In this episode,
we're going to talk about different collection methods that
you can utilize as ac Ys A analyst.
What you need to understand when it comes to collection methodology
is that it's not just about collecting information inside your network.
If all we did as analysts was grab as much
of the information coming into our network as humanly possible,
we really wouldn't have a good idea of what else is going on out there in the
web.
We wouldn't understand that, hey, this organization that closely allies to my own
has this type of attack that is constantly occurring or that this
thread over here is impacting other networks that could eventually impact my own
collection methodology really refers to the art of understanding, hey,
I need to collect different information from different sources.
So I have a bigger picture of the world around me.
So I'm better prepared to defend my network against different types of attacks.
We don't want this closed loop of information where all
we're gathering is information that's coming from our own network.
We need information from a lot of different sources
so that we can better protect ourselves and our
networks against different threat actors and the different threat
vectors that may challenge our specific network infrastructure.
The first type of collection methodology I want to talk about is open source,
open source methodologies are all those things that
you probably utilized throughout your entire career.
We're talking about the social media out there. Maybe it's Twitter or
a Facebook, it could be even
Etsy believe it or not different open source
and social media information come from various sources to
different blogs.
Uh It's not uncommon for people to get open source information.
Here's the problem with open source information though everybody knows about it,
including the threat actor.
So once we publish something that says, hey,
my network was attacked by this and be aware of it,
they could change what they're doing even a
slight minutia that would change the entire attack.
This poses problems to us as cybersecurity analysts because once
the threat actor knows that we're on their game,
they're going to change their,
their game a little bit to get around our protective measures.
So open source collection methodology,
while it's very valuable can also pose some problems with
the actual defense against that specific methodology as well.
There's also blogs where people write about it.
These are usually experts that write about a specific
uh attack vector or a different threat actor than
how their network or a network that they gained
privileged access to is associated to a specific attack.
The problem
with blogs as they're usually about a three or four days after the attack occurs.
So the information at best is three or four days old, at worst.
It's two or three months old and this could cause problems into what's going on.
There's all also government bulletins,
government bulletins from say FBI S um
in
guard systems,
they provide those bulletins to us on a weekly basis
or a monthly basis that tells us what's going on.
And if you're an Infra
Guard member, then you get access to those specific bulletins.
It's not just FB I's Infra
though there's CISA, there's other government bulletins that come out
and while they try their best to
associate those bulletins specifically to an organization,
some of them are very open source meaning again, threat actors have access to them.
And finally, there's the dark web,
the dark web is easy to access. Most people have it.
And even those people that are on the
dark web are constantly monitoring the different forums,
the different aspects of those same blogs or social media posts,
but they're just not provided on Facebook or Twitter.
They're on their own version of the dark web sphere.
Now, this could be a specific website that constantly changes or could be an old
website that people are still active on.
It doesn't really matter.
But that open source information with the dark web serves the same problem of
the information usually being old or the attacker has access to it anyway.
So dark web information, however,
does provide us a key look into what's going on
sometimes before the threat actor actually does the attack,
which is obviously quite well for us because it
gives us a different outlook into what's going on.
Then we have what's called closed source information.
These are usually paid fees that are put on by a specific security organization,
whether it's cloud flair or another organization that
does their own security vulnerability testing or research,
these paid fees usually fund that research.
Now, the great thing about closed feeds is most threat.
Actors aren't subscribing to those types of feeds.
And most closed source feeds have a specific
requirement of,
you have to have equipment or be a network that is reliable
and actually been validated before they provide those feeds to you.
Do those feeds sometimes end up in the general public. Absolutely.
Do they try their best not to make that happen again?
Yes,
paid fees provide us a pathway into a
specific research company that is providing the research
towards a vulnerability or a known exploit and
giving us the most up to date information
as it comes to bear.
They could have warnings or wars where they come out and say, hey,
we see this new vulnerability that's being exploited.
We don't have new information about it but be aware of it
that provides us a closed feed of information of an ongoing attack.
They like to do information sharing,
which provides us the most up to date information as it's coming by.
