Welcome!

Agile Computing Authors: Carmen Gonzalez, Pat Romanski, Liz McMillan, Elizabeth White, William Schmarzo

Blog Feed Post

RSA 2013 – The Year of Threat Intelligence

The RSA conference this year was abuzz with talk of threat intelligence and its usage in detecting and protecting against more advanced threats. There was re-branding of existing products and the entrance of new products, all of which claimed to support some type of “intelligence” capability.  As I walked around it struck me that usage of the term was not consistent. We need to have a detailed understanding of what it means to use intelligence to secure our enterprise from cyber attacks, and maintain business operations in the face of sophisticated threats.

Recolored

Defining Threat Intelligence

In April of 2011, Cyber Squared defined Threat Intelligence as “an emerging information security discipline that seeks to recognize and understand sophisticated cyber adversaries, specifically why and how they threaten data, networks, and business processes.  With enhanced knowledge of the threat develop better protective measures against them.”  Not many companies would use the word “emerging” as it relates to their primary business, but we did, because at the time most clients were not yet worried about sophisticated threats, nor did they know how they would use threat intelligence to protect themselves from them.  Almost two years later and Threat Intelligence has now become a market within the broader security space.  For you skeptics that think it is yet another marketing term, don’t take my word for it.    SANS has sponsored a Summit on this single topic.

The Cyber Threat Intelligence Summit will be held in March.  I’ll be presenting a lightning round presentation on the topic of crowdsourcing threat intelligence, and Rich Barger, Cyber Squared’s Chief Intelligence Officer, will be participating on a panel.  This is such an important topic for the industry that SANS is putting on this event, and in doing so have started the process for an industry wide definition of Threat Intelligence.

Why is it needed

The Advanced Persistent Threat (APT) facing many modern networked organizations has rendered intrusion detection systems, anti-virus and traditional incident response approaches insufficient. The APT represents well-resourced and trained adversary’s who use advanced tools and techniques designed to circumvent most conventional computer network defense mechanisms. Their multi-year intrusion campaigns target highly sensitive and valuable data for competitive edge.

What is it

Network defense techniques that leverage knowledge about these adversaries – known as cyber threat intelligence – can enable defenders to establish a state of information superiority which decreases the adversary’s likelihood of success with each subsequent intrusion attempt. Threat intelligence can be a force multiplier and provide security managers accurate, timely and detailed information to continuously monitor new and evolving attacks. Earlier detection can minimize losses or disruption within the network, and lessen the cost of cleanup efforts.  With Threat Intelligence you can provide a more effective defensive posture then would be otherwise be possible.

Threat Intelligence Triangle

A Threat Intelligence Ecosystem can be broken down into the following basic functional areas: information collection and analysis, decision support, and mitigations.  All three must work in concert in order to keep pace with the threat.  So to make Threat Intelligence possible, we must connect the efforts of our decision makers with security personal, and provide them with a robust ability to leverage more comprehensive knowledge of their particular cyber threats. Taking the concept of a Threat Intelligence one step further. We must unite the efforts of the community around the threat, and crowdsource our need for threat intelligence. The Threat Intelligence Ecosystem is so much more knowledgeable and powerful than a single individual or organization.

How crowdsourcing can help

We know that responding quickly to cyber threats is of critical importance, and the only way to really change the game is to understand how the adversary works and predict where they might go next.  We realize that we can’t win this battle by fighting alone. While progress is being made to create and use Threat Intelligence within organizations, unfortunately today this is only possible with the more mature and resourced organizations.  It takes a significant investment to collect, create, enrich, and leverage Threat Intelligence, leaving less resourced businesses from protecting themselves in the same manner.  The adversary doesn’t discriminate between those organizations with and without resources.  The adversary  is targeting those who have sensitive and valuable data.

