As an analyst, you need to be aware of the different intelligence levels, as well as a plethora of
other information that comes along with understanding the different threat actors, threat vectors,
and of course, threat intelligence itself.
In this episode, we're going to discover different intelligence levels and how they correspond to threat
intelligence, so that you can process that different information to be a better Cisa analyst.
Threat intelligence levels are divided into three core categories strategic, operational, and tactical.
With strategic intelligence, we're looking at long term business profiles or goals that interact with
the organization as a whole.
These are usually things like what do we want to do or accomplish within five years?
How does that relate to the cybersecurity department, and what do you need to be aware of as part of
a strategic operational force specific with cybersecurity?
This could include things like maybe setting up a Siem scheme or setting up a new IPS.
Maybe, you know, servers are going to hit end of life and you need to be aware of that.
Those are those long term business strategies that you need to be aware of at an operational level.
You need to be aware of the different strategic objectives so that you could correspond to those strategic
with the operational level.
What that really means is from 1 to 3 years out, what do you need to do in order to correspond with
that strategic level objectives?
We talked about maybe implementing a scheme or setting up new servers that are ending in their end of
life.
But what about that 1 to 3 level goal?
Maybe we need to replace some routers.
Maybe the operational level means that I need to hire new employees, or train my current employees
up to a level so that we can have new, fresh employees coming in that they will in turn, train.
Operational level is really that 1 to 3 mark that we're talking about.
In order to correspond with that strategic level, in order to better provide a foundational level at
the business sense, at a tactical level, you need to be aware of your specific department.
These are six months to one year.
As soon as three months.
In some cases, these are things like maybe I'm already hitting that end of life and we've already passed
it.
Or maybe there's a key vulnerability implemented within the system.
For instance, maybe you're using Windows 10.
And Microsoft came out and said, hey, we're no longer supporting windows 10 in 6 months, and so you
need to update to Windows 11.
Those would be tactical level objectives that need to be associated with they correspond with that operational
level.
And then again, the strategic level.
What you really need to understand about the different intelligence levels, as far as Cisa is concerned,
is short term, medium term and then long term planning from the different levels.
Your C-suite usually puts out strategic level objectives for the business as a whole.
Directors and high level managers usually come up with the operational level, and then your immediate
supervisor usually comes up with that tactical level that you need to be aware of.
The tactical level really is the hands on portion that most analysts intersect with when it comes to
the overarching strategic goals of the company.
Threat intelligence comes in different varieties, and we get threat intelligence from different sources,
and we talked about that in previous episodes.
In this episode, we're really going to contact onto those indicators of compromise.
What provides a clue into what's going on inside of our network?
These can be things like vulnerabilities.
Maybe I've hit end of life like we already talked about, but we've opened up a new vulnerability.
Maybe we downloaded a new software that's supposed to make our lives easier for the IT team, but it
has an inherent flaw with a unencrypted port.
These are different vulnerabilities that we need to be aware of that could open ourselves up to different
threat actors and a new threat vector.
So vulnerabilities come in different capacities.
They can be in configuration management, they could be in new software.
It could be even in new employees.
We need to be aware of the different trends that go along with that as well.
If we're seeing a rash of new ransomware that's coming out through the through the lines of threat intelligence,
then we need to correspond to our defensive structures onto those trends.
You have to remember, cybersecurity is like anything else.
It's not a matter of when we get hit, it's only a matter of time before we get hit.
And that aspect.
We need to be fully aware of impending trends.
Have you ever noticed that when something's hitting the the media a lot, that people seem to jump on
it and we see that in different business cycles?
We saw that with tiny homes.
We see it in a different variety of ways.
Cyber security is no different.
Those trends come into play and we need to be aware of them.
Finally, we need to be aware of our threat landscape, meaning the landscape that is inherent within
our organization.
Are we using VLANs?
Are we using subnetting?
Are we using windows only machines or do we have some Linux intertwined within that?
What kind of IDs or IPS systems are we using that network infrastructure that we're responsible for
from a cybersecurity standpoint, definitely provides a threat landscape in which an attacker is most
likely going to try to invade our network with.
We need to be aware of that landscape and put up defensive measures in order to secure that landscape
as we move forward.
Indicator of compromise could also be abnormal user behavior.
We've all seen that one employee that is stellar.
They never click on those phishing links.
They never do anything wrong.
But then suddenly their abnormal behaviour comes to bear.
And their surfing websites, they've never surfed before, or maybe their opening email attachments
that they've never opened before.
This could be an indicator of compromise, where somebody has gotten access into their account and is
remotely accessing different websites or different emails in order to download malicious activity or
malicious malware.
This comes into that abnormal user behaviour that we need to be aware of.
It could also be a sign of an eternal threat.
If we've got a user that is normally a stellar employee as far as cybersecurity is coming into play,
but now they're starting to access servers that they've never accessed before.
Maybe they're hitting file structures they've never messed with before.
We need to be aware of that.
Could it be abnormal user behaviour or is it part of their job.
Maybe they've got promoted, maybe their, uh, their requirements for their job that they currently
are in have expanded.
Those are perfectly legitimate uses for the new behaviour that we're seeing.
But we need to be aware of that.
Abnormal user behaviour could also mean that they're frustrated with their job and they're getting ready
to quit, and they're trying to download the latest and greatest information from different servers
so that they could sell it on the black market.
That doesn't mean that's what they're going to do.
It could be perfectly legitimate, but it's something that we need to be aware of as cybersecurity professionals.
There's also something called unusual network traffic.
This is where they're accessing different websites.
Maybe they're accessing websites.
They shouldn't.
For instance, Facebook or Twitter.
