Click here to close now.




















Welcome!

Agile Computing Authors: Liz McMillan, Dana Gardner, Kevin Benedict, SmartBear Blog, Adrian Bridgwater

Related Topics: Agile Computing

Agile Computing: Blog Post

Getting Back to the Basics of Actionable Threat Intelligence

Shoot, move and communicate more effectively

I remember it like it was yesterday, the first few hours of basic training. I stood there cooking in the South Carolina humidity with a very loud and short man, named Drill Sergeant Doll screaming a few inches from my ear, "You need to shoot, move and communicate!" At the time, I had absolutely no clue what he was talking about. However, over the course of a few weeks I would start to understand that these would be the basic skills I needed to successfully complete my training.

Later, I would learn that these three skills needed to be honed together and each soldier would eventually take what they learned and apply it under the pressure of a live fire exercise. This would test our ability to work as a team, each soldier required to direct precise suppressing fire, moving swiftly in alternating bounding movements towards an objective all while communicating with one another, taking care not to shoot a fellow team member. "Shoot, Move, and Communicate" became the cornerstone of our military training.

We see communication as a vital attribute underpinning much of what we do as a community on a daily basis. We communicate within our circle of influence, within and across our organizations, as well as with external parties or even autonomous machines. Communication is what builds interpersonal relationships and is what allows us to draw upon a larger community that then becomes a countermeasure, which can be organized and wielded against modern threats.

Teamwork Makes the Dream Work
Not unlike training for and conducting conventional combat, neutralizing asymmetric cyber threats requires some of the same basic teamwork skills. The njRAT infrastructure takedown operation conducted by Microsoft this week has been nothing short of controversial. If you shoot and move but fail to communicate, the result often means someone is going to get hurt. The unilateral takedown has served its purpose of impacting the attackers, but has also negatively effected all the stakeholders, such as Microsoft,  Vitalwerks (NO-IP), and its users alike.

While this is a highly complex example, the anatomy of the problem is disguised behind a two-front war, and as we look closer, the Microsoft takedown illuminates some of the problems we face today. Certainly there are the obvious technical challenges that the threats pose, but those are largely dwarfed in comparison to the interpersonal, social and cultural issues we have with one another, our individual motivations, as well as how and why we choose to communicate. The fallout between Microsoft and Vitalwerks (NO-IP) is a strategic inflection point within a decade old industry that seemingly fumbles every time one of us gets the ball.

There are many viewpoints, both for and against the actions Microsoft took, that have been posted on blogs, discussed on mailing lists and questioned in the news. Like trying to solve any challenge faced on a global scale, pulling one lever will undoubtedly move three or four somewhere else, triggering unforeseen consequences, in many cases becoming the new focal point and problem. As an industry, we need to become more situationally aware and selfless. We cannot continue to go at it alone, nor should we try. Unity is our strength. The sooner we all recognize this, the more effective we will be in dealing with common adversaries.

Solution Focused vs. Problem Focused
We specifically engineered ThreatConnect to be the enterprise solution that allows the security community to cross the chasm that exists between the technical and non-technical security challenges we face today. ThreatConnect was created with the intention of giving anyone the ability to easily develop and control their own threat intelligence by aggregating data from any source they deemed of value, allowing them to analyze and dynamically enrich contextualized indicators over time with the ability to communicate their findings in a controlled and trusted manner.

This flexibility gives analysts and network defense personnel the precision that is needed to accurately focus in on specific indicator types of interest and effectively manage their knowledge and pool resources. When it comes time to operationalize the information and coordinate their neutralization, there are capabilities to communicate around the data, intent to convey and actions to coordinate in order to minimize the risk of uninformed stakeholders and unintended consequences.

No Excuses
In today's highly connected world, there should be no excuse for breakdowns in communication when conducting such important and delicate operations as infrastructure takedowns. As of late April 2014, ThreatConnect has been sponsoring a free private ThreatConnect Community, proactively reaching out to service providers who are victims of abuse and wish to actively contribute resources to support coordinated takedown operations.

This emerging community is populated with vetted individuals and organizations within enterprise security teams, dynamic DNS providers and domain registrars. The goal is to deliver a platform and environment in which all stakeholders can easily come together and adopt a selfless attitude, and then deliver results for the common interest of our users and customers.