What if we applied the crowdsourcing model?   Applying a crowdsourcing approach to Threat Intelligence would involve being able to assemble an impromptu, virtual army of trusted cyber defenders to more quickly and comprehensively understand the threat and predict where they will go next.  It would require the ability to create dynamic relationships with trusted sharing partners who have common threat interests, and being able to register and receive notifications when threats change.  By transitioning today’s more static “sharing” model to a more dynamic “crowdsourcing” approach for Threat Intelligence, we could actually improve response times and predict attacks.  Furthermore, it is possible that an established, successful crowdsourcing Threat Intelligence solution could serve as a deterrent for cyber adversaries.  Benefits of crowdsourcing include:

  • Less time commitment to understand the threat
  • Lower costs to obtain a larger understanding of the threat
  • Obtain insights that would not be otherwise obvious
  • Connect with other stake holders who are also experiencing the same problem
  • Ability to track / measure the threat, effectively explaining and articulating the problem to decision makers

Based on established current day environmental factors, we should have at our disposal the necessary ingredients to create a successful crowdsourcing environment for threat intelligence.  For instance, the enormous popularity of social media has turned strangers into virtual friends.  Facebook’s “like” feature virtually binds people into a community via a common interest.  There is a growing awareness and acceptance of using crowdsourcing to solve problems.  We can bind these concepts into a crowdsourcing, internet-based solution for Threat Intelligence that includes rankings, statistics, and metrics to facilitate “co-ompetition”.

Conclusions

Unfortunately, there is going to be a great deal of confusion around Threat Intelligence for the foreseeable future.  Just remember that Threat Intelligence is not something you buy, it’s something you create.   You can streamline the process of building Threat Intelligence using security analysis products that support data feeds and crowdsourcing .  Please come out on March 22nd and see what I have to say about Crowdsourcing Threat Intelligence – the BIG (data) idea behind ThreatConnect.com.

Read the original blog entry...

More Stories By Adam Vincent

Adam is an internationally renowned information security expert and is currently the CEO and a founder at Cyber Squared Inc. He possesses over a decade of experience in programming, network security, penetration testing, cryptography design & cryptanalysis, identity and access control, and a detailed expertise in information security. The culmination of this knowledge has led to the company’s creation of ThreatConnect™, the first-of-its-kind threat intelligence platform. He currently serves as an advisor to multiple security-focused organizations and has provided consultation to numerous businesses ranging from start-ups to governments, Fortune 500 organizations, and top financial institutions. Adam holds an MS in computer science with graduate certifications in computer security and information assurance from George Washington University. Vincent lives in Arlington, VA with his wife, two children, and dog.

