It, How Does it Work and Why Should I Care?MIRAI: What is It, How Does it Work and Why Should I Care?
MIRAI: What is It, How Does it Work and Why Should I Care?
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
 
Honeycon2016-honeypot updates for public
Honeycon2016-honeypot updates for publicHoneycon2016-honeypot updates for public
Honeycon2016-honeypot updates for public
 
Honeypot honeynet
Honeypot honeynetHoneypot honeynet
Honeypot honeynet
 
IBM Security AppExchange Spotlight: Threat Intelligence & Monitoring Microso...
IBM Security AppExchange Spotlight: Threat Intelligence & Monitoring Microso...IBM Security AppExchange Spotlight: Threat Intelligence & Monitoring Microso...
IBM Security AppExchange Spotlight: Threat Intelligence & Monitoring Microso...
 
M-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security GapM-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security Gap
 

Similar a Anomali Detect 2016 - Borderless Threat Intelligence

What a locked down law firm looks like updated
What a locked down law firm looks like updatedWhat a locked down law firm looks like updated
What a locked down law firm looks like updatedDenim Group
 
Combating Insider Threats – Protecting Your Agency from the Inside Out
Combating Insider Threats – Protecting Your Agency from the Inside OutCombating Insider Threats – Protecting Your Agency from the Inside Out
Combating Insider Threats – Protecting Your Agency from the Inside OutLancope, Inc.
 
NormShield 2018 Cyber Security Risk Brief
NormShield 2018 Cyber Security Risk BriefNormShield 2018 Cyber Security Risk Brief
NormShield 2018 Cyber Security Risk BriefNormShield
 
Cyber 101 for smb execs v1
Cyber 101 for smb execs v1Cyber 101 for smb execs v1
Cyber 101 for smb execs v1NetWatcher
 
Penetration testing & Ethical Hacking
Penetration testing & Ethical HackingPenetration testing & Ethical Hacking
Penetration testing & Ethical HackingS.E. CTS CERT-GOV-MD
 
VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing Netpluz Asia Pte Ltd
 
How To Handle Breach Disclosures? Bug Bounty, Coordinated Vulnerability Discl...
How To Handle Breach Disclosures? Bug Bounty, Coordinated Vulnerability Discl...How To Handle Breach Disclosures? Bug Bounty, Coordinated Vulnerability Discl...
How To Handle Breach Disclosures? Bug Bounty, Coordinated Vulnerability Discl...Priyanka Aash
 
Implementing security for your library | PLAN Tech Day Conference
Implementing security for your library | PLAN Tech Day ConferenceImplementing security for your library | PLAN Tech Day Conference
Implementing security for your library | PLAN Tech Day ConferenceBrian Pichman
 
Chapter 3 security part i auditing operating systems and networks
Chapter 3 security part i auditing operating systems and networksChapter 3 security part i auditing operating systems and networks
Chapter 3 security part i auditing operating systems and networksTommy Zul Hidayat
 
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptx
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptxColorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptx
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptxAkramAlqadasi1
 
Cybercrime - Stealing in the Connected Age
Cybercrime - Stealing in the Connected AgeCybercrime - Stealing in the Connected Age
Cybercrime - Stealing in the Connected Agedlblumen
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Mark Arena
 
The Personal and Website Security Mindset
The Personal and Website Security MindsetThe Personal and Website Security Mindset
The Personal and Website Security MindsetAdam W. Warner
 
5 Möglichkeiten zur Verbesserung Ihrer Security
5 Möglichkeiten zur Verbesserung Ihrer Security5 Möglichkeiten zur Verbesserung Ihrer Security
5 Möglichkeiten zur Verbesserung Ihrer SecurityGeorg Knon
 
NormShield Cyber Threat & Vulnerability Orchestration Overview
NormShield Cyber Threat & Vulnerability Orchestration OverviewNormShield Cyber Threat & Vulnerability Orchestration Overview
NormShield Cyber Threat & Vulnerability Orchestration OverviewNormShield, Inc.
 
