In this lesson,
we will learn about Threat Intelligence Sources.
Threat intelligence sources are external
or internal information streams
that provide insights into emerging threats,
vulnerabilities and attacker tactics.
Threat intelligence source concepts include
threat intelligence feeds, common vulnerabilities
and exposures, or CDE details, bounty programs,
as well as third-party reports and logs.
Threat intelligence feeds deliver real-time data
on potential security risks.
Next, a CVE is a standardized identifier
for a publicly known vulnerability in software or hardware.
Next, bug bounty programs encourage security researchers
to identify and report vulnerabilities
to application owners.
And finally, third-party reports and logs
offer additional context and data
on specific threats or incidents.
Let's learn more about threat intelligence feeds,
common vulnerabilities and exposures,
or CVE details, bounty programs,
as well as third-party reports and logs.
First, we have threat intelligence feeds.
Threat intelligence feeds are real-time streams of data
that provide organizations
with insights into emerging threats.
These feeds often include indicators of compromise,
such as malicious IP addresses, URLs, file hashes,
and domains used by attackers.
Public threat intelligence feeds
like the ones provided by open source platforms
like Alien Vaults, Open Threat Exchange, or OTX
are freely available and are widely used by security teams
to stay up-to-date on the latest threats.
Private threat intelligence feeds on the other hand,
often available through paid services
from cybersecurity firms offer more targeted
and in-depth data.
These private feeds typically include tailored intelligence
about specific industries or geographies.
An example of private threat intelligence
is information sharing within information sharing
and analysis centers, or ISACs,
which generally require a membership fee.
ISACs, like the financial services ISAC
or the Healthcare ISAC,
allow organizations within specific sectors
to share threat data specific to their industry,
enabling faster and more coordinated responses
to emerging threats.
Using threat intelligence feeds,
organizations can enhance their defenses
by incorporating up-to-date threat data
into their security operations.
For example, security teams can configure their firewalls,
intrusion detection systems, and security information
and event management, or SIM tools to automatically block
or alert on any traffic
associated with malicious indicators.
Threat intelligence can even be ingested
into these security devices
through automated feeds, using formats
like the Structured Threat Information eXpression,
or STIX, and over
the Trusted Automated eXchange of Indicator Information
or TAXII protocol.
For example, if a threat feed identifies
specific IP addresses linked to ransomware command
and control servers,
organizations can configure their firewalls
to block traffic to and from those IP addresses.
So these feeds helps security teams
respond to emerging threats in real-time,
providing a proactive layer of defense against cyber attack.
Second, we have common vulnerabilities
and exposures or CVEs.
A CVE is a standardized identifier
used to catalog publicly known vulnerabilities.
Each CVE entry contains details about the vulnerability
such as its identifier, which is CVE,
followed by the year it was discovered,
followed by a serial number, a brief description,
the affected systems or software,
and links to further technical details or patches.
CVEs are maintained by the MITRE Corporation
and are widely used by organizations to prioritize
and address known security weaknesses.
The format of a CVE entry
includes the year it was identified, and a serial number,
which helps in tracking vulnerabilities in databases
like the National Vulnerability Database or NVD,
for example, CVE-2021-34527,
also known as PrintNightmare,
is a vulnerability in the Windows Print Spooler Service,
which allowed remote code execution
and required immediate patching by organizations.
CVE details are extremely valuable for security teams
as they also provide severity scores for vulnerabilities.
This enables organizations
to prioritize their patch management efforts,
severity scores, such as those
provided by the Common Vulnerability Scoring System
or CVSS range from 0.0,
representing no risk
to 10.0 representing critical risk.
By consulting CVEs
and associated CVSS scores,
security teams can quickly assess which vulnerabilities
pose the highest risk to their environment,
and should be addressed first.
Third, we have bug bounty programs.
Bug bounty programs encourage
independent security researchers to identify and report
vulnerabilities in software or systems to the vendor.
Companies or organizations running bug bounty programs
offer financial rewards to researchers
who responsibly disclose security flaws
rather than exploit them maliciously.
This process of responsible disclosure
involves reporting the vulnerability
directly to the organization, allowing them to fix the issue
before the details are made public.
Platforms like HackerOne and Bugcrowd
facilitate these programs providing researchers
with opportunities to submit vulnerabilities
in exchange for monetary reward.
The amount of money that can be earned
in a bug bounty program varies widely
depending on the severity of the bug
and the organization running the program.
For example, some companies offer rewards
ranging from $500 for low severity bugs
to over $100,000 for critical vulnerabilities.
