In this episode, we're trying to cover a convergence of supply and
check technology and how supply chain impact what
you're trying to accomplish as a cybersecurity analyst,
both in a soc environment and as your organization as a whole.
We're also going to discuss tactics,
techniques and procedures and how malicious actors are
utilizing this framework in order to pull off
some of the more daring or intrinsic attacks
against a specific network or your enterprise environment.
Finally, we're going to discuss intelligence and
how threat intelligence impacts your trends and how
to safeguard your networks knowing that threat actors
are using that intelligence or using those actions
before they actually pull off the different attacks.
All of these combine or an assortment of different features
within the threat analysts that you need to be aware
of in order to properly secure your environment and your
network against those specific threat actors that we talked about.
In the last episode,
supply chain management affects how you're going
to utilize different equipment and where you source
equipment from both from an it standpoint,
as well as from a cybersecurity standpoint.
You need to be aware of that all supply chain is not created equally.
If you're buying servers off of ebay or maybe a third party vendor,
they could inject malware and change
the intrinsic capabilities of that specific hardware
in order to move forward against a malicious vector within your network.
That is to say if I'm buying a thirdparty
equipment from a vendor and even if it's Cisco or
LS
or some well known provider yet,
it's going through maybe a shady third party vendor.
It could have malicious activity embedded upon the firmware or even in the hardware
that you wouldn't otherwise be familiar with.
A lot of times we look at different third party vulnerabilities associated
specifically to that hardware based on where you source that equipment from
counterfeit software and hardware is often worked by those third party vendors
tell you from my own experience that we purchased
a different hardware that we thought was a Cisco equipment
and it had all the,
the markings on there and the serial numbers even had the
model number that was appropriate to a real piece of equipment.
But once you opened up that box,
you started to know some key differences and how
that information or how that hardware was laid out.
We later found out that that hardware has actually been infected with specific
malware associated with that firmware because
not only was the hardware counterfeit,
but so was the software,
the malicious actor was able to get
in there and change specific programs change different
complexities of that hardware that allowed them
to create a backdoor into that system.
Now, luckily,
we were able to find that out because some of the different key influences.
A part of that hardware kind of led us down that trail
to identify this as being counterfeit hardware associated with a known switch.
Because of that,
we were able to remove that from our network and then buy the appropriate
hardware off the supply chain manager.
Now that sounds like one of the once in a while things.
But I want you to picture this way back in the second Gulf War.
There were specific vendors that the United States military utilized
in order to move forward against specific terrorist organizations.
GPS and identification was brand new technology.
When it came to that,
people were starting to use digital cameras and
digital phones at the time to record their videos
and the United States military along with the CI A was able to then
use those pictures that imprinted a GPS LAT and long associated with that picture.
And then we're able to identify exactly where the picture
was taken when the terrorist organization published it online.
This is a form of supply chain management that was curtailed via an A ptie
in the United States government to produce those concepts that we needed to know.
Supply chain manipulation is another thing that you need to be
aware of supply chain manipulation happens when you've got a carrier
that moves products or services from one point to
another that may be intercepted along the route.
Meaning that if I have a piece of equipment that's say going from a known good vendor,
but it ends up in a warehouse somewhere that maybe a fraudulent
threat actor could go in and replace that piece of equipment with
a known bad piece of equipment or a piece of equipment that
they were able to inject malicious software into this happens on occasion.
It is rare but it does happen.
You just need to be aware of that.
From my first example, where we had supply chain management issues,
just be aware that all your equipment should have known good software,
known good hardware,
recognizable serial numbers and model numbers and correspond
with what you're getting from the actual vendor.
You don't want to use third party vendors when possible.
If I'm buying a piece of Cisco equipment, I need it to come from Cisco when possible.
Now that's not always possible, especially in lower end stuff or if you're buying a
used
server in those cases,
just be aware that there is a certain amount of threat that comes with
or a certain amount of,
of vulnerabilities that come from buying software
or hardware from a third party vendor,
especially if you can't 100% guarantee that that vendor is legit
TS techniques and procedures refer to the strategic goals,
methodologies and processes that a threat actor uses
in order to invade or exploit a network.
Strategic goals could encompass different aspects
of the actual goals of the threat actor.
We just talked about a pts and nation states and strip goodies in the last episode.
But what are their strategic goals if it's a specific crime organization,
their strategic goal to, could be to inject a network with ransomware
and then collect money from that ransomware? That's their goal, right.
But what is their strategic goal?
What is, how are they going to actually accomplish that task?
That's the methodology that comes into play.
A different methodology could be utilizing a PDF document or a
word document or some other document where the organization opens it,
they accidentally inject their system with malware that
now sets up a botnet within the field.
Their command and control system then sends down the pipeline to upload
a new malware form that then projects ransomware across not just that machine
but worms out into other machines. That would be their methodology.
And finally their process, the process could be the step
by step guide or execution of that specific technique.
ID step one, find out through social engineering,
how or who is responsible with administrative privileges within their network.
Step two, send them a spear phishing email, step three,
inject that spearphishing mail with a late
specific to malware or Injection of a specific
type of malware that will then open a communication process with our known servers.
Processes are just step by step directions that the threat actor could use
in order to pull off their overarching goal or methodology,
intelligence sources are broken up into reliability, credibility, accuracy,
timeliness, and of course, accessibility.
Now these all come into play. When it talks about actual intelligence sources,
I could have my intelligence come from a reliable or accurate source,
but the credibility may be very low.