Personal Internet Security Practice
Personal Internet Security PracticePersonal Internet Security Practice
Personal Internet Security PracticeBrian Pichman
 
Securing and Safeguarding Your Library Setup
Securing and Safeguarding Your Library SetupSecuring and Safeguarding Your Library Setup
Securing and Safeguarding Your Library SetupBrian Pichman
 
Chapter 3 security part i auditing operating systems and networks
Chapter 3 security part i auditing operating systems and networksChapter 3 security part i auditing operating systems and networks
Chapter 3 security part i auditing operating systems and networksjayussuryawan
 

Similar a Anomali Detect 2016 - Borderless Threat Intelligence (20)

What a locked down law firm looks like updated
What a locked down law firm looks like updatedWhat a locked down law firm looks like updated
What a locked down law firm looks like updated
 
Combating Insider Threats – Protecting Your Agency from the Inside Out
Combating Insider Threats – Protecting Your Agency from the Inside OutCombating Insider Threats – Protecting Your Agency from the Inside Out
Combating Insider Threats – Protecting Your Agency from the Inside Out
 
NormShield 2018 Cyber Security Risk Brief
NormShield 2018 Cyber Security Risk BriefNormShield 2018 Cyber Security Risk Brief
NormShield 2018 Cyber Security Risk Brief
 
Cyber 101 for smb execs v1
Cyber 101 for smb execs v1Cyber 101 for smb execs v1
Cyber 101 for smb execs v1
 
Penetration testing & Ethical Hacking
Penetration testing & Ethical HackingPenetration testing & Ethical Hacking
Penetration testing & Ethical Hacking
 
VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing VAPT - Vulnerability Assessment & Penetration Testing
VAPT - Vulnerability Assessment & Penetration Testing
 
How To Handle Breach Disclosures? Bug Bounty, Coordinated Vulnerability Discl...
How To Handle Breach Disclosures? Bug Bounty, Coordinated Vulnerability Discl...How To Handle Breach Disclosures? Bug Bounty, Coordinated Vulnerability Discl...
How To Handle Breach Disclosures? Bug Bounty, Coordinated Vulnerability Discl...
 
Implementing security for your library | PLAN Tech Day Conference
Implementing security for your library | PLAN Tech Day ConferenceImplementing security for your library | PLAN Tech Day Conference
Implementing security for your library | PLAN Tech Day Conference
 
Chapter 3 security part i auditing operating systems and networks
Chapter 3 security part i auditing operating systems and networksChapter 3 security part i auditing operating systems and networks
Chapter 3 security part i auditing operating systems and networks
 
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptx
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptxColorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptx
Colorado-Society-of-CPAs-Cybersecurity-Presentation-v3_Feb8.pptx
 
Cybercrime - Stealing in the Connected Age
Cybercrime - Stealing in the Connected AgeCybercrime - Stealing in the Connected Age
Cybercrime - Stealing in the Connected Age
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...Cyber Threat Intelligence: Building and maturing an intelligence program that...
Cyber Threat Intelligence: Building and maturing an intelligence program that...
 
Data Breach Detection: Are you ready for GDPR?
Data Breach Detection: Are you ready for GDPR?Data Breach Detection: Are you ready for GDPR?
Data Breach Detection: Are you ready for GDPR?
 
The Personal and Website Security Mindset
The Personal and Website Security MindsetThe Personal and Website Security Mindset
The Personal and Website Security Mindset
 
5 Möglichkeiten zur Verbesserung Ihrer Security
5 Möglichkeiten zur Verbesserung Ihrer Security5 Möglichkeiten zur Verbesserung Ihrer Security
5 Möglichkeiten zur Verbesserung Ihrer Security
 
NormShield Cyber Threat & Vulnerability Orchestration Overview
NormShield Cyber Threat & Vulnerability Orchestration OverviewNormShield Cyber Threat & Vulnerability Orchestration Overview
NormShield Cyber Threat & Vulnerability Orchestration Overview
 
Personal Internet Security Practice
Personal Internet Security PracticePersonal Internet Security Practice
Personal Internet Security Practice
 
Securing and Safeguarding Your Library Setup
Securing and Safeguarding Your Library SetupSecuring and Safeguarding Your Library Setup
Securing and Safeguarding Your Library Setup
 
Real Business Threats!
Real Business Threats!Real Business Threats!
Real Business Threats!
 
