Cyber Threat Intelligence
•
14 j'aime•7,589 vues
Build a Cyber Threat Intelligence with Big Security Data
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
En vedette (20)
Similaire à Cyber Threat Intelligence
Similaire à Cyber Threat Intelligence (20)
Dernier
Dernier (20)
Cyber Threat Intelligence
- 1. CYBER THREAT INTELLIGENCE Mohamed NASRI Cyber Intelligence Analyst Securiday 2015 Big Data Security 1
- 5. 5
- 7. 2010 7
- 9. Securiday 2015 Big Data Security 9 08-09 April 2015 From 22h to 1h
- 10. THREAT-BASED DEFENSE STRATEGY 10 # If you know your enemy and know yourself you need not fear the result of 100 battles Sun Tzu “The art of war”
- 11. Cyber-attack life cycle Model « Kill Chain » Lockheed Martin’s 2010. 11
- 12. Courses of action Matrix 12
- 13. 13
- 14. THREAT INTELLIGENCE STANDARD AND TOOLS Securiday 2015 Big Data Security 14
- 15. Structured Threat Information eXpression • Language to represent structured cyber threat indicators
- 16. With What is Cyber ThreatIntelligence? Consider these questions: What activity are we seeing? What threats should I look for on my networks and systems and why? Where has this threat been seen? What does it do? What weaknesses does this threat exploit? Why does it do this? Who is responsible for this threat? What can I do about it?
- 17. Architecture
- 18. Use Cases
- 19. 19
- 20. SHARE 20 # My detection becomes your prevention
- 21. 21
- 22. TrustedAutomatedeXchangeofIndicatorInformation • Standardizes exchange of cyber threat information
- 26. SIEM • « SIEM is Dead! » John Linkous 2012 • « Don’t Stretch SIEM Beyond its Capabilities for Contextual Security Analytics » Jody Ma Kissling 2015 26
- 27. Securiday 2015 Big Data Security 27 Vendor specific intel SIEM Preventive Detective Fusion Host Controls IDS AV IPS Network Controls Web Content Gateway IPS IDS Automated defense threat intelligence to augment Security
- 28. Securiday 2015 Big Data Security 28 OS-Intelligence Threat Collector Preventive Detective Fusion Contextuel Host Controls IDS AV IPS Network Controls Web Content Gateway IPS IDS SIEM Contextuel Information Vulnerability Scanner Sandbox Cyber Threat Analyst
- 29. Securiday 2015 Big Data Security 29 OS-Intelligence Threat Collector Preventive Detective Fusion Contextuel Actuator Host Controls IDS AV IPS Network Controls Web Content Gateway IPS IDS SIEM Contextuel Information Vulnerability Scanner Sandbox Cyber Threat Analyst Actuator Network isolation script Ticketing System Workflow
- 30. Polyglot Persistence Martin Fowler 2011 RDBMS Horizontal scalability Data consistency 30
- 32. Merci de votre attention 32