What do I mean by credibility versus reliability?
Because I have a lot of students that kind of get intermingled or muddied.
When they start talking about this,
I can have a reliable source,
meaning that they're providing Intel on a weekly basis every Friday,
just like they're supposed to be.
However, the information they're providing me isn't actually credible,
meaning their 5050 hit ratio is pretty low.
I
you get reliable information from them,
meaning that the information is coming every Friday,
but the credibility could be that 5050 structure where,
yeah, some of it is really on target, but some of it isn't,
this is where credibility comes into play versus reliability.
Then we talk about accuracy.
How accurate is the information that they're giving us is that accuracy 100%?
Meaning that every time they give me data
and it's credible data, the accuracy is on point.
We know, hey,
they're gonna attack this IP address or this piece
of malware is directed to the specific system.
How accurate is the information they're actually giving me.
Then there's timeliness timeliness comes into play with how reliable or
how credible the information is coming in at a specific time.
Now, I just talked about that and I kind of moneyed up the waters,
but let's take it back in a further step
if I have credible information that's highly reliable,
but it was reliable and credible and accurate a year ago.
It does me no good now because it was over a year ago that it was actually
uh credible, meaning that the timeliness is completely off.
However, let's talk about a zero day attack.
If I'm getting credible, reliable information today,
that hasn't been released to the public or hasn't
been actually const considered out to a network.
That's very timely information.
However,
if my system has already been injected with the
malware and you're just now feeding me the information,
the timeliness is all off, it really doesn't make sense.
It's like, thanks for telling me something I already know.
And finally, there's accessibility of the information.
How accessible is the information? What do we mean by that?
Is sometimes the federal government or different government
organizations or threat intelligence organizations will send us information
or they knew about the information a week ago
and they're just now giving that to us now,
that kind of slews that line between timeliness versus accessibility.
But let's kind of break it out a little bit more by that.
They've given us the information, it's timely and the attack has in our system yet.
But we're not telling anybody else within our it and framework,
which means the co and maybe the director has it.
But the technicians don't because they're trying
to keep that information very type lit.
That means that the technicians that are working
on the information and hardening up our system,
they don't have access to the information, but we're fixing the problems.
That's where accessibility really comes into play.
Sometimes we get information at a high level and we have
to do things on our network that we don't really understand
the reasons why because management or the type level people that
have access to it aren't filtering that information down to us.
And the reason they're not doing that is because the attack could occur without
notice or maybe they're not entirely sure about the credibility or the accuracy.
Accessibility rec
comes into play of how accessible is the
information and how far is it getting passed down
to the line of where our technicians or the people that need it actually have it.
This can be from the company perspective all
the way down to the employee perspective.
This is where accessibility really comes into play.
Finally, let's talk about confidence levels within the chart.
Here,
you can see specific chart or framework that we utilize in different confidence
levels associated with intelligence or with the
information that's coming down the pipeline.
For instance, if our confidence level is zero,
we don't have a very good confidence level
that the information is accurate or reliable.
Or maybe it's not timely meaning that our confidence
level is very low on the flip side,
maybe we have a report of mouse
that's being developed on the dark web.
And we've seen past sources come from this or past information
from this source coming down the pipeline where it's highly reliable,
highly accurate and it's very time sensitive
meaning that we have a very high confidence level,
confidence level really is kind of a judgment call.
It's not all logic based,
but what you really need to understand about it is that we
need to utilize that in terms of a real world number.
When associated to an enterprise environment.
Sometimes we get intelligence that's unreliable,
but highly accurate and highly timely,
sometimes we get highly accurate information.
But the reliability is very low.
This is our confidence levels really come into play where
there's a different chart or flow that comes into it.
It's more of an art form than logic.
But just realize for cys A that you need to
understand that our confidence is either going to be low,
moderate or high.
And if I have a high confidence level, then I need to act on that information.
That does mean that I have low confidence in the information that I shouldn't act,
we may take predetermined levels.
But if I have high confidence levels,
I'm going to act before the low confidence levels on that same information.
Throughout this episode,
we talked about supply chain management and how
it can be utilized by malicious actors.
We talked about tactics,
techniques and procedures that malicious actors
can utilize across our enterprise environment.
And finally,
we talked about intelligence sources and
how intelligence sources interact with those.
Uh TT PS
for
CYSA, you need to have a high level overview and understanding of tactics,
techniques, procedures, supply chain and intelligence source.
You're going to see questions about scenario
based across different arcs of not only
confidence levels but how intelligence sources are
rated versus the reliability versus accuracy.
You should have a good breath of knowledge.
When it comes to high accuracy versus timeliness
versus the other concepts that we discuss.
You may get a scenario based question that says I have
highly accurate and reliable information,
but the trustworthiness of the information has been spotty in the past.
How would you rate your confidence level?
That would be expected question that you might see in one cys A,
you might also see a different question that
talks about confidence levels of being very low.
But then the information is highly reliable or very accurate.
This is where you kind of really have to shave that art form into logic and
really look at it from a perspective of an analyst in your real world position.
Like I said, there's no one tried and true reason to it.
There's a lot of art form associated with it,
but you should know the principles and use your judgment as best you can.
Most of the time the questions are gonna be very
slated in such a way that you can easily identify
whether it's a high confidence level versus a low confidence level
and where the accuracy versus timeliness versus reliability come into play.
If you can do that, you should be fine with the exam.