Cyber threat intelligence software
Cyber threat intelligence software: How to choose the right CTI tools for your business
Get to know the ins and outs of cyber threat intelligence and how your company's security can be can be strengthened by putting threat intelligence into place.
Cyber threat intelligence (CTI) is a concept that is crucial to the security of corporate networks, yet it can be difficult to really understand the ideas behind it, not to mention the implementation of threat intelligence within the company’s IT and security structures. This guide defines what it is, how it works and how to implement a few free solutions that really make a difference for your security.
- What exactly is a threat?
- What is cyber threat intelligence?
- Intelligence cycle
- CTI steps
- Who can benefit from CTI?
- Different kinds of CTI
- The pyramid of pain
- The cyber kill chain
- Data collection
- Data feeds
- When TLP comes in
- CTI tools
What exactly is a threat?
Before diving into what cyber threat intelligence is, it is essential to understand what the word “threat” defines.
A cyber threat can be defined as “any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image or reputation), organizational assets, individuals, other organizations or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information and/or denial of service.”
Threats can arrive from a single event (such as malware infecting a single computer) or multiple events tied together (a web server is compromised, the attacker moves from there to other servers, drops backdoors and steals sensitive information).
Some of the most common threats in 2021 have been:
- Ransomware attacks
- Malware infection for various purposes: data theft, credit card theft, cyberespionage, etc.
- Cryptojacking: Compromising computers or servers to use them as cryptocurrency miners
- E-mail related threats: Business email compromise, phishing, financial fraud
- Data breaches / data leaks
- Threats to data integrity and data availability: DDoS attacks in particular have a huge impact on data availability and can lead to data loss.
- Non-malicious threats: Threats that do not have a malicious component, like physical damage on a part of the infrastructure, or human error
What is cyber threat intelligence?
Cyber threat intelligence is a widely used term but sometimes in a loose way. This is partly due to people writing and speaking about it without enough knowledge of it, or complete misunderstanding.
People tend to think that CTI is just reports and feeds data, but it is actually much more.
According to NIST, “Threat intelligence is threat information that has been aggregated, transformed, analyzed, interpreted or enriched to provide the necessary context for decision-making processes.”
To clarify, data and information alone is not intelligence, but the process of correlating that data, analyzing it, sharing it with the relevant stakeholders, makes it become real intelligence.
Intelligence cycle
The intelligence cycle used in civilian or military intelligence agencies the cyber threat intelligence perfectly (Figure A).
Figure A
CTI steps
Direction
That step, also known as “planning and direction,” refers to an initial questioning that needs an answer. It defines as precisely as possible what the question is and possibly the time range in which it should be answered. It might also define the resources to handle the question.
Collection
This is the process of gathering all needed data to answer the question. The collection greatly depends on the sources used to acquire the data (open source, internal source, private source, commercial source, etc.).
Processing
Processing consists of shaping the data into a more usable form. It might consist of pure data format transformation or conversion, language translation, decrypting data, evaluating the relevance and reliability of data, to name a few. This step is highly technical, and several different open source or commercial systems can help here.
Analysis
This is where most of the CTI magic takes place. This step is mostly human, one or several analysts work on analyzing the data processed. This is where experience in cyber threat intelligence really makes a difference. Companies should have at least one or two experts in the field working on that step. This is also where data is put into context, as the expert analyzes all the collected and processed data in order to write down facts and thoughts about the threat and answers the question from the initial step.
Dissemination
In this step, the answer is provided to the appropriate stakeholders. It should be noted that different categories of people will need the results in a different format. Analysts might prefer pure data in an easily exploitable format like CSV, JSON or XLS, while a CISO for example will probably not look at raw data but rather threat reports in PDF format.
Feedback
Feedback is the step in which the stakeholders come back to the analysts. The analyst needs to know if the question has been answered clearly. If it has, it might bring further questions. If it has not, it might mean defining a new question more appropriately, or more precisely.
SEE: Google Chrome: Security and UI tips you need to know (TechRepublic Premium)
Who can benefit from CTI?
Nearly everyone in the security chain benefits from CTI, making it highly beneficial for the whole company.
- Incident handlers working on a threat are receiving and providing CTI. While they work on incidents, they can feed the CTI with the information they get–mostly indicators of compromise (IOC) and context related to the threat. Then, using the available information from the incident response, the CTI might find additional information related to the same threat and provide it to the incident handlers, who would greatly benefit from it to achieve their mission faster and with more efficiency.
