As an intelligence sharing platform, MISP will have a vital
role to play within your internal intelligence framework and
across the wider community.
This also dovetails him very nicely with the NIST Cybersecurity Framework.
As with most blue team tools,
they probably cover off several functions within the
Cybersecurity Framework, and MISP is no exception.
It's quite easy to see how it would fall into protect, detect, and
respond, but in particular, it has great value within the detect
and respond functions and especially when dealing with respond when
dealing with communications.
However,
for this course, I'm focusing on the detect function within the NIST framework.
If we take a closer look at the detect function within the NIST framework,
we can see that this also breaks out into the various categories, anomalies
and events, security continuous monitoring, and the detection process, and
it's very true to say that MISP will have a bearing across these different
categories. But a great one to concentrate on are anomalies and events. And as
you can see, these also break down into various subcategories. And I've
selected the DE.AE‑2: Detected events are analyzed to understand attack
targets and methods, and here you would be able to ascertain the different
threat actors and the TTPs based on the wide range of data available to you on
the MISP platform. And also DE.AE‑3: Event data are collected and correlated
from multiple sources and sensors, and this perfectly describes the way that
MISP both collects and disseminates data across the threat intelligence
community. Of course, as with all of these tools,
they are also under the jurisdiction of MITRE ATT&CK, and as a
threat intelligence analysis tool, MISP may assist you across the
spectrum of the MITRE ATT&CK analysis type.
However, in particular,
of course, it falls heavily into the category of threat intelligence.
This would be part of the threat intelligence program mitigation
technique, which you can identify in MITRE ATT&CK and comes under the
identification of M1019, threat intelligence program.
And of course, there are techniques which can be addressed by
having a threat intelligence program, and these,
for example,
are the T1212, exploitation for credential access, the
T1068, exploitation for privilege escalation, and the T1210,
exploitation of remote services.
This is where it's very important to develop a robust cyber threat
intelligence capability to determine what types and levels of threat may use
software exploits or zero‑day exploits against a particular organization.
We'll be using these as examples in the demonstration