SLIDE 1
Introduction
- Ron Schlecht, Managing Partner
– 18 years of Information Security experience
- G Contracting, Law Enforcement, Consulting, CISO
- Founded BTB Security in 2006
The Organized Mess & Business Ethics of Cyber Threat Intel Ron - - PowerPoint PPT Presentation
The Organized Mess & Business Ethics of Cyber Threat Intel Ron - - PowerPoint PPT Presentation
The Organized Mess & Business Ethics of Cyber Threat Intel Ron Schlecht Introduction Ron Schlecht , Managing Partner 18 years of Information Security experience G Contracting, Law Enforcement, Consulting, CISO Founded BTB
SLIDE 2
SLIDE 3
Company Profile
- The BTB Group, LLC / BTB Security
– Founded in 2006 – Offices in Philadelphia, Chicago, Austin – coverage nationally – Backgrounds include years of experience with Big Four and similarly sized organizations, and experience building, managing, and operating corporate security groups. – 3 partners
- Brian Bailey, Managing Partner (Chicago)
- Chris McGinley, Managing Partner (Philly)
- Ron Schlecht, Founder / Managing Partner (Philly/Chicago)
Company Profile
SLIDE 4
Cyber Threat Intel
- Gartner definition:
– evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.
SLIDE 5
Current State
…with less yelling
SLIDE 6
Velocity and Volume
- Disturbing Trends (continue)
– Commercialization of malware – Attack kits readily available – Botnets readily available – spam/attack/DDoS – Adaptation is now the norm for attackers…not NEW
SLIDE 7
Who’s doing it?
- National Governments
- Terrorists
- Organized Crime
- Hacktivists
- Hackers
SLIDE 8
What are ”WE” doing about it?
ecurity Woman (or Man if you are one
SLIDE 9
Sources of Cyber Threat Intel (CTI)
- Endpoint Security Vendor
- UTM/Firewall/IDS Vendor
- Vulnerability Management Vendor
- SIEM Vendor
- Application Security Vendor
- Log Management Vendor
- Forensics Vendor
- Identity and Access Management Vendor
- CTI Intel Platform Vendor
- CTI Intel Subscription Feed Vendor
SLIDE 10
Improvements
- Better context, accuracy and/or speed in handling
incidents
- Improved visibility into attack methodologies
- Faster and more accurate detection and response
- Reduction in incidents through early prevention
- Plus it sounds really cool
SLIDE 11
The Problems
- Vendor Driven
- Standards and Interoperability around feeds
- Ethics
– G and Commercial won’t share! – Research input – Dark Web
SLIDE 12
Company Profile
SLIDE 13
What do we do?
- Open Threat Exchange – Alienvault
- OpenIOC - FireEye
- STIX – Structured Threat Information Expression
- Cybox – Cyber Observable eXpression
- TAXII – Trusted Automated eXchange of Indicator
Information
- OASIS – A nonprofit consortium that drives the
development, convergence and adoption of open standards for the global information security
SLIDE 14
OASIS
SLIDE 15
Why Is This Important?
- Malware
- Attack Kits
- Botnets / Bad networks
- Security data correlation
- Plus it sounds really cool
SLIDE 16