Chapter 3 security part i auditing operating systems and networks
Chapter 3 security part i auditing operating systems and networksChapter 3 security part i auditing operating systems and networks
Chapter 3 security part i auditing operating systems and networks
 

Último

The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxLoriGlavin3
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Mark Simos
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 
Commit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyCommit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyAlfredo García Lavilla
 
Generative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information DevelopersGenerative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information DevelopersRaghuram Pandurangan
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays
 
What is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfWhat is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfMounikaPolabathina
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningLars Bell
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubKalema Edgar
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.Curtis Poe
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionDilum Bandara
 
From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .Alan Dix
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsSergiu Bodiu
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxLoriGlavin3
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr BaganFwdays
 

Último (20)

The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 
DMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special EditionDMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special Edition
 
Commit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyCommit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easy
 
Generative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information DevelopersGenerative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information Developers
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko
 
What is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfWhat is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdf
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine Tuning
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding Club
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An Introduction
 
From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platforms
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan
 

Anomali Detect 2016 - Borderless Threat Intelligence

  • 1. Borderless Threat Intelligence Using External Threat Intelligence for Brand and Supply Chain Monitoring
  • 2. © Anomali 2016 Confidential whoami • Jason Trost • VP of Threat Research • Anomali Labs
  • 3. © Anomali 2016 Confidential Agenda • Overview • Supply Chain Monitoring • External Threat Intelligence • Suspicious Domains • Network Cleanliness • Social Media and DarkWeb • Credential Exposures • Phishing Campaigns • Operationalizing • Wrap up
  • 4. © Anomali 2016 Confidential Overview • External threat intelligence based Breach Analytics • i.e. using intelligence about events that may not be observable on your network to detect breaches or other security events • We apply this beyond your borders to your supply chain • Types of threat intelligence covered include: • Suspicious Domains • Network Cleanliness • Social Media and DarkWeb • Credential Exposures • Spam and Phishing Campaigns
  • 5. © Anomali 2016 Confidential Defining Your Supply Chain • Any vendor, partner, or customer that your organization relies on or trusts implicitly or explicitly • Supply chain members are a dependency in your vulnerable graph • Breaches within your supply chain may impact your organization • Supply chain examples: • Contractors or vendors • Software, Third Party Libraries, Remote Access Tools (VPN) • Environmental Control • Power, Utilities, and Telecomms • Computing, Hosting, and ISPs • SaaS Services
  • 6. © Anomali 2016 Confidential On Premises Controls • On Premises Controls will only work for supply chain events within your network • Code / Library Reviews • Network Flow and Account Access Reviews • Internal Pivoting • Threat Feeds correlated with log events (DNS, web proxy, firewall, etc.) • They cannot detect events occurring outside your network
  • 7. © Anomali 2016 Confidential Zero Premises Controls • How can you use Your Threat Intelligence solution to identify Supply Chain Threats? • Zero Premises Controls will extend your capabilities deep within your suppliers infrastructure! • Public Credential Exposures (Yourself, Partners, Suppliers) • Threat Feeds (External Organizations on Block lists) • Portscan/Web crawl Data Reviews (Shodan/Censys) • Suspicious Domain Registrations (Yourself, Partners, Suppliers) • Social Media / DarkWeb Monitoring • Spam and Phishing Campaigns