However,
this also poses the problem of not
being readily accessible or very thought through.
Meaning that while the
information is up to date, it's only the information they have access to,
which means sometimes it's a little off, it could be attacking, say port 443.
But on the back end,
we didn't realize there was a malware going into a
fact that caused that port to be vulnerable to attack.
All we may know is that, hey, something's happening on port 443,
we know that it's happening, but that's all the information we have.
However, some information is usually better than no information.
It usually comes also from internal sources.
For instance, if I have a firewall and I'm part of that vendor,
then that vendor may have their own security research and
they're sending out to everybody that owns their firewall.
The latest paid information that comes with that firewall.
This is great for us if you own the firewall.
But if you don't, sometimes you don't have access to it.
This would be a closed source information.
Now,
I'm going to show you a open source of information that you
have readily accessible to you as long as you sign up.
Let's take a look at that. Now,
this is OTX A
involves open source of threat identification.
I mean, it's a thread feed that is open source to anybody that signs up for it.
It didn't take much.
I signed up, it literally took two minutes and it gave me access to this information
you can see here right here. We have coin minor 7181.
Meaning that's the number of counts they've seen. And that we have a feature of one,
we can see related pulses associated with it on different websites.
For instance, CV e.org provides us one month ago
and it was modified 26 minutes ago by this person.
And it tells us the select like what's going on.
If I right click on this and open a new tab,
it brings me up to a new feature.
This feature goes on to tell me that, hey,
it's in reference to CBE 2024 meaning it's recent today
and it's the 32,000 version of that feed, I can copy that,
but I can also go down to a more relevant one.
If we scroll down to a historically, we can see all the way down
to 2022
and you get the point. It really goes down all the way. So this has been around
related to the CBE since as early as 20 probably 2021.
If I kept on scrolling, I can go all the way back here actually.
And you can see again 2021
right? So the most up to date information is going to be right here.
On the CBE 2024 32,000,
I can see the indicator of compromises and it tells me that the CV is 15,000.
It tells me other, the URL is associated with it
and then the domain as well. And it's only showing the last 10 entries.
If I scroll down,
I can see other information like the file hash associated with the specific one.
So if I see this on my network,
I can actually rule it out and go
through and identify anything associated with that specific.
Hash.
Again, I can go down to the more
recent information of 32,003
and you can see the related pulses.
If I go here,
I can look at the different comments that somebody that's already
associated with this specific feed has identified as part of this.
Now, comments are like anything else you have to take that with a grain of salt.
But sometimes it provides us some good information
by drop down.
We can see see link for Common Windows services update
and it provides me some link and some valuable information.
This is just an example of one threat feed that maybe you should subscribe to.
Uh but there's various ones out there, there's ones on Cloudflare,
there's other ones associated with sticks or taxi, those are more well known.
But for this one, Alienvault does a pretty good job in this episode.
We talked about open and closed source front feed and
what you should be aware of as a threat analyst
in your cys A exam,
you're going to be asked specific questions about whether
a feed is open source or closed source,
but it should be fairly high level.
You shouldn't see any direct questions about
paid feeds versus information sharing or internal sources
or even the different feeds that are
associated with open source versus closed source.
Most of your questions are going to be very rudimentary when
it comes to threat intelligence feeds and maybe why they're important.
Usually the answers are common sense to give you some
relation to this type of questions that you might see.
I would really understand that a closed source is paid feed.
It provides information sourcing and it's usually from internal sources,
usually from a vendor with open source feeds.
We're really talking about information that's
available freely on the internet and
it's shared across the different aspects of that specific threat feed.
You really need to understand that the big difference between a closed
source and open source feed and how they provide reliability versus subjectivity.
When it comes to those types of feeds,
you might see scenario based questions asking
specifically if a feed is closed source,
maybe it'll ask something like you paid for a feed and this feed provides you XY
and Z is this a closed source and open source or just a regular source?
You kind of get the picture,
I wouldn't expect to see any truly in depth questions when it
comes to cys A about open source or versus code source.
But I would expect to see some rudimentary high level questions and
why they may be important for you as a cybersecurity analyst.