On a daily basis, the ThreatConnect Intelligence Research Team (TCIRT) leverages ThreatConnect to effectively share information and collaborate with large organizations, such as Microsoft and small to medium sized organizations, like Vitalwerks (NO-IP), so they are able to act on information in a coordinated manner. We do this because it is the right thing to do and the best way to do it.

If you or your organization is interested in participating in this community or others in ThreatConnect, register for a free basic account and get started, so you can do your part and enter into a community which will allow you to shoot, move, and communicate more effectively.

More Stories By Rich Barger

Rich is the Chief Intelligence Officer for Cyber Squared and the ThreatConnect Intelligence Research Team (TCIRT) Director. Rich has over 17 years of experience supporting the commercial sector, defense industry, and intelligence community with threat intelligence and computer network operations. Rich is a passionate and creative thought leader that has led talented teams of researchers in producing quality analysis and actionable intelligence. After his commitment to the United States Army, Rich has supported the U.S. Army Command and Control Support Agency, the U.S. Army 1st Information Operations Command, the Joint Task Force Global Network Operations, and the NSA/CSS Threat Operations Center. Rich possesses a variety of industry certifications and a BS in Information Systems Security with Honors from American Military University.

@ThingsExpo Stories
The Internet of Everything (IoE) brings together people, process, data and things to make networked connections more relevant and valuable than ever before – transforming information into knowledge and knowledge into wisdom. IoE creates new capabilities, richer experiences, and unprecedented opportunities to improve business and government operations, decision making and mission support capabilities.
The Internet of Things is not only adding billions of sensors and billions of terabytes to the Internet. It is also forcing a fundamental change in the way we envision Information Technology. For the first time, more data is being created by devices at the edge of the Internet rather than from centralized systems. What does this mean for today's IT professional? In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists addressed this very serious issue of profound change in the industry.
Discussions about cloud computing are evolving into discussions about enterprise IT in general. As enterprises increasingly migrate toward their own unique clouds, new issues such as the use of containers and microservices emerge to keep things interesting. In this Power Panel at 16th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists addressed the state of cloud computing today, and what enterprise IT professionals need to know about how the latest topics and trends affect their organization.
SYS-CON Events announced today that HPM Networks will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. For 20 years, HPM Networks has been integrating technology solutions that solve complex business challenges. HPM Networks has designed solutions for both SMB and enterprise customers throughout the San Francisco Bay Area.
For IoT to grow as quickly as analyst firms’ project, a lot is going to fall on developers to quickly bring applications to market. But the lack of a standard development platform threatens to slow growth and make application development more time consuming and costly, much like we’ve seen in the mobile space. In his session at @ThingsExpo, Mike Weiner, Product Manager of the Omega DevCloud with KORE Telematics Inc., discussed the evolving requirements for developers as IoT matures and conducted a live demonstration of how quickly application development can happen when the need to comply wit...
Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an Internet of Things implementation? In his session at @ThingsExpo, James Kirkland, Red Hat's Chief Architect for the Internet of Things and Intelligent Systems, described how to revolutionize your archit...
It is one thing to build single industrial IoT applications, but what will it take to build the Smart Cities and truly society-changing applications of the future? The technology won’t be the problem, it will be the number of parties that need to work together and be aligned in their motivation to succeed. In his session at @ThingsExpo, Jason Mondanaro, Director, Product Management at Metanga, discussed how you can plan to cooperate, partner, and form lasting all-star teams to change the world and it starts with business models and monetization strategies.
Converging digital disruptions is creating a major sea change - Cisco calls this the Internet of Everything (IoE). IoE is the network connection of People, Process, Data and Things, fueled by Cloud, Mobile, Social, Analytics and Security, and it represents a $19Trillion value-at-stake over the next 10 years. In her keynote at @ThingsExpo, Manjula Talreja, VP of Cisco Consulting Services, discussed IoE and the enormous opportunities it provides to public and private firms alike. She will share what businesses must do to thrive in the IoE economy, citing examples from several industry sectors.
Growth hacking is common for startups to make unheard-of progress in building their business. Career Hacks can help Geek Girls and those who support them (yes, that's you too, Dad!) to excel in this typically male-dominated world. Get ready to learn the facts: Is there a bias against women in the tech / developer communities? Why are women 50% of the workforce, but hold only 24% of the STEM or IT positions? Some beginnings of what to do about it! In her Opening Keynote at 16th Cloud Expo, Sandy Carter, IBM General Manager Cloud Ecosystem and Developers, and a Social Business Evangelist, d...
