Hack.lu 2017 How I’ve Broken Every Threat Intel Platform I’ve Ever Had (And Settled on MISP)
Channel: Cooper
Date: 19/10/2017

How I’ve Broken Every Threat Intel Platform I’ve Ever Had (And Settled on MISP)

by John Bambenek

Almost every major enterprise has the same problem, how to categorize, store, and operationalize the various sources of intelligence (internal and external) so that they can be useful. The way we categorize information and operationalize information, however, has led to design flaws of almost every intel platform out there. IP address lists are good for plugging into firewalls, but they don’t appear organically in the absence of other critical information like hostnames, file names, TLS certificates, and so on.

To perform proper intelligence, all of these items need to be correlated into common events so discrete data points can be mapped to larger events and to overall patterns and campaigns against an organization.

This talk covers the adventures of working with various platforms to store a large malware configuration database so that it can retain its usefulness to users to correlate attacks back to specific actors. This malware configuration database (called Barncat) ultimately sits on MISP after attempting other platforms that failed to work for this use case. The intent of this talk is to shift the paradigm from indicators to events as the starting element to begin threat intelligence work as the relationship of all the observables of an attack are important to retain, analyze, and correlate.

Bio: John Bambenek

John Bambenek is Manager of Threat Systems at Fidelis Cybersecurity and an incident handler with the Internet Storm Center. He has been engaged in security for 18 years researching security threats. He is a published author of several articles, book chapters and one book. He has contributed to IT security courses and certification exams covering such subjects as penetration testing, reverse engineering malware, forensics, and network security. He has participated in many incident investigations spanning the globe including the DNC breach and other election related cybersecurity incidents affecting both parties. He also produces several large intelligence datasets based on DGAs and malware configurations that are given away for free. He speaks at conferences around the world and runs several private intelligence groups focusing on takedowns and disruption of criminal entities.