  • 8. © Anomali 2016 Confidential Supply Chain Threat Intelligence • Document and Research • Supply chain company’s security posture? • Network cleanliness? Web footprint? (Services/Capabilities) • Supply chain company compromised? • How Recent? Repeated? May put you at risk • Supply chain company’s brand used to phish you? • Pay Special Attention to Service Desk Companies! • Supply chain company being targeted? • Examples may not be so obvious • DNS Registrars hold the keys
  • 10. © Anomali 2016 Confidential Suspicious Domain Name Monitoring • Adversaries register domains mimicking the target’s brand • Techniques: • Transforms: Typosquat, Homoglyph, Character Omission/insertion/swap, etc • Deceptive domains: vpn-mycompany.com, portal-mycompany.com • Used to phish you, exploit you, or as C2 domains • Very effective social engineering tactic • Inventory Items: internal and external domain names, brand names • Data Sources: New Domain registrations, Passive DNS, Virustotal Hunting, URLCrazy, dnstwist • Operations: SIEM integration, Email alerts, IDS Signatures, DNS RPZ
  • 11. © Anomali 2016 Confidential Suspicious Domain Examples threa4stream.edu th2eatdtream.com threatstrewqm.com threatsrraem.com thvaatstraam.com thbeaystream.com th2eatstreams.com threatstreal.se thpeatstreasm.com threatatream.se threadstrean.com theeatstreae.com threatrtrteam.com thraatstream.ru thr3atstraem.com threststram.com thruatsdtruam.com thhreatstrema.com threratstveam.com thrra4stream.com throatstroasm.com threutsatreum.com threitstreram.com thraetstrecm.com thteatstrgam.com threattstream.se threatsttteam.com threautsream.com threatst2eam.no threitstreasm.com thruatstzuam.com threatstreaen.com threatstreem.ru thruatctruam.com thretstreaam.com threatstrawm.com thrmatstream.ch threaystr3am.com theatsdream.com thhreatrstream.com threustreum.com theretstreem.com threatsvrewam.com threatstreal.us thr3atsvream.com threotstrreom.com threatstrgams.com threatsteram.cm threetstreel.com thgraatstream.com theeatstresm.com threatstrreal.com threattresm.com thvatstream.com threatwtreams.com threatstrtewam.com thgreatstreai.com thuatstream.com thraatsyraam.com thr3avstr3am.com threattreamm.com threatstreal.ru threatstr3m.com threat3trearn.com thrratsttream.com threatystream.ch thrrapstream.com threatstrea.de theatstrewam.com threatstreams.org threatstram.fr thseatstream.net thveatsttream.com threaustrwam.com threatsrreem.com threatstrr3am.com threatstr3qm.com threatsyzeam.com thpeatstreaam.com threatstteam.no threaststream.us thrratstrwam.com threatstrream.org threattstreamcom.com threatwtrem.com threaatstream.ca threattrgam.com threastsstream.com thrmatstreaam.com thrratstreams.com
  • 12. © Anomali 2016 Confidential Don’t Forget About Dynamic DNS threatstream.gnway.net threatstream.rincondelmotor.com threatstream.pluginfree.net threatstream.estr.com.ru threatstream.teksunpv.com threatstream.gameyg.com threatstream.redbirdrestaurant.com threatstream.linkpc.net threatstream.support-microsoft.net threatstream.openoffcampus.com threatstream.keygen.com.ru threatstream.cu.cc threatstream.pornandpot.com threatstream.informatix.com.ru threatstream.fuentesderubielos.com threatstream.9wide.com threatstream.jaqan.cn threatstream.hyfitech.com threatstream.easyeatout.com threatstream.xicp.cn threatstream.xenbox.net threatstream.publicvm.com threatstream.ven.bz threatstream.meibu.com threatstream.aq.pl threatstream.m3th.org threatstream.lioha.com threatstream.meibu.net threatstream.kz.com.ru threatstream.gnway.cc threatstream.ircop.cn threatstream.igirl.ru threatstream.newsexstories.com threatstream.free-stuff.com.ru threatstream.leedichter.com threatstream.ggsddup.com threatstream.yooko.com.ru threatstream.za.pl threatstream.servercide.com threatstream.sxn.us threatstream.wmdshr.com
  • 13. © Anomali 2016 Confidential Case Study: Suspicious Domain Registration • Abuse isn’t always about network compromises • Major US Based Cable and Telecommunications company • Fraudulent procurement attempt • Email sent from johnsmith@${company}-us.com, but with the correct letter head and markings • Discovered by SIEM scanning incoming email logs and flagged messages as suspicious • Security team prevented fraudulent transaction, fraud team seized domain
  • 14. © Anomali 2016 Confidential Network Cleanliness Monitoring • Systems from your IP space or your supply chain’s showing up as … • Bot IPs • Scanning IPs • Brute force IPs • Spam IPs • Your webserver hosting malicious content? • Vulnerable or unexpected services running and discoverable? • Inventory Items: IP Address Space of organization and key executives (if possible) • Data Sources: Threat intelligence feeds, honeypot events, botnet sinkhole (esp. DGAs), Portscan/Web crawl data • Operations: SIEM integration, Email notifications, passive audits of portscan/webcrawl data
