SlideShare una empresa de Scribd logo

Global Cyber Threat Intelligence

•
•
NTT Innovation Institute Inc.
NTT Innovation Institute Inc.

Recently, NTT published the Global Threat Intelligence Report 2016 (GTIR). This year’s report focused both on the changes in threat trends and on how security organizations around the world can use the kill chain to help defend the enterprise. Turning threat intelligence data from multiple sources into actionable, contextual information is a challenge faced by many organizations today. The Global Threat Intelligence Platform provides increased efficiency, reduces risks and focuses on global coverage with accurate and up-to-date threat intelligence. This presentation was given at Carnegie Mellon University by Kenji Takahashi, VP of Product Management, Security at NTT Innovation Institute.

Tecnología
1 de 25
Descargar para leer sin conexión
Global Cyber Threat Intelligence Kenji Takahashi NTT Innovation Institute, Inc. 2016 Copyright NTT Innovation Institute, Inc. All rights reserved.
2 NTT i3 ACCELERATING THE TRANSFORMATION OF IDEAS FROM LAB TO MARKET Full Lifecycle Innovation FOCUS NTT Global Strategic Assets LEVERAGE Leading Companies and Startups ENGAGE INNOVATION Internet of Things Wearables Machine Learning MARKET-READY PLATFORMS Elastic Services Infrastructure Global Threat Intelligence Platform Cloud Service OrchestrationPlatform 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
3 THE EVOLVING GLOBAL SECURITY LANDSCAPE Cybercriminals • Large and sophisticated global crime groups • Black markets for stolen data, tool, and hacker talent • Detailed knowledge on targets (vulnerabilities, businesses, organizations and people) Enterprise Security Team • Technology vulnerability of IT • Largely reactive security practices • Limited data sources and analytic capabilities • Security skills gaps Threats and attacks generated by criminals outpace security team capabilities 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
4 THE GLOBAL THREATS LANDSCAPE IN 2016 Global Threat Intelligence Report 2016 (GTIR 2016) www.nttgroupsecurity.com Top 10 External Vulnerabilities Outdated PHP Version 8% Cross-Site Scripting (CSS/XSS) 7% Outdated Apache Web Server 7% SSL/TLS Information Disclosure 6% Web Clear Text Username/Password 5% Weak SSL/TLS Ciphers/Certificate 5% Outdated Apache Tomcat Server 4% Weak/No HTTPS cache policy 4% Cookie without HTTPOnly attribute set 3% SSL Certificate Signed using Weak Hashing Algorithm 3% Top 10 Internal Vulnerabilities Outdated Java Version 51% Outdated Adobe Flash Player 11% Outdated Adobe Reader and Acrobat 5% Outdated Microsoft Windows 3% Outdated Microsoft Internet Explorer 3% Outdated Mozilla Firefox 2% Outdated Microsoft Office 1% Outdated Linux Kernel 1% Outdated Novell Client 1% Outdated OpenSSH Version 1% The data presented is based on information gathered through 2015 Vulnerabilities 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
5 THE GLOBAL THREATS LANDSCAPE IN 2016 Attacks The data presented is based on information gathered through 2015 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
6 THE GLOBAL THREATS LANDSCAPE IN 2016 Incidents The data presented is based on information gathered through 2015 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
7 HACKING FOR PROFIT – THE JP MORGAN CYBERATTACK 100 million customers of 12 companies in the US 8 years of operation 2007-2015 $100Ms in illicit proceeds Global cybercrime network 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
8 RANSOM32: RANSOMWARE AS A SERVICE (source: http://blog.emsisoft.com/2016/01/01/meet-ransom32-the-first-javascript-ransomware/) 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
9 THE CYBERCRIME INFRASTRUCTURE OF BOTNETS • Consists of thousands of victimized computers (”nodes”) • Buy or rent tools, data, services, and talents on the cyber black market using bitcoins • Recycled in 30 – 90 day cycle 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
10 CYBER KILL CHAIN THE SEVEN PHASES OF A CYBER ATTACK *1: “Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains” by E. Hutchins, M. Cloppert, R. Amin, Lockheed Martin Corporation, 2011. http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf Cyber Kill Chain is a registered trademark of Lockheed Martin Corporation. RECONNAISSANCE WEAPONIZATION DELIVERY EXPLOITATION INSTALLATION COMMAND & CONTROL ACTIONS & OBJECTIVES 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
11 CYBER KILL CHAIN: CASE STUDY RECONNAISSANCE Recon, PHP and SQL fingerprinting 0 DELIVERY & Delivery of SQL injection via Havij tool & Exploitation of injection attack Command & Control Establish and maintain C2 WEAPONIZATION Recon data analyzed and Havij tool selected and configured for attack Creation of accounts and installation of RAT EXPLOITATION 46 53 58 51 55 ACTIONS & OBJECTIVES 0 6059 65 First Identified Log Public Disclosure Observed 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved. Data exfiltration INSTALLATION
