Th The ABC BCs of of ICS Th Threat Act ctiv ivit ity y Grou - - PowerPoint PPT Presentation

▶
th the abc bcs of of ics th threat act ctiv ivit ity y
SMART_READER_LITE
LIVE PREVIEW

Th The ABC BCs of of ICS Th Threat Act ctiv ivit ity y Grou - - PowerPoint PPT Presentation

Aug 18, 2023 687 likes •879 views

Th The ABC BCs of of ICS Th Threat Act ctiv ivit ity y Grou oups Au August st 2 26, 2 2020 Sergio Caltagirone Dave Bittner VP Threat Intelligence Producer & Host Dragos The CyberWire Podcast Before we get started - The

slide-1
SLIDE 1

Th The ABC BCs of

  • f ICS Th

Threat Act ctiv ivit ity y Grou

  • ups

Au August st 2 26, 2 2020

Sergio Caltagirone VP Threat Intelligence Dragos Dave Bittner Producer & Host The CyberWire Podcast

slide-2
SLIDE 2

Before we get started…

  • The webinar is being recorded
  • The recording will be sent out in a few days
  • Please submit questions using the Q&A feature
  • All attendee phones are muted
  • Let’s meet our speakers!
slide-3
SLIDE 3

Meet Meet our

  • ur Spea

peaker ers

Sergio Caltagirone VP Threat Intelligence Dragos Dave Bittner Producer & Host The CyberWire Podcast

slide-4
SLIDE 4

Threat Group Names are Everywhere

slide-5
SLIDE 5
slide-6
SLIDE 6

What does this mean?

slide-7
SLIDE 7

Diamond Model of Intrusion Analysis

Source: diamondmodel.org

slide-8
SLIDE 8

Diamond, Kill Chain, ATT&CK

slide-9
SLIDE 9

Activity Groups

Source: diamondmodel.org

slide-10
SLIDE 10

Activity Group Lifecycle

Analytic Problem Feature Selection Creation Growth Analysis Redefinition

Source: diamondmodel.org

slide-11
SLIDE 11

Activity Groups

Source: diamondmodel.org

slide-12
SLIDE 12

Behavior, Behavior, Behavior

Detection Mitigation

Detect behaviors, not things Detect classes of threats Have 100s of detections, not millions Define and control the physics Mitigate whole classes of threats Mitigate Strategically not Tactically

slide-13
SLIDE 13

Activity Group Families

AGF1 AGF2

AG1 AG5 AG3 AG2 AG4

Source: diamondmodel.org

slide-14
SLIDE 14

Attribution

Activity Groups are not equivalent to attribution ICS threat environments are too complex for a simple attribution model Soft Attribution is not Hard Attribution

slide-15
SLIDE 15

Some Dragos Activity Groups

https://www.dragos.com/threat-activity-groups/

slide-16
SLIDE 16

Q& Q&A

Sergio Caltagirone VP Threat Intelligence Dragos Dave Bittner Producer & Host The CyberWire Podcast

slide-17
SLIDE 17

Th Thank You!

Sergio Caltagirone VP Threat Intelligence Dragos Dave Bittner Producer & Host The CyberWire Podcast