- Security Operations Center analysts can leverage CTI to help automate alerts and threats. These centers typically have to handle thousands of alerts on a daily basis, and automatic triage of those is probably the best way to reduce the amount of time spent on the handling of all the alerts they get and help them focus on the most important ones with more efficiency.
- Vulnerability management teams can use CTI to get more context on a given vulnerability and know if the risk associated with a threat is immediate or merely potential.
- Risk analysts, fraud analysts, and other security people need to understand the threats in order to prioritize their tasks. CTI brings them the necessary intelligence to accomplish it.
- CISOs need to be aware of every threat but also need to make decisions based on the threats targeting their companies. CTI provides them a clearer and wider view than just what happens in their companies and can greatly help make decisions in the middle or long term.
Different kinds of CTI
CTI can be split into different subtypes for management or focusing purposes. Not everyone is interested in the same kind of information that CTI can leverage, so it makes sense classifying it for easier access (Figure B).
Figure B
Strategic CTI
This subtype is mostly used by decision-making profiles or board members. It mostly consists of consolidated CTI reports, briefings or conversations.
Operational CTI
The operational CTI is useful when it comes to get information about a threat that is specific and imminent to the organization. It is consumed by high-level security staff. While it is very difficult to know who will attack your company prior to the attack in most cases, it can be possible in the case of hacktivists advertising for attacks against the company, or when specific events occur in the real world that might strongly encourage people to attack the company.
Technical CTI
This is the most technical subtype of CTI. It consists of technical information (e.g., an IP address known to be used as command-and-control server by a particular malware) that is often short-lived, since attackers tend to change their infrastructure often, as it is often taken down as soon as it is discovered.
Tactical CTI
This part is often called TTP (tactics, techniques and protocols) and refers to how threat actors are conducting their attacks. This data can be obtained via threat intelligence reports, white papers, technical press, incident response or from peers.
The pyramid of pain
David J. Bianco published a conceptual model for the effective use of CTI with the particular focus of increasing the threat actors’ cost of operations. He called it the pyramid of pain (Figure D).
Figure D
In that model, the pyramid is built of different types of indicators collected in the CTI process. The higher a defender climbs on the pyramid and exposes indicators from it, the more it becomes detrimental to the threat actor.
To make it short, exposing a threat actor’s full TTP gives him two choices: quitting or starting from scratch.
The cyber kill chain
The cyber kill chain (Figure E) is the best known threat modeling used in CTI. It was developed by Lockheed Martin and allows defenders to break an attack into different stages, for appropriate countermeasures and handling.
Figure E
The cyber kill chain consists of the following steps:
Reconnaissance
This is the phase where the attacker searches for a target (or is assigned one in case of a threat actor working for third parties) and starts collecting useful information about it for later compromising it.
Usually, it mostly consists of identifying all the network parts connected to the internet (web/email/DNS/VPN servers for example), then look for vulnerabilities that could be exploited against those systems to gain an initial foothold inside the target’s network.
It might also consist of searching for interesting people in the targeted company who will later be targeted by spear phishing especially crafted for them.
Weaponization/delivery/exploitation
These steps are closely tied together. Following the reconnaissance, the threat actor then prepares malware or code to exploit found vulnerabilities, or prepares a spear phishing email. Then he exploits the vulnerability or sends the weaponized spear-phishing content to employees of the targeted company.
After this step, no matter if the threat actor chose to compromise a server directly or go for the spear-phishing option, he should have an initial foothold in the targeted company’s network.
Installation
In this phase, the threat actor installs his persistence method, usually at least one backdoor somewhere on the network that is easily accessible.
Command & control
At this step, the attacker can communicate from and to the backdoor.
Actions on objective
The threat actor can now do whatever he or she needed the intrusion for: data theft, sabotage, etc.
Some security companies have tweaked this kill chain a bit and come up with some slight differences but the idea remains the same. A more general kill chain can be:
- Reconnaissance phase
- Initial Compromise
- Privileges escalation and maintaining the access
- Lateral Movements
- Exfiltration/other goal
These steps are quite straightforward and describe what happens in the original cyber kill chain from Lockheed Martin. It just includes lateral movements, which is the action of moving laterally on all the target’s network to find the relevant data the threat actor is looking for. Also, it insists a bit more on the idea of escalating privileges in the network to have a better control and facility to handle the attack.