12 CKC AS A GUIDELINE FOR THREAT INTELLIGENCE • Analysis of earlier phase provides threat intelligence for later phases • Attribution underpins the analysis of CKC phases § Victims § Capabilities § Resources § Objectives • Strategic priority and focus are essential § Systems, services, data, and people of importance
13 WHAT CONSTITUTE THREAT INTELLIGENCE Threat intelligence is gathered from disparate sources and synthesized by human analysts to identify a specific threat and its target in advance of an incident. 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
14 THREAT INTELLIGENCE EVOLVING SECURITY FROM REACTION TO PREDICTION A new approach to addressing global threats requires: 1 Creation of potential victim/target profiles 2 Prediction of threats based on the real-time analysis of a variety of data sources 3 Deployment of security control to monitor and block both predicted and existing threats 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
15 GLOBAL THREAT INTELLIGENCE PLATFORM • Single holistic view of the real-time evolution of the dynamic threat landscape • Global dataset of more than 18 million attacks gathered from a wide variety of sources, across geographical and organizational boundaries • Advanced analytics driven by machine learning (including malware taint analysis) • API for seamless integration into applications, services and systems • Support led by managed security service professionals 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
16 DEMO 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
CONTEXTUALIZATION Provide the “right” information best fit to user context • Context can be expressed by vertical industry, geographical region, CKC phases, attack type, victim profile, used resources (IP addresses, URLs/domains, malware, etc.) Enable users to formulate contextualized queries • Users can save and manage queries The information is further enriched • Gathering the data from multiple non threat sources • Put them into consistent format • Pivoting Facilitate collaboration among security experts • Annotation, Labeling 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved. 17
18 GTIP – MALWARE TAINT ANALYSIS ENGINE Dynamic data flow analysis by tracking down every movement of every bit of data by malware on a computer. Keep track of the trace of “tags” • Tags are identifiers placed on data, and are propagated as data moves inside computer, automatically tracking and identifying data provenance. BLACKLIST ANALYTICS ENGINE MALWARE BINARIES 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
19 IMPORTANT ISSUES FOR THE FUTURE OF CYBERSECURITY • Information Sharing • Big Data and Machine Learning for Malware and Traffic Analysis • Software Defined Security Orchestration 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
20 INFORMATION SHARING 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
21 MALWARE CLASSIFICATION BY MACHINE LEARNING Applying Machine Learning to both dynamic and static analysis • Features from execution in GTIP Malware Taint Analysis Engine (dynamic analysis) • Features extracted from raw files (static analysis) Preliminary experiments result in promising 98% accuracy • 4,000 malware files and 3,000 benign files • Windows binaries Same approach can be applied to other types of malware • Mobile (.apk), PDF, JavaScript, MS Office, etc. 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
TEMPORAL VISUALIZATION AND ANALYSIS • Different types of attacks and CKC phases show distinguishing temporal patterns. • By visualizing and analyzing the patterns, we are exploring a way of taking actions in an earlier, quicker and effective manner. SSH attacks access many targets in Reconnaissance phase A malware attacks accesses only one target in Exploitation phase 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved. 22
23 TRAFFIC ANALYSIS: BOTNET INFRASTRUCTURE DETECTION Network providers, vendors, and law enforcements could detect bot masters and their infrastructures by working together Information sharing and massively scalable analytics are the key • Streaming analytics • Machine learning ML outlier detection Black lists, DNS sink holes, Passive DNS, DNS Cache, Domain Generation Algorithm (DGA), Domain profiling, ML clustering Netflow analysis, Behavior analysis 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
24 BENDABLE NETWORKS: SOFTWARE DEFINED SECURITY ORCHESTRATION The integration of ESI and GTIP takes security operation integrity and agility to a new level. DEVICES GTIP + ESI SOURCES FW, IPS, IDS, SIEM… On-demand installation On-demand policy and configuration Detect Install and update SDN + NFV + Threat Intelligence BENDABLE NETWORKS
25 ACCELERATING THE TRANSFORMATION OF IDEAS FROM LAB TO MARKET h t t p : / / www. n t t i3 . co m h t t p s: / / t wit t e r. co m / n t t i3 h t t p s: / / www. lin ke d in . c o m / co m p a n y / n t t in n o va t io n i n st it u t e h t t p s: / / www. f a ce b o o k. co m / n t t in n o va t io n h t t p s: / / www. yo u t u b e . co m / u se r / NT Ti3 Ch a n n e l 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.