@ThingsExpo Stories
SYS-CON Events announced today that Hitachi, the leading provider the Internet of Things and Digital Transformation, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Hitachi Data Systems, a wholly owned subsidiary of Hitachi, Ltd., offers an integrated portfolio of services and solutions that enable digital transformation through enhanced data management, governance, mobility and analytics. We help globa...
The explosion of new web/cloud/IoT-based applications and the data they generate are transforming our world right before our eyes. In this rush to adopt these new technologies, organizations are often ignoring fundamental questions concerning who owns the data and failing to ask for permission to conduct invasive surveillance of their customers. Organizations that are not transparent about how their systems gather data telemetry without offering shared data ownership risk product rejection, regu...
SYS-CON Events announced today that SoftLayer, an IBM Company, has been named “Gold Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. SoftLayer, an IBM Company, provides cloud infrastructure as a service from a growing number of data centers and network points of presence around the world. SoftLayer’s customers range from Web startups to global enterprises.
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place June 6-8, 2017, at the Javits Center in New York City, New York, is co-located with 20th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry p...
SYS-CON Events announced today that Juniper Networks (NYSE: JNPR), an industry leader in automated, scalable and secure networks, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Juniper Networks challenges the status quo with products, solutions and services that transform the economics of networking. The company co-innovates with customers and partners to deliver automated, scalable and secure network...
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Busine...
Bert Loomis was a visionary. This general session will highlight how Bert Loomis and people like him inspire us to build great things with small inventions. In their general session at 19th Cloud Expo, Harold Hannon, Architect at IBM Bluemix, and Michael O'Neill, Strategic Business Development at Nvidia, discussed the accelerating pace of AI development and how IBM Cloud and NVIDIA are partnering to bring AI capabilities to "every day," on-demand. They also reviewed two "free infrastructure" pr...
SYS-CON Events announced today that T-Mobile will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. As America's Un-carrier, T-Mobile US, Inc., is redefining the way consumers and businesses buy wireless services through leading product and service innovation. The Company's advanced nationwide 4G LTE network delivers outstanding wireless experiences to 67.4 million customers who are unwilling to compromise on ...
SYS-CON Events announced today that Super Micro Computer, Inc., a global leader in compute, storage and networking technologies, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Supermicro (NASDAQ: SMCI), the leading innovator in high-performance, high-efficiency server technology, is a premier provider of advanced server Building Block Solutions® for Data Center, Cloud Computing, Enterprise IT, Hadoop/...
NHK, Japan Broadcasting, will feature the upcoming @ThingsExpo Silicon Valley in a special 'Internet of Things' and smart technology documentary that will be filmed on the expo floor between November 3 to 5, 2015, in Santa Clara. NHK is the sole public TV network in Japan equivalent to the BBC in the UK and the largest in Asia with many award-winning science and technology programs. Japanese TV is producing a documentary about IoT and Smart technology and will be covering @ThingsExpo Silicon Val...
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...
The 20th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held June 6-8, 2017, at the Javits Center in New York City, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal ...
The age of Digital Disruption is evolving into the next era – Digital Cohesion, an age in which applications securely self-assemble and deliver predictive services that continuously adapt to user behavior. Information from devices, sensors and applications around us will drive services seamlessly across mobile and fixed devices/infrastructure. This evolution is happening now in software defined services and secure networking. Four key drivers – Performance, Economics, Interoperability and Trust ...
SYS-CON Events announced today that CollabNet, a global leader in enterprise software development, release automation and DevOps solutions, will be a Bronze Sponsor of SYS-CON's 20th International Cloud Expo®, taking place from June 6-8, 2017, at the Javits Center in New York City, NY. CollabNet offers a broad range of solutions with the mission of helping modern organizations deliver quality software at speed. The company’s latest innovation, the DevOps Lifecycle Manager (DLM), supports Value S...
With billions of sensors deployed worldwide, the amount of machine-generated data will soon exceed what our networks can handle. But consumers and businesses will expect seamless experiences and real-time responsiveness. What does this mean for IoT devices and the infrastructure that supports them? More of the data will need to be handled at - or closer to - the devices themselves.
Web Real-Time Communication APIs have quickly revolutionized what browsers are capable of. In addition to video and audio streams, we can now bi-directionally send arbitrary data over WebRTC's PeerConnection Data Channels. With the advent of Progressive Web Apps and new hardware APIs such as WebBluetooh and WebUSB, we can finally enable users to stitch together the Internet of Things directly from their browsers while communicating privately and securely in a decentralized way.
In his keynote at @ThingsExpo, Chris Matthieu, Director of IoT Engineering at Citrix and co-founder and CTO of Octoblu, focused on building an IoT platform and company. He provided a behind-the-scenes look at Octoblu’s platform, business, and pivots along the way (including the Citrix acquisition of Octoblu).
Multiple data types are pouring into IoT deployments. Data is coming in small packages as well as enormous files and data streams of many sizes. Widespread use of mobile devices adds to the total. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will look at the tools and environments that are being put to use in IoT deployments, as well as the team skills a modern enterprise IT shop needs to keep things running, get a handle on all this data, and deli...
Grape Up is a software company, specialized in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market across the USA and Europe, we work with a variety of customers from emerging startups to Fortune 1000 companies.
Financial Technology has become a topic of intense interest throughout the cloud developer and enterprise IT communities. Accordingly, attendees at the upcoming 20th Cloud Expo at the Javits Center in New York, June 6-8, 2017, will find fresh new content in a new track called FinTech.