ATT&CK
The ATT&CK matrix from MITRE has gained increased popularity in recent years. It is a globally-accessible knowledge base of threat actor TTP based on real-world observations. It is used as a foundation for the development of specific threat models and methodologies in the private sector, in government and in the cybersecurity product and service community.
It is nowadays included in most of the threat reports published by vendors.
Data collection
As previously seen in the collection phase of the intelligence cycle, any CTI framework needs to be fed with data. Several ways for acquiring data are available online, as free or commercial services.
The need for trustable data
One might think that the more sources the better CTI, but that is only true as long as the data sources are relevant and can be trusted.
For instance, a data source that provides data that sometimes results from false positives should not be included in the CTI framework. Also, a data source that adds data based on hypothesis rather than facts should absolutely be kept away from CTI. A good data source is one that only brings data that can be trusted, without any blurry line or false positives.
Data feeds
What is called data feed most often consists of public or private feed provided in a format that makes it easy to interact with any CTI framework. These feeds contain IOCs generally in JSON, CSV or XML format for easy usage. It can also be in STIX format, which is a format dedicated to cyber threat intelligence. In this format, one might share just any element from the cyber kill chain: an IP address, a threat actor TTP, etc.
An example of such a data feed is URLhaus from the abuse.ch research project. URLhaus describes its goal as “sharing malicious URLs that are being used for malware distribution.” It is a constantly updated list of URLs that are tied to different malware families. It can be accessed either by web interface (Figure F) or by using its API (Figure G).
Figure F
Figure G
Several lists of data feed sources can be found on the Internet very easily.
Honeypots
Honeypots are systems that are created for the sole purpose of pretending to be different vulnerable protocols or software to check how attackers from the Internet are trying to compromise it or what they are doing after the system is compromised.
A honeypot can be as simple as a software simulating a SSH service running on a port and logging all connection attempts (to study the most used password attempts from attackers, for example) and as complex as simulating a whole network containing fake documents and fake computers.
SEE: Password breach: Why pop culture and passwords don’t mix (free PDF) (TechRepublic)
Incident response / internal source
Incident response is the most complete way to get intelligence from an attack, but when it happens the company is already under successful attack most of the time. Incident responders are the only security people who have access to the globality of an attack: network servers, compromised endpoints, etc.
Incident responders should always share all their discoveries with all other CTI actors in the company, since it can be useful at different levels.
Cybercriminal forums/chats
While it might be very interesting to have an insider view on cybercriminal forums, be it on the Dark Web or the clear web, it takes a huge investment, a lot of resources and efforts for anyone trying to monitor it and extract CTI from it. There are several barriers here, like the language problems (Russian forums and Chinese forums can be really difficult to get access to), the access problems (some forums need vetting from known members), and the amount of different cybercrime forums is just too big to track.
Companies interested in really investing in this part of CTI generally use CTI services from dedicated providers.
Also, more and more cybercriminals have moved to a heavy use of Telegram, using private channels to communicate rather than web forums, and can be a bit trickier to find.
CTI reports
A lot of vendors and governmental agencies do regularly publish free CTI reports in an effort to disrupt the actions of a threat actor and help every other security team to try to detect compromise in their own network by checking all the IOCs the report provides.
Social media
More and more IOCs and sometimes some CTI can be seen on social media, Twitter being the social media of choice for most security researchers.
While it might be difficult to determine if data provided by some Twitter accounts is fully trustable or not, it is still worth the effort monitoring data to enrich some CTI knowledge.
Need to share
This might be the most important point, and from experience I can say a lot of companies unfortunately do not get it: sharing is crucial.
Consuming CTI from different sources is of course mandatory for a good CTI structure, but it will not reach its maximum strength if it never shares its data to peers or wider communities.
For some people, sharing data with other parties, some of them being direct competitors, sounds quite unbelievable. Yet it is probably one of the most valuable sources of information for CTI.
For starters, people gather at computer security conferences. They watch each other’s presentations, and as soon as they see they have some common interests, they are getting in touch and talking about it, and generally end up sharing data.
The next step is usually to get together in public or private communities. Most of the time it is structured as mailing-lists or channels in social media tools (e.g., Slack, Keybase, etc.).