Recomendados

Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence WorkshopPriyanka Aash
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligenceseadeloitte
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligencemohamed nasri
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH
 
Cyber Threat Intelligence.pptx
Cyber Threat Intelligence.pptxCyber Threat Intelligence.pptx
Cyber Threat Intelligence.pptxAbimbolaFisher1
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 

Recomendados

Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence WorkshopPriyanka Aash
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligenceseadeloitte
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligencemohamed nasri
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH
 
Cyber Threat Intelligence.pptx
Cyber Threat Intelligence.pptxCyber Threat Intelligence.pptx
Cyber Threat Intelligence.pptxAbimbolaFisher1
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)Ahmed Ayman
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghOWASP Delhi
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence programMark Arena
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat IntelligencePrachi Mishra
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat IntelligenceMarlabs
 
Cyber threat intelligence ppt
Cyber threat intelligence pptCyber threat intelligence ppt
Cyber threat intelligence pptKumar Gaurav
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightDeep Shankar Yadav
 
Is Cyber Resilience Really That Difficult?
Is Cyber Resilience Really That Difficult?Is Cyber Resilience Really That Difficult?
Is Cyber Resilience Really That Difficult?John Gilligan
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Sqrrl
 
Sqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar UsersSqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar UsersSqrrl
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsIain Dickson
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation CenterS.E. CTS CERT-GOV-MD
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPrime Infoserv
 
NIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An OverviewNIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An OverviewTandhy Simanjuntak
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?Jonathan Sinclair
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
SIEM and Threat Hunting
SIEM and Threat HuntingSIEM and Threat Hunting
SIEM and Threat Huntingn|u - The Open Security Community
 
INCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSINCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSSylvain Martinez
 
How Data Analytics is Re-defining Modern Era in Cyber Security
How Data Analytics is Re-defining Modern Era in Cyber SecurityHow Data Analytics is Re-defining Modern Era in Cyber Security
How Data Analytics is Re-defining Modern Era in Cyber SecuritySaqib Chaudhry
 
Ciberseguridad en el mundo de la IA
Ciberseguridad en el mundo de la IACiberseguridad en el mundo de la IA
Ciberseguridad en el mundo de la IACristian Garcia G.
 

Más contenido relacionado

La actualidad más candente

Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)Ahmed Ayman
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghOWASP Delhi
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence programMark Arena
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat IntelligencePrachi Mishra
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat IntelligenceMarlabs
 
Cyber threat intelligence ppt
Cyber threat intelligence pptCyber threat intelligence ppt
Cyber threat intelligence pptKumar Gaurav
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightDeep Shankar Yadav
 
Is Cyber Resilience Really That Difficult?
Is Cyber Resilience Really That Difficult?Is Cyber Resilience Really That Difficult?
Is Cyber Resilience Really That Difficult?John Gilligan
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Sqrrl
 
Sqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar UsersSqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar UsersSqrrl
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsIain Dickson
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation CenterS.E. CTS CERT-GOV-MD
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPrime Infoserv
 
NIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An OverviewNIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An OverviewTandhy Simanjuntak
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?Jonathan Sinclair
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
INCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSINCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSSylvain Martinez
 

La actualidad más candente (20)

Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence program
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Cyber threat intelligence ppt
Cyber threat intelligence pptCyber threat intelligence ppt
Cyber threat intelligence ppt
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to Insight
 
Is Cyber Resilience Really That Difficult?
Is Cyber Resilience Really That Difficult?Is Cyber Resilience Really That Difficult?
Is Cyber Resilience Really That Difficult?
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)
 
Sqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar UsersSqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar Users
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security Solution
 
NIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An OverviewNIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An Overview
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
 
SIEM and Threat Hunting
SIEM and Threat HuntingSIEM and Threat Hunting
SIEM and Threat Hunting
 
INCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSINCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTS
 

Similar a Global Cyber Threat Intelligence

How Data Analytics is Re-defining Modern Era in Cyber Security
How Data Analytics is Re-defining Modern Era in Cyber SecurityHow Data Analytics is Re-defining Modern Era in Cyber Security
How Data Analytics is Re-defining Modern Era in Cyber SecuritySaqib Chaudhry
 
Ciberseguridad en el mundo de la IA
Ciberseguridad en el mundo de la IACiberseguridad en el mundo de la IA
Ciberseguridad en el mundo de la IACristian Garcia G.
 
Blueliv Corporate Brochure 2017
Blueliv Corporate Brochure 2017Blueliv Corporate Brochure 2017
Blueliv Corporate Brochure 2017Blueliv
 
Blueliv Corporate Brochure 2017
Blueliv Corporate Brochure 2017Blueliv Corporate Brochure 2017
Blueliv Corporate Brochure 2017Blueliv
 
Artificial Intelligence and Cybersecurity
Artificial Intelligence and CybersecurityArtificial Intelligence and Cybersecurity
Artificial Intelligence and CybersecurityOlivier Busolini
 
A Study on Honeypots and Deceiving Attacker using Modern Honeypot Network
A Study on Honeypots and Deceiving Attacker using Modern Honeypot NetworkA Study on Honeypots and Deceiving Attacker using Modern Honeypot Network
A Study on Honeypots and Deceiving Attacker using Modern Honeypot Networkijtsrd
 
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?Raffael Marty
 
NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018
NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018 NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018
NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018 NETSCOUT
 
Lessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
Lessons Learned Fighting Modern Cyberthreats in Critical ICS NetworksLessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
Lessons Learned Fighting Modern Cyberthreats in Critical ICS NetworksAngeloluca Barba
 
The malware monetization machine
The malware monetization machineThe malware monetization machine
The malware monetization machinePriyanka Aash
 
Open Source Insight: NotPetya Strikes, Patching Is Vital for Risk Management
Open Source Insight: NotPetya Strikes, Patching Is Vital for Risk ManagementOpen Source Insight: NotPetya Strikes, Patching Is Vital for Risk Management
Open Source Insight: NotPetya Strikes, Patching Is Vital for Risk ManagementBlack Duck by Synopsys
 
2016 - Cyber Security for the Public Sector
2016 - Cyber Security for the Public Sector2016 - Cyber Security for the Public Sector
2016 - Cyber Security for the Public SectorScott Geye
 
Cybercrime and Cybersecurity Governance: A Kenyan Perspective
Cybercrime and Cybersecurity Governance: A Kenyan PerspectiveCybercrime and Cybersecurity Governance: A Kenyan Perspective
Cybercrime and Cybersecurity Governance: A Kenyan PerspectiveIvan Sang
 
Evolución de la Ciber Seguridad
Evolución de la Ciber SeguridadEvolución de la Ciber Seguridad
Evolución de la Ciber SeguridadCristian Garcia G.
 