When we've locked down those machines yet they're using a VPN to get around our our network infrastructure.
Maybe they're accessing a VPN website.
And we see that that would be something that's unusual network traffic.
It could also be inside our own internal network.
It doesn't necessarily have to be something outside.
It could also be inside where again, they're accessing those servers that they don't normally access.
You can see where abnormal user behavior interlines with unusual network traffic.
There's also unexpected system changes where the user is going in.
And maybe they're changing their permissions.
Maybe they're going through the process and suddenly deleting files or adding new files that they normally
don't add on.
There there's basic users where they go in and they create a new file and they upload a lot of to word
docs.
But what have we got?
A bunch of new files being uploaded and they're going into the windows system directory files.
That's abnormal system behavior and unexpected system changes.
We could also see traffic to known malware sites.
This kind of corresponds with that unusual network traffic and of course known malware signatures where
we've got employees clicking on phishing links.
Or maybe they're purposely going onto these websites and downloading new malware.
We once saw where an employee actually brought a USB drive and it had malware associated with it, and
they plugged it into their machine.
At first they tried to play it off as, oh, I didn't know where the USB came from.
But on further investigation, we started to realize that the employee was actually using that USB drive
to constantly upload new malware into the different computer systems which they were accessing.
This is before we started locking off USB drives or USB connections, but you can kind of see the point.
There's that careful consideration that you really have to come into play with which what is usual versus
unusual, and is the employee truly doing it on accident versus on purpose?
Internal threats are that careful balancing act of figuring out what the employee is attempting to do
versus what they're trying to do?
Here you can see the Pyramid of Pain developed by David Bianco.
This was developed by him to kind of identify the different aspects of indicators of compromise and
how they came into play with different levels of knowledge and also skill set.
You can see at the very top where we have tactics, techniques and procedures.
This is considered to be tough or challenging or very challenging, I should say, which is something
that we don't normally see out of malicious actors.
That doesn't mean that they're not always there, it just means they're highly skilled and understand
what they want to do.
We can also see different tools.
These can be challenging.
These tools can include something like, I don't know, Metasploit framework utilizing those different
tools, maybe orbital strike to pull off a DDoS attack, or maybe even some password cracking tools
that we may see fairly often, like Jack the Ripper.
We can see these different tools and applying within our own network, and those are tough or challenging
in order for us to not only prevent, but actually defend against.
We can also see network or host artifacts, which are somewhat annoying to the cyber defense.
And this provides us a different aspect of hey, while Ttps are very tough and they take a lot of legwork
and tools can be somewhat challenging, network artifacts are just plain out annoying.
That doesn't mean that they can't be costly in time or even resources.
In fact, they can be very costly in time and resources.
But they're annoying because there's so many of them that could come into play.
Then we have something called domain names.
These are simple and simple.
We put in a firewall rule and we get rid of it.
We also have IP addresses which are considered to be easy.
Again, firewall could stop that, even an IPS or an IDs.
And then of course trivial.
These are the hash values associated with different viruses or malware, which are antivirus programs
can pick up and stop this pyramid of pain.
Really kind of denotes the ability of our cyber task force or our cybersecurity team to deal with different
methodologies that attackers may utilize against us as a cyber workforce.
That doesn't mean that they're actually going against us every time.
Sometimes, as you can see with an IP addresses, it's just a known variant that we have to deal with
on a day to day basis.
VirusTotal was developed by Google and provides a 70 plus antivirus scanners and URL domain blacklisting
services to identify whether a URL or even a file has malicious activity within it.
Let's take a look at one right now.
Here you can see the website virustotal.com.
Now this is the landing page for this website.
And you can see here that we have file that we can upload.
We have URL and we can even do a search factor for different IP addresses or other content that we want
to be aware of.
VirusTotal provides us kind of a seamless intervention within different aspects that we may or may not
be aware of.
I'm going to pull up a known site that we know is somewhat malicious and concerning.
It's called Weekapaug.
It's weekapaug.
I'm going to hit the enter button right there, and it's going to go through the process.
And here we can see that it's providing a CDF with malicious activity and it was considered malicious.
We can also see something called gridinsoft.
It's suspicious.
And again it's clean.
This is a somewhat easy tool to utilize.
Here at the very top you can see we can reanalyze.
We can search.
If we've got a paid subscription or a login.
You can use the graph or even the API that you can utilize within your standard security set.
This website provides us some good information for threat intelligence specific towards the files and
URLs, but it provides us a good outlook of what's going on.
And you can see here just by scrolling down, it gives me a lot of information at my fingertips.
Very easy to use, very detailed and it's process.
And we can see here CI radar, for instance, is the commercial off the shelf product that first discovered
this.
So that's VirusTotal.
And this episode we discussed intelligence levels and how they correspond with you as a cyber analyst.
We also talked about different threat intelligence and how that corresponds to the different threat
intelligence levels that you need to be aware of.
Cisa takes a very high level overview of what we discussed today.
You don't need to know the ins and outs of every single idiosyncrasy that comes along with threat intelligence,
but you do need to have a high understanding or a high level overview of what you're trying to accomplish
here.
For instance, I wouldn't expect to see a lot of information or questions specific towards VirusTotal,
but I would expect to see different levels of, say, intelligence levels and how they correspond with
what you're trying to achieve.
You may also get some information or have questions specific to the different aspects of where threat
intelligence is actually sourced from those confidence levels that we discussed in earlier episodes,
and then how that interplays with how you, an analyst, would go into intersection with threat intelligence
as a whole.
Again, we're really not looking at the idiosyncrasies or the deep dive in this aspect, but you do
need to have a high level understanding of how threat intelligence corresponds with you as a cyber cyber
analyst.