In 2019, Apple expanded its bug bounty program
and began offering rewards of up to $1 million
for discovering critical vulnerabilities in iOS,
particularly those that could lead
to a zero-click remote code execution
without any user interaction.
Rewards like this are offered
because bug bounty programs benefit the vendor organization
by giving them access to a global pool of security talent,
helping them uncover security issues
that internal teams may overlook.
Fourth and last, we have third-party reports and logs.
Third-party reports and logs
are additional sources of threat intelligence
that provide context and analysis
on specific cybersecurity incidents or vulnerabilities.
These reports are often generated by cybersecurity firms,
government agencies, or research organizations,
and offer deep insights into ongoing threats
or new attack techniques.
For example, annual reports
like the Verizon Data Breach Investigations Report
provide comprehensive analysis
on the state of cyber threats,
helping organizations understand the latest trends
in attacks and vulnerabilities.
These reports aggregate data from thousands of incidents,
providing valuable insights that organizations can use
to refine their defenses.
Next, third-party logs such as those
provided by managed security service providers
or cloud services offer valuable information
about security events within an organization.
These logs can even be integrated
into an organization's SIM for continuous monitoring
and threat detection.
For example, cloud providers like Amazon Web Services
or AWS, provide detailed access logs
that allow organizations to monitor
who access specific resources and when.
By combining internal logs
with third-party logs and reports,
organizations can gain a more comprehensive view
of their security posture,
allowing them to respond more effectively to threats.
Before we wrap up, let's do a demonstration
highlighting how to integrate a threat intelligence feed
into a SIM such as a Splunk.
On this Kali Linux machine, I have Splunk installed
and I have created separately an OTX account and API key
so that I can pull the OTX threat intelligence feed.
Let's take a look at what I've created.
I am logged into otx.alienvault.com,
and in my settings, I can see that there's an OTX key,
which will be used for the API from Splunk to OTX.
Next, here in my Splunk dashboard,
I need to create an add-on for threat intelligence.
To do that, I'm going to go to Find more apps
on the left-hand side.
Here in the Find more apps,
I'm going to search for open threat.
There are two applications that are already installed.
Those are the ones that I would want to download.
Add-on for Open Threat Exchange
and supporting add-on for Open Threat Exchange.
As I mentioned, I've already installed these.
I just disabled them for this demonstration,
so my next step is to go to those applications
and re-enable them.
If this was being done for the first time,
you would just install them here.
I'm going to go to Apps, Manage apps,
and I'm going to enable those two applications,
the supporting add-on for Open Threat Exchange
and the add-on for Open Threat Exchange.
Now, with both of those enabled, I'm going to go back
to my home page on Splunk and refresh it.
You'll see that I now have an add-on
for Open Threat Exchange.
Let's open it up.
Here is where I will create my new input
with my OTX API key, but before doing that,
I need to create an index so I can manage and query
threat intelligence from the OTX feed.
So I'm going to go to Settings, under Data,
I'll select Indexes.
Here I want to create a new index.
I'm going to call my index threat_intel.
All these default configurations are okay,
and now I've created an index called threat_intel.
Now back to my new application add-on
for Open Threat Exchange.
Now I'm going to be able to create that new input.
I'll give it a name,
and the name I'm going to give it is OTX Threat Feed.
I'm going to have it refresh
or look for new updates every 6,000 seconds or 10 minutes,
and I want to assign it an index
that I just created threat_intel.
Now I need to give it that API key that I created earlier.
I'll copy it and paste it in.
Once my API key is in place,
I'll go ahead and add this new input.
There we go.
I've created my OTX threat feed.
Now we're receiving threat intelligence into Splunk.
At this point, we could create dashboards to alert us
to top malicious IP addresses from the OTX feed,
or maybe blocked or flagged traffic from Splunk
using the threat feed data.
During the security X exam,
I do not expect you to have to configure a SIM
to ingest threat intelligence.
So don't memorize these steps,
but it is valuable to understand that it can be done
and what the benefits are.
This is the end of our demonstration.
So remember,
threat intelligence sources provide crucial insights
into emerging cybersecurity threats, vulnerabilities,
and attacker tactics.
These sources include threat intelligence feeds,
common vulnerabilities and exposures,
or CVE details, bug bounty programs,
and third-party reports and logs.
Threat intelligence feeds deliver real-time data
on potential security risks while CVEs help organizations
track down vulnerabilities
by assigning standardized identifiers.
Next, bug bounty programs provide incentive
for security researchers to discover and report
vulnerabilities to vendors, often for financial reward.
Last third-party reports and logs offer detailed analysis
and additional data on specific incidents
helping organizations improve
their overall security posture.