Archive, Volume 1: conference talks and papers on security and risk, 2010 to 2018. Zola 2015-10-20T00:00:00+00:00 https://blog.itys.net/vol1/tags/stix-taxii/atom.xml 2015-10-20T00:00:00+00:00 2015-10-20T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/threat-intelligence-101/ <h2 id="summary">Summary</h2> <p>The Cyber Security Summit 2015 presentation Threat Intelligence 101: Introduction and Foundations by Matthew J. Harmon provides an entry level overview of the role and practice of cyber threat intelligence (CTI). Harmon begins by framing the inevitability of breaches citing high-profile incidents, and the principle that attackers need only one success, then introduces CTI as the structured collection and sharing of Indicators of Compromise (IoCs) enriched with context to support detection and response.</p> <h2 id="foundations">Foundations</h2> <p>He then explains the foundational CTI standards, CybOX (the vocabulary of observables), STIX (the XML based language for packaging observables into indicators, incidents, TTPs, and courses of action), and TAXII (the protocol for exchanging STIX packages) and walks through a real-world example: from spotting anomalous server traffic to extracting email, hash, IP, and URL indicators; packaging them into a STIX header; and sharing via TAXII to uncover a broader campaign.</p> <h2 id="diy">DIY</h2> <p>Finally, Harmon showcases two CTI platforms ThreatConnect (expertcurated CybOX/STIX feeds) and CriticalStack Intel (aggregated open-source IoCs in TSV for Bro integration) and outlines a hands-on lab using Bro or Security Onion and CriticalStack feeds. This culmination demonstrates how organizations can do it themselves by deploying free tools, subscribing to feeds, automating IoC ingestion, and participating in community-driven neighborhood watch initiatives to elevate their collective security posture.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/57315_2015-10-20_Threat_Intelligence_Intro_And_Foundations-CSSummit.pdf">Threat Intelligence 101</a></p> 2015-07-23T00:00:00+00:00 2015-07-23T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/threat-intelligence-neighborhood-watch/ <h2 id="summary">Summary</h2> <p>The SANS @ Night session Threat Intelligence: Neighborhood Watch for Your Networks by Matthew J. Harmon introduces the concept of crowdsourced cyber threat intelligence as a critical component of modern defense. Harmon defines threat intelligence as the collection of Indicators of Compromise, DNS hosts, IP addresses, email addresses, URLs, and file hashesi, enriched with contextual information about campaigns, tactics, techniques, and procedures (TTPs) to produce actionable insights. He stresses that confidence in data varies from unvetted open-source feeds to expert-curated platforms and that standardized formats like CybOX for observables, STIX for structured information, and TAXII for automated exchange enable seamless sharing across organizational boundaries.</p> <p>Through a step-by-step case study, Harmon demonstrates how to apply these standards in practice: identifying excessive traffic on a server, back-tracing it to a phishing email with a malicious ZIP attachment, extracting MD5 hashes and C2 IPs, and packaging them into a STIX header with appropriate Course of Action blocks. He then compares two data-sharing solutions: ThreatConnect, which offers high-confidence, expert-vetted intelligence via CybOX/STIX/TAXII; and CriticalStack Intel, which aggregates over a hundred open-source IoC feeds in simple tab-separated values for rapid integration with Bro (the network analysis framework). To reinforce the concepts, Harmon outlines a hands-on lab deploying Bro or Security Onion, subscribing to Intel feeds, and using bro-cut to validate detectionsunderscoring the power of a community-driven neighborhood watch to elevate collective security posture.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/57226_2015-07-23_Threat_Intelligence_Neighborhood_Watch-SANS.pdf">Threat Intelligence: Neighborhood Watch for your Networks</a> <a href="/attachments/57925_2017-06-21_MJH_Internet_of_Everything-SANS_Script.pdf">Threat Intelligence: Neighborhood Watch for your Networks, Script</a></p>