Failed Ransom: How IBM XGS Defeated Ransomware
Failed Ransom: How IBM XGS Defeated RansomwareFailed Ransom: How IBM XGS Defeated Ransomware
Failed Ransom: How IBM XGS Defeated RansomwareIBM Security
 
World best web apps security and Active detection of malicious link
World best web apps security and Active detection of malicious linkWorld best web apps security and Active detection of malicious link
World best web apps security and Active detection of malicious link임채호 박사님
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfssuser4237d4
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfssuser4237d4
 

Similar a Global Cyber Threat Intelligence (20)

How Data Analytics is Re-defining Modern Era in Cyber Security
How Data Analytics is Re-defining Modern Era in Cyber SecurityHow Data Analytics is Re-defining Modern Era in Cyber Security
How Data Analytics is Re-defining Modern Era in Cyber Security
 
Ciberseguridad en el mundo de la IA
Ciberseguridad en el mundo de la IACiberseguridad en el mundo de la IA
Ciberseguridad en el mundo de la IA
 
Blueliv Corporate Brochure 2017
Blueliv Corporate Brochure 2017Blueliv Corporate Brochure 2017
Blueliv Corporate Brochure 2017
 
Blueliv Corporate Brochure 2017
Blueliv Corporate Brochure 2017Blueliv Corporate Brochure 2017
Blueliv Corporate Brochure 2017
 
Artificial Intelligence and Cybersecurity
Artificial Intelligence and CybersecurityArtificial Intelligence and Cybersecurity
Artificial Intelligence and Cybersecurity
 
A Study on Honeypots and Deceiving Attacker using Modern Honeypot Network
A Study on Honeypots and Deceiving Attacker using Modern Honeypot NetworkA Study on Honeypots and Deceiving Attacker using Modern Honeypot Network
A Study on Honeypots and Deceiving Attacker using Modern Honeypot Network
 
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?
 
NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018
NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018 NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018
NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018
 
Lessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
Lessons Learned Fighting Modern Cyberthreats in Critical ICS NetworksLessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
Lessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
 
The malware monetization machine
The malware monetization machineThe malware monetization machine
The malware monetization machine
 
The artificial reality of cyber defense
The artificial reality of cyber defenseThe artificial reality of cyber defense
The artificial reality of cyber defense
 
Open Source Insight: NotPetya Strikes, Patching Is Vital for Risk Management
Open Source Insight: NotPetya Strikes, Patching Is Vital for Risk ManagementOpen Source Insight: NotPetya Strikes, Patching Is Vital for Risk Management
Open Source Insight: NotPetya Strikes, Patching Is Vital for Risk Management
 
2016 - Cyber Security for the Public Sector
2016 - Cyber Security for the Public Sector2016 - Cyber Security for the Public Sector
2016 - Cyber Security for the Public Sector
 
Cybercrime and Cybersecurity Governance: A Kenyan Perspective
Cybercrime and Cybersecurity Governance: A Kenyan PerspectiveCybercrime and Cybersecurity Governance: A Kenyan Perspective
Cybercrime and Cybersecurity Governance: A Kenyan Perspective
 
Evolución de la Ciber Seguridad
Evolución de la Ciber SeguridadEvolución de la Ciber Seguridad
Evolución de la Ciber Seguridad
 
Failed Ransom: How IBM XGS Defeated Ransomware
Failed Ransom: How IBM XGS Defeated RansomwareFailed Ransom: How IBM XGS Defeated Ransomware
Failed Ransom: How IBM XGS Defeated Ransomware
 
World best web apps security and Active detection of malicious link
World best web apps security and Active detection of malicious linkWorld best web apps security and Active detection of malicious link
World best web apps security and Active detection of malicious link
 
Security Industry Overview
Security Industry OverviewSecurity Industry Overview
Security Industry Overview
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdf
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdf
 

Más de NTT Innovation Institute Inc.

In Pursuit of Innovation: Curating the Culture of Ambitious Ideas, Rebellious...
In Pursuit of Innovation: Curating the Culture of Ambitious Ideas, Rebellious...In Pursuit of Innovation: Curating the Culture of Ambitious Ideas, Rebellious...
In Pursuit of Innovation: Curating the Culture of Ambitious Ideas, Rebellious...NTT Innovation Institute Inc.
 
