Archive, Volume 1: conference talks and papers on security and risk, 2010 to 2018. Zola 2016-07-20T00:00:00+00:00 https://blog.itys.net/vol1/tags/security-onion/atom.xml 2016-07-20T00:00:00+00:00 2016-07-20T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/threat-intelligence-and-baselining-sans/ <h2 id="summary">Summary</h2> <p>The SANS @ Night session Threat Intelligence: Neighborhood Watch for Your Networks &amp; Why Baselining Matters, delivered by Matthew J. Harmon on July 20, 2016, explores how integrating crowdsourced Indicators of Compromise (IoCs) with rigorous network baselining practices equips defenders to spot, prioritize, and respond to threats before they escalate .</p> <h2 id="state-of-cyber-security">State of Cyber Security</h2> <p>First, Harmon frames the state of cybersecurity emphasizing that breaches are inevitable against motivated adversaries and introduces the fundamentals of threat intelligence. He walks through the CIAs 15 Axioms for Intelligence Analysts, defines IoC types (DNS hosts, IPs, URLs, file hashes), and outlines the CybOX, STIX, and TAXII standards for packaging and exchanging structured threat data. A real-world case study shows how to trace a Dyreza banking-trojan infection from anomalous traffic to phishing emails, package findings into a STIX header, and share via TAXII. Harmon then compares commercial and open-source intelligence feedsi ThreatConnect for expert-curated data and CriticalStack Intel for aggregated TSV-formatted IoCs demonstrating how organizations can leverage these resources for timely, actionable insight.</p> <h2 id="baselining">Baselining</h2> <p>Next, the presentation pivots to the critical role of baselining: defenders must know their normal network behavior to detect deviations. Harmon introduces key open-source tools Bro (for traffic analysis), PRADS (for asset discovery), SGUIL (for alert management), and LOKI (for IOC scanning)and shows how they integrate within the Security Onion distribution. He provides a do-it-yourself lab outline: install Security Onion, subscribe to CriticalStack feeds, configure Bro and YARA rules, and deploy a network tap for continuous monitoring. By combining structured threat intelligence with continuous baselining, organizations can proactively identify both emerging campaigns and internal anomalies, dramatically improving detection and response capabilities.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/2016-07-20_Threat_Intelligence_and_Baselining-SANS.pdf">Threat Intelligence and Baselining</a></p> 2015-10-20T00:00:00+00:00 2015-10-20T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/threat-intelligence-101/ <h2 id="summary">Summary</h2> <p>The Cyber Security Summit 2015 presentation Threat Intelligence 101: Introduction and Foundations by Matthew J. Harmon provides an entry level overview of the role and practice of cyber threat intelligence (CTI). Harmon begins by framing the inevitability of breaches citing high-profile incidents, and the principle that attackers need only one success, then introduces CTI as the structured collection and sharing of Indicators of Compromise (IoCs) enriched with context to support detection and response.</p> <h2 id="foundations">Foundations</h2> <p>He then explains the foundational CTI standards, CybOX (the vocabulary of observables), STIX (the XML based language for packaging observables into indicators, incidents, TTPs, and courses of action), and TAXII (the protocol for exchanging STIX packages) and walks through a real-world example: from spotting anomalous server traffic to extracting email, hash, IP, and URL indicators; packaging them into a STIX header; and sharing via TAXII to uncover a broader campaign.</p> <h2 id="diy">DIY</h2> <p>Finally, Harmon showcases two CTI platforms ThreatConnect (expertcurated CybOX/STIX feeds) and CriticalStack Intel (aggregated open-source IoCs in TSV for Bro integration) and outlines a hands-on lab using Bro or Security Onion and CriticalStack feeds. This culmination demonstrates how organizations can do it themselves by deploying free tools, subscribing to feeds, automating IoC ingestion, and participating in community-driven neighborhood watch initiatives to elevate their collective security posture.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/57315_2015-10-20_Threat_Intelligence_Intro_And_Foundations-CSSummit.pdf">Threat Intelligence 101</a></p>