  • 15. © Anomali 2016 Confidential Case Study: Network Cleanliness • Large Hi-tech firm evaluating IT staffing company for outsourcing some development and IT services • IT Staffing company would need VPN access and access to other internal IT resources • Passive vendor audit performed using threat intelligence data and public portscan repository • Upon inspection, IT staffing company had very poor network hygiene • tens of IPs regularly checked in to malware sinkholes • tens of IPs regularly scanned honeypot sensors • thousands of compromised credentials • IT staffing company deemed too risky
  • 16. © Anomali 2016 Confidential Social Network and Darkweb Monitoring • Inventory Items: Brand names, key executive names, domain names, IP address space • Data Sources: Social media feeds, Crawling DarkWeb, analysts monitoring darkweb, Google Dorks • Operations: SIEM integration, Email notifications Credential Exposure Posting from the Hell Darkweb forum
  • 17. © Anomali 2016 Confidential Case Study: Social Media/Darkweb Monitoring • Brand monitoring for Major US Based Retailer • Discovered a custom built attack tool designed for the sole purpose of brute forcing a specific part of the retailer’s web infrastructure • Provided the sample and a report about what it did, how it worked and who built it to the retailer
  • 18. © Anomali 2016 Confidential Credential Exposure Monitoring • Inventory Items: email domains, email addresses of key executives • Data sources: Paste sites, Google Dorks, Darkweb • Operations: SIEM integration / orchestration system – notify users/reset passwords, Email alerts
  • 19. © Anomali 2016 Confidential Case Study: Credential Exposures • Brand monitoring for a Major Food and Beverage Company • Discovered leaked credentials from an internal IT wiki page that was accidently exposed • Company alerted and changed all passwords within 24 hours • No evidence that these credentials were abused in that time
  • 20. © Anomali 2016 Confidential Spam and Phishing Campaigns • Are your brand names, company name, or logos being used in large-scale Spam or Phishing campaigns? • If you’re not monitoring outside your network, you may have no visibility • Discovering early allows notifying customers or other business units (customer support, legal, etc) • Inventory Items: external domain names, brand names, logo URLs • Data Sources: Spam honeypots, VirusTotal, DNS DMARC providers, Commercial phishing threat intelligence • Operations: SIEM integration, Email alerts
  • 21. © Anomali 2016 Confidential Case Study: Spam & Phishing Campaigns Phish Domain: www[.]BANKNAME-login[.]ml/nl/prive/aanvraag-formulier/ Real Domain: www[.]BANKNAME[.]nl • Banking Phishing Campaign • Using the bank’s branding, logos • Mimicked bank’s domain name and URL structure • appended “-login” to domain • .ml ccTLD instead of .nl
  • 23. © Anomali 2016 Confidential Build an Inventory • Create an inventory • Yourself • Critical supply chain partners • The adversaries this, you should too  Email domains names  Internal and External domain names  Personal email addresses of key executives  Company’s IP address space  IP address space of key executives’ home networks  Names of key executives  Internal project code names  Brand names  Logos and Logo URLs
  • 24. © Anomali 2016 Confidential Data Sources Integration Points Suspicious Domains • New domain registration data (Whois) • Passive DNS • Virustotal Hunting • Repeated reviews of DynDNS • URLCrazy / dnstwist DNS lookups • SIEM integrations • Email based alerting • IDS Signatures • DNS RPZ Network Cleanliness • Honeypots / C2 Sinkholes • Open source threat feeds • Spammer feeds • Commercial Threat intelligence providers • Portscan / Web crawl data • Search/Alert on your IP network or your supply chain’s network showing up on these lists. • SIEM integrations • Email based alerting • Periodic review of external internet facing assets Social Media and Dark Web • DarkWeb / DeepWeb Forums • Social Media Sites • Google Dorks • Search/Alert on your brand or your supply chains’ • SIEM integrations Data Sources and Integration Points (1 of 2)
  • 25. © Anomali 2016 Confidential Data Sources Integration Points Compromised Credentials • Paste sites • DarkWeb / DeepWeb monitoring • Google dorks • Commercial Threat intelligence providers • Search/Alert on your email domains or those of your supply chain • Notify users • Reset passwords as needed Spam and Phishing Campaign Monitoring • Spam Honeypots • Virustotal Hunting • DNS DMARC providers • Commercial Threat intelligence providers • Search/Alert on your domains, brands, or logo URLs (or those of your supply chain) • SIEM integrations • Email based alerting Data Sources and Integration Points (2 of 2)
  • 26. © Anomali 2016 Confidential Summary • Organizations must watch more than themselves and their industry vertical • High Tech Suppliers such as Web and Domain Services, Firewall and Desktop Application vendors are increasingly targeted • Chatter on social media and DarkWeb forums can provide early warning • Compromised Credentials may be used by third party contractors on your network • Passive vendors audits should be part of your procurement process • Spam/phishing campaign monitoring can help you get ahead of the fallout
  • 27. © Anomali 2016 Confidential Questions?