2015 Global Threat Intelligence Report Executive Summary | NTT i3
2015 Global Threat Intelligence Report Executive Summary | NTT i32015 Global Threat Intelligence Report Executive Summary | NTT i3
2015 Global Threat Intelligence Report Executive Summary | NTT i3NTT Innovation Institute Inc.
 
NTT i3 Point of View: Network Infrastructure Elasticity
NTT i3 Point of View: Network Infrastructure ElasticityNTT i3 Point of View: Network Infrastructure Elasticity
NTT i3 Point of View: Network Infrastructure ElasticityNTT Innovation Institute Inc.
 

Más de NTT Innovation Institute Inc. (6)

In Pursuit of Innovation: Full Lifecycle Innovation
In Pursuit of Innovation: Full Lifecycle InnovationIn Pursuit of Innovation: Full Lifecycle Innovation
In Pursuit of Innovation: Full Lifecycle Innovation
 
In Pursuit of Innovation: Curating the Culture of Ambitious Ideas, Rebellious...
In Pursuit of Innovation: Curating the Culture of Ambitious Ideas, Rebellious...In Pursuit of Innovation: Curating the Culture of Ambitious Ideas, Rebellious...
In Pursuit of Innovation: Curating the Culture of Ambitious Ideas, Rebellious...
 
Cybercrime: Radically Rethinking the Global Threat
Cybercrime: Radically Rethinking the Global ThreatCybercrime: Radically Rethinking the Global Threat
Cybercrime: Radically Rethinking the Global Threat
 
2015 Global Threat Intelligence Report Executive Summary | NTT i3
2015 Global Threat Intelligence Report Executive Summary | NTT i32015 Global Threat Intelligence Report Executive Summary | NTT i3
2015 Global Threat Intelligence Report Executive Summary | NTT i3
 
NTT i3 at OpenStack Summit - May 20th, 2015
NTT i3 at OpenStack Summit - May 20th, 2015NTT i3 at OpenStack Summit - May 20th, 2015
NTT i3 at OpenStack Summit - May 20th, 2015
 
NTT i3 Point of View: Network Infrastructure Elasticity
NTT i3 Point of View: Network Infrastructure ElasticityNTT i3 Point of View: Network Infrastructure Elasticity
NTT i3 Point of View: Network Infrastructure Elasticity
 

Último

AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsMemoori
 
Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxhariprasad279825
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett
 
The Future of Software Development - Devin AI Innovative Approach.pdf
The Future of Software Development - Devin AI Innovative Approach.pdfThe Future of Software Development - Devin AI Innovative Approach.pdf
The Future of Software Development - Devin AI Innovative Approach.pdfSeasiaInfotech2
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr LapshynFwdays
 
My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024The Digital Insurer
 
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)Wonjun Hwang
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embeddingZilliz
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubKalema Edgar
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr BaganFwdays
 
Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Manik S Magar
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLScyllaDB
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge
 
CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):comworks
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 3652toLead Limited
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren
 

Último (20)

AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial Buildings
 
Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptx
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024
 
The Future of Software Development - Devin AI Innovative Approach.pdf
The Future of Software Development - Devin AI Innovative Approach.pdfThe Future of Software Development - Devin AI Innovative Approach.pdf
The Future of Software Development - Devin AI Innovative Approach.pdf
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
 
My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024
 
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL Certs
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embedding
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding Club
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan
 
Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQL
 
DMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special EditionDMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special Edition
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024
 
CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):CloudStudio User manual (basic edition):
CloudStudio User manual (basic edition):
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024
 