There will be 150 billion connected devices by 2020. New digital businesses have already disrupted value chains across every industry. APIs are at the center of the digital business. You need to understand what assets you have that can be exposed digitally, what their digital value chain is, and how to create an effective business model around that value chain to compete in this economy. No enterprise can be complacent and not engage in the digital economy. Learn how to be the disruptor and not the disruptee.
Akana has released Envision, an enhanced API analytics platform that helps enterprises mine critical insights across their digital eco-systems, understand their customers and partners and offer value-added personalized services. “In today’s digital economy, data-driven insights are proving to be a key differentiator for businesses. Understanding the data that is being tunneled through their APIs and how it can be used to optimize their business and operations is of paramount importance,” said Alistair Farquharson, CTO of Akana.
Business as usual for IT is evolving into a "Make or Buy" decision on a service-by-service conversation with input from the LOBs. How does your organization move forward with cloud? In his general session at 16th Cloud Expo, Paul Maravei, Regional Sales Manager, Hybrid Cloud and Managed Services at Cisco, discusses how Cisco and its partners offer a market-leading portfolio and ecosystem of cloud infrastructure and application services that allow you to uniquely and securely combine cloud business applications and services across multiple cloud delivery models.
The enterprise market will drive IoT device adoption over the next five years. In his session at @ThingsExpo, John Greenough, an analyst at BI Intelligence, division of Business Insider, analyzed how companies will adopt IoT products and the associated cost of adopting those products. John Greenough is the lead analyst covering the Internet of Things for BI Intelligence- Business Insider’s paid research service. Numerous IoT companies have cited his analysis of the IoT. Prior to joining BI Intelligence, he worked analyzing bank technology for Corporate Insight and The Clearing House Payment...
In his keynote at 16th Cloud Expo, Rodney Rogers, CEO of Virtustream, discussed the evolution of the company from inception to its recent acquisition by EMC – including personal insights, lessons learned (and some WTF moments) along the way. Learn how Virtustream’s unique approach of combining the economics and elasticity of the consumer cloud model with proper performance, application automation and security into a platform became a breakout success with enterprise customers and a natural fit for the EMC Federation.
"Optimal Design is a technology integration and product development firm that specializes in connecting devices to the cloud," stated Joe Wascow, Co-Founder & CMO of Optimal Design, in this SYS-CON.tv interview at @ThingsExpo, held June 9-11, 2015, at the Javits Center in New York City.
SYS-CON Events announced today that CommVault has been named “Bronze Sponsor” of SYS-CON's 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. A singular vision – a belief in a better way to address current and future data management needs – guides CommVault in the development of Singular Information Management® solutions for high-performance data protection, universal availability and simplified management of data on complex storage networks. CommVault's exclusive single-platform architecture gives companies unp...
Electric Cloud and Arynga have announced a product integration partnership that will bring Continuous Delivery solutions to the automotive Internet-of-Things (IoT) market. The joint solution will help automotive manufacturers, OEMs and system integrators adopt DevOps automation and Continuous Delivery practices that reduce software build and release cycle times within the complex and specific parameters of embedded and IoT software systems.
"ciqada is a combined platform of hardware modules and server products that lets people take their existing devices or new devices and lets them be accessible over the Internet for their users," noted Geoff Engelstein of ciqada, a division of Mars International, in this SYS-CON.tv interview at @ThingsExpo, held June 9-11, 2015, at the Javits Center in New York City.
Internet of Things is moving from being a hype to a reality. Experts estimate that internet connected cars will grow to 152 million, while over 100 million internet connected wireless light bulbs and lamps will be operational by 2020. These and many other intriguing statistics highlight the importance of Internet powered devices and how market penetration is going to multiply many times over in the next few years.
SYS-CON Events announced today that Dyn, the worldwide leader in Internet Performance, will exhibit at SYS-CON's 17th International Cloud Expo®, which will take place on November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Dyn is a cloud-based Internet Performance company. Dyn helps companies monitor, control, and optimize online infrastructure for an exceptional end-user experience. Through a world-class network and unrivaled, objective intelligence into Internet conditions, Dyn ensures traffic gets delivered faster, safer, and more reliably than ever.