- In this lesson 5.2,
we're gonna be talking about threat modeling
and threat intelligence.
The threat modeling is a very structured process
by which we identify potential threats
as well as threat actors.
So we identify them, we enumerate them,
and we can prioritize them.
So what makes for a successful attack?
Well, motivation, talent, work factor,
meaning time and resources, patience, evasion, capability,
and sometimes just luck
really all contribute to a successful attack.
Work factor being the time, the effort,
and the resources necessary for the attacker
to successfully achieve their objective.
But it's really important that we understand
all of the components that go into
making an attacker successful.
It's not just that we have a vulnerability or a weakness
they also have to have a whole list of things.
Again, motivation, talent, work factor,
patience, ovation, capabilities, and sometimes luck.
But by doing threat modeling,
we can get some insight right into what they need
to really complete a successful attack.
Now, there are three approaches to threat modeling,
asset centric, architecture centric, and attacker centric.
And what I find is that most organizations
intuitively take all three of these approaches
and could mesh it into a hybrid approach.
So here we are thinking about, right, who might attack us?
What attacks? What threats do we have?
What potential dangers in our organization?
Asset centric threat modeling really approaches on
kind of what do we have
that someone would want and why would they want it?
So we're really looking to identify
our valued assets and the motivation of someone
who might come after those assets.
In architecture centric, we're looking at the how, right?
How they might be able to attack us.
And what we're really doing here,
is identifying system design components,
strengths and weaknesses.
So for example, if I have a web server, right?
And I'm running Apache and WordPress,
I wanna know what were the weaknesses in Apache,
what were the weaknesses in WordPress, right?
That my attacker may attempt to exploit?
And third is attacker centric,
which is, who am I wanna come after me?
So we're identifying the adversaries.
So by doing asset centric, architecture centric,
and attacker centric, right?
We're answering the question
what might they wanna come after and why?
How might they do it and who are they?
So how do we learn about our potential attackers?
That's where threat intelligence comes in.
Threat intelligence is evidence-based knowledge
about emerging threats that can be used to inform
our control decisions.
But it's not just raw data, right?
We really wanna make sure that our threat intelligence
is usable.
So useful threat intelligence is aggregated,
analyzed, assessed, and actionable.
Aggregated from reliable sources
and cross correlated for accuracy,
analyzed by trained specialist,
assessed for relevancy to our organization,
and actionable
meaning can I do something with this information?
Now, actionable threat intelligence
will often include contacts, mechanisms,
indicators, implications,
and response and remediation advice.
So what are some sources of threat intelligence?
Well, we can get threat intelligence
from technology vendors from cyber security companies
from journalists, researchers, and thought leaders
as well as a whole pantheon of of government agencies.
So with our technology vendors,
many of them will have subscription or public feeds
provided by vendors such as Microsoft or Cisco or Apple.
Cybersecurity companies have subscriptions
and or public feeds
provided by the vendors such as TylerDetect
or AlienVault, FireEye, RSA, and SecureWorks.
And then there's some awesome journalists,
researchers, and thought leaders.
Bruce Schneider, Jeremiah Grossman, Brian Krebs
who has a fabulous blog called Krebs on Security,
Mark Russinovich, Kim Zetter, Nicole Periroth,
Andy Greenberg, and Ellen Nakashima.
All excellent journalists, researchers, thought leaders.
They're almost all on Twitter.
You can follow them on Twitter.
Again, some of them have blogs like Krebs on Security,
definitely, definitely worth following them.
And then government agencies.
And this is data provided by agencies such as NIST,
the National Institute of Standards and Technology,
the FBI, US-CERT, NVD
which is the National Vulnerability Database,
MITRE and my new personal favorite,
which is a Cybersecurity and Infrastructure Agency
known as CISA.
And I'll talk about that one in just a moment.
Now, another place to get threat intelligence
is through open source sources.
Now, open source intelligence known as OSINT,
is a term used to refer to data collected
from publicly available sources
to be used in an intelligence context.
Now, there's an excellent framework
that you wanna become familiar with
called the OSINT framework,
which is a structured collection of OSINT tools.
And the OSINT framework is organized by topic and goals.
And it presents itself in a really cool tree form
that allows you to browse different OSINT tools
filtered by category.
So how do you get to it?
If you go out to osintframework.com
definitely put that on your list.
You wanna really become familiar there are lots
of great information
and some really fantastic open source tools
that you can use.
So let's circle back to CISA.
You haven't been out to the CISA website.
You definitely wanna get out there www.cisa, C-I-S-A.gov.
CISA is America's Cyber Defense Agency.
It's a cybersecurity and infrastructure security agency
and they have just an incredible wealth of information.
There are advisories, there are news and events,
there are resources, there are actions
that are being spotlighted.
CISA interacts with a lot of other agencies
and so they pull in information from other agencies as well.
So this should be a bookmark for you.
This should be a place that you visit on a regular basis
to get some really excellent information
about what's going on, not just in in America
but really what's going on worldwide.
So definitely bookmark that, www.cisa.gov.
And that my friends, brings us to a three second challenge.
Five challenge questions, three seconds each.
You know how to do it.
Threat model that focuses on system design.
Remember we talked about three different approaches.
This one focuses on system design.
One, two, three.
It's gonna be architecture centric.
Number two, the threat model that focuses on who?
One, two, three. That's attacker centric.
Number three, the US government agency
charged with working with government
and industry to identify, analyze, prioritize and manage
the most significant cybersecurity strategic risks
to the nation's critical infrastructure.
Now, I didn't give you all that when we looked at it
but I said this is the one you really wanna get to know.
Who is it? One, two, three.
That's gonna be the Cybersecurity
and Infrastructure Security Agency known as CISA.
Question four, evidence-based knowledge
about an emerging threat.
One, two, three.
There's threat intelligence. Fantastic.
And number five, data collected
from publicly available sources
to be used in an intelligence context.
One, two, three.
That's open source intelligence known as OSINT.
So let's do a security
and action together about threat modeling.
You've been asked to guide your department
through a threat modeling exercise.
Now, this is the first time the department has done this
and you are recommending a hybrid approach.
So I want you to describe your approach to me
and resources that you might use.
Go ahead, put me on pause, jot down some notes,
then come back and we'll talk about the approach.
Well, a hybrid approach to threat modeling
focuses on assets, architecture, and attackers, right?
And it asks the following questions
what do we have of value?
That's our asset centric.
How would we be attacked? That's our architecture centric.
And who are our likely attackers?
That's our attacker centric.
Now, our resources could include a variety of OSINT,
government sources, researchers, journalists,
thought leaders, and vendors.
So there's a lot of places for us to get information
to feed into our threat modeling process.
But I really like the idea of starting
with a hybrid approach,
because then you can sort of pull from all areas, right?
What do we have of value?
Who might be attacked?
What are our likely attackers?
And I guarantee it will result
in a very robust conversation.
So being able to lead this exercise,
that my friends for sure is security in action.
So that brings us to our word club.
You know what to do.
You wanna go through all of these terms,
make sure that you're comfortable and confident
before moving on.
And speaking of moving on, what are we gonna do next?
Well, let's do a quiz together.
See you there.