Global Cyber Threat Intelligence

  • 1. Global Cyber Threat Intelligence Kenji Takahashi NTT Innovation Institute, Inc. 2016 Copyright NTT Innovation Institute, Inc. All rights reserved.
  • 2. 2 NTT i3 ACCELERATING THE TRANSFORMATION OF IDEAS FROM LAB TO MARKET Full Lifecycle Innovation FOCUS NTT Global Strategic Assets LEVERAGE Leading Companies and Startups ENGAGE INNOVATION Internet of Things Wearables Machine Learning MARKET-READY PLATFORMS Elastic Services Infrastructure Global Threat Intelligence Platform Cloud Service OrchestrationPlatform 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 3. 3 THE EVOLVING GLOBAL SECURITY LANDSCAPE Cybercriminals • Large and sophisticated global crime groups • Black markets for stolen data, tool, and hacker talent • Detailed knowledge on targets (vulnerabilities, businesses, organizations and people) Enterprise Security Team • Technology vulnerability of IT • Largely reactive security practices • Limited data sources and analytic capabilities • Security skills gaps Threats and attacks generated by criminals outpace security team capabilities 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 4. 4 THE GLOBAL THREATS LANDSCAPE IN 2016 Global Threat Intelligence Report 2016 (GTIR 2016) www.nttgroupsecurity.com Top 10 External Vulnerabilities Outdated PHP Version 8% Cross-Site Scripting (CSS/XSS) 7% Outdated Apache Web Server 7% SSL/TLS Information Disclosure 6% Web Clear Text Username/Password 5% Weak SSL/TLS Ciphers/Certificate 5% Outdated Apache Tomcat Server 4% Weak/No HTTPS cache policy 4% Cookie without HTTPOnly attribute set 3% SSL Certificate Signed using Weak Hashing Algorithm 3% Top 10 Internal Vulnerabilities Outdated Java Version 51% Outdated Adobe Flash Player 11% Outdated Adobe Reader and Acrobat 5% Outdated Microsoft Windows 3% Outdated Microsoft Internet Explorer 3% Outdated Mozilla Firefox 2% Outdated Microsoft Office 1% Outdated Linux Kernel 1% Outdated Novell Client 1% Outdated OpenSSH Version 1% The data presented is based on information gathered through 2015 Vulnerabilities 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 5. 5 THE GLOBAL THREATS LANDSCAPE IN 2016 Attacks The data presented is based on information gathered through 2015 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 6. 6 THE GLOBAL THREATS LANDSCAPE IN 2016 Incidents The data presented is based on information gathered through 2015 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 7. 7 HACKING FOR PROFIT – THE JP MORGAN CYBERATTACK 100 million customers of 12 companies in the US 8 years of operation 2007-2015 $100Ms in illicit proceeds Global cybercrime network 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 8. 8 RANSOM32: RANSOMWARE AS A SERVICE (source: http://blog.emsisoft.com/2016/01/01/meet-ransom32-the-first-javascript-ransomware/) 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 9. 9 THE CYBERCRIME INFRASTRUCTURE OF BOTNETS • Consists of thousands of victimized computers (”nodes”) • Buy or rent tools, data, services, and talents on the cyber black market using bitcoins • Recycled in 30 – 90 day cycle 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 10. 10 CYBER KILL CHAIN THE SEVEN PHASES OF A CYBER ATTACK *1: “Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains” by E. Hutchins, M. Cloppert, R. Amin, Lockheed Martin Corporation, 2011. http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf Cyber Kill Chain is a registered trademark of Lockheed Martin Corporation. RECONNAISSANCE WEAPONIZATION DELIVERY EXPLOITATION INSTALLATION COMMAND & CONTROL ACTIONS & OBJECTIVES 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 11. 11 CYBER KILL CHAIN: CASE STUDY RECONNAISSANCE Recon, PHP and SQL fingerprinting 0 DELIVERY & Delivery of SQL injection via Havij tool & Exploitation of injection attack Command & Control Establish and maintain C2 WEAPONIZATION Recon data analyzed and Havij tool selected and configured for attack Creation of accounts and installation of RAT EXPLOITATION 46 53 58 51 55 ACTIONS & OBJECTIVES 0 6059 65 First Identified Log Public Disclosure Observed 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved. Data exfiltration INSTALLATION
  • 12. 12 CKC AS A GUIDELINE FOR THREAT INTELLIGENCE • Analysis of earlier phase provides threat intelligence for later phases • Attribution underpins the analysis of CKC phases § Victims § Capabilities § Resources § Objectives • Strategic priority and focus are essential § Systems, services, data, and people of importance