These are efficient ways for CTI people to share data and share experience. It is important to mention here that there is generally no kind of competition aspect. People, as long as they trust each other, share data with competitors without any problem, according to different data sharing protocols, the most used one being the Traffic Light Protocol (TLP).
Those relationships and trust are very rewarding when it comes to quickly assessing a specific threat and calling around for more information on an ongoing attack.
We strongly believe that every CTI team should have at least one skilled social networker to handle relationships with peers and be available for sharing data under different TLPs.
When TLP comes in
Traffic Light Protocol has been created to facilitate the sharing of information. It is a set of designations to ensure that sensitive information is shared appropriately. It consists of four colors (Figure H).
Figure H
A lot of private communities actually set their default TLP to Amber. This TLP allows people to work efficiently with the data exchanged, but it has to stay inside their own organization or just spread to impacted clients or customers under a “need to know” basis.
CTI tools
Different CTI tools are useful, as different stages of the intelligence cycle. There are tools to automatically collect data, store it, share it and run some analysis. People tend to want a unique solution that contains everything, and generally this is what vendors propose, at an expensive price that small or middle-sized companies cannot afford.
Therefore, we decided to expose a few tools that we believe are the most useful for handling CTI, for free or low cost.
OpenCTI
This project has been developed by very serious players in the CTI world, the French Network and Security Agency (ANSSI–Agence Nationale de la Sécurité des Systèmes d’Information) in partnership with the CERT-EU (Computer Emergency Response Team for EU institutions, agencies and bodies).
The project describes itself as a “unified platform for all levels of Cyber Threat Intelligence.” The idea behind OpenCTI is to be as open and modular as possible, so that a large community can contribute to it.
It has worked pretty well in the last years, seeing the huge amount of connectors that are now available for OpenCTI.
OpenCTI is a framework that consists of Python or Go API interface, and a powerful web interface (Figure I).
Figure I
OpenCTI provides multiple tools and viewing capabilities, in addition to multiple connectors to third parties’ sources of data, which can be imported automatically. It is made to store, organize, pivot, run analysis andshare data and knowledge about cyber threats. The tool allows not only to store IOCs but also the whole TTP of threat actors and information about threat actors themselves.
OpenCTI supports several formats, including STIX 2 data model.
Finally, OpenCTI offers the curious user the ability to try a demo version of it online, before deciding to go for a real installation or not.
Maltego
Maltego is a comprehensive tool for graphical analysis (Figure J). While it comes in different flavours, one being free, it is too limited for a real use in CTI. The paid versions (pro/enterprise) allow a lot more important options and capabilities.
Figure J
Maltego offers the ability to quickly connect data from more than 70 sources using “Transforms.” Some of the transforms are free, and some others need a license from third parties.
Say you have a CSV list of domains used by a threat actor. You can import it into Maltego and start using transforms to get more out of it, in a graphical mode: Whois data, DNS servers, email servers, etc.
Maltego comes as a client which can be installed on Windows/Linux/Mac systems.
Also, a transform for OpenCTI is available in Maltego. It allows CTI analysts to query and explore data from an OpenCTI instance directly in Maltego.
Maltego is a very useful tool for understanding threats, as it often happens that a visual representation brings a clearer view to analysts than raw data.
Yeti
Yeti is a free open-source platform meant to organize IOCs and observables, TTPs and knowledge on threats (Figure K).
Figure K
Yeti also automatically enriches observables (resolving domain names, for example) using different analytics tools (Figure L).
Figure L
Different analytic tools to be used for data enrichment in Yeti – Image: Sebdraven / Yeti
It can also provide graphical relationships between observables and provides an API in addition to the web interface.
Yeti transforms for Maltego also exist.
MISP
MISP is an open source and free threat intelligence platform and open standards for threat information sharing created by the CIRCL (Computer Incident Response Center Luxembourg)
It allows the storage of multiple IOCs, threat intelligence, vulnerability information, malware information and more.
It is also built to very easily share information between different MISP instances owned by different organizations. It can import and export data in several different formats and has multiple default feeds one can use automatically.
MISP provides an API and a web interface (Figure M). Transforms for Maltego are also available online.
Figure M
More tools are, of course, available for handling CTI, at any level of it, but those are the most used ones, which allow one to quickly improve one’s CTI.
Disclosure: techniciansolution own no right to this article.... its a copywrite
Comments
Post a Comment