  • 13. 13 WHAT CONSTITUTE THREAT INTELLIGENCE Threat intelligence is gathered from disparate sources and synthesized by human analysts to identify a specific threat and its target in advance of an incident. 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 14. 14 THREAT INTELLIGENCE EVOLVING SECURITY FROM REACTION TO PREDICTION A new approach to addressing global threats requires: 1 Creation of potential victim/target profiles 2 Prediction of threats based on the real-time analysis of a variety of data sources 3 Deployment of security control to monitor and block both predicted and existing threats 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 15. 15 GLOBAL THREAT INTELLIGENCE PLATFORM • Single holistic view of the real-time evolution of the dynamic threat landscape • Global dataset of more than 18 million attacks gathered from a wide variety of sources, across geographical and organizational boundaries • Advanced analytics driven by machine learning (including malware taint analysis) • API for seamless integration into applications, services and systems • Support led by managed security service professionals 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 16. 16 DEMO 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 17. CONTEXTUALIZATION Provide the “right” information best fit to user context • Context can be expressed by vertical industry, geographical region, CKC phases, attack type, victim profile, used resources (IP addresses, URLs/domains, malware, etc.) Enable users to formulate contextualized queries • Users can save and manage queries The information is further enriched • Gathering the data from multiple non threat sources • Put them into consistent format • Pivoting Facilitate collaboration among security experts • Annotation, Labeling 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved. 17
  • 18. 18 GTIP – MALWARE TAINT ANALYSIS ENGINE Dynamic data flow analysis by tracking down every movement of every bit of data by malware on a computer. Keep track of the trace of “tags” • Tags are identifiers placed on data, and are propagated as data moves inside computer, automatically tracking and identifying data provenance. BLACKLIST ANALYTICS ENGINE MALWARE BINARIES 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 19. 19 IMPORTANT ISSUES FOR THE FUTURE OF CYBERSECURITY • Information Sharing • Big Data and Machine Learning for Malware and Traffic Analysis • Software Defined Security Orchestration 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 20. 20 INFORMATION SHARING 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 21. 21 MALWARE CLASSIFICATION BY MACHINE LEARNING Applying Machine Learning to both dynamic and static analysis • Features from execution in GTIP Malware Taint Analysis Engine (dynamic analysis) • Features extracted from raw files (static analysis) Preliminary experiments result in promising 98% accuracy • 4,000 malware files and 3,000 benign files • Windows binaries Same approach can be applied to other types of malware • Mobile (.apk), PDF, JavaScript, MS Office, etc. 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 22. TEMPORAL VISUALIZATION AND ANALYSIS • Different types of attacks and CKC phases show distinguishing temporal patterns. • By visualizing and analyzing the patterns, we are exploring a way of taking actions in an earlier, quicker and effective manner. SSH attacks access many targets in Reconnaissance phase A malware attacks accesses only one target in Exploitation phase 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved. 22
  • 23. 23 TRAFFIC ANALYSIS: BOTNET INFRASTRUCTURE DETECTION Network providers, vendors, and law enforcements could detect bot masters and their infrastructures by working together Information sharing and massively scalable analytics are the key • Streaming analytics • Machine learning ML outlier detection Black lists, DNS sink holes, Passive DNS, DNS Cache, Domain Generation Algorithm (DGA), Domain profiling, ML clustering Netflow analysis, Behavior analysis 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.
  • 24. 24 BENDABLE NETWORKS: SOFTWARE DEFINED SECURITY ORCHESTRATION The integration of ESI and GTIP takes security operation integrity and agility to a new level. DEVICES GTIP + ESI SOURCES FW, IPS, IDS, SIEM… On-demand installation On-demand policy and configuration Detect Install and update SDN + NFV + Threat Intelligence BENDABLE NETWORKS
  • 25. 25 ACCELERATING THE TRANSFORMATION OF IDEAS FROM LAB TO MARKET h t t p : / / www. n t t i3 . co m h t t p s: / / t wit t e r. co m / n t t i3 h t t p s: / / www. lin ke d in . c o m / co m p a n y / n t t in n o va t io n i n st it u t e h t t p s: / / www. f a ce b o o k. co m / n t t in n o va t io n h t t p s: / / www. yo u t u b e . co m / u se r / NT Ti3 Ch a n n e l 2016 CopyrightNTT Innovation Institute, Inc. All rights reserved.