Instructor: In this lesson,
we will learn about external intelligence sources.
External intelligence sources include data and insights
gathered from outside an organization
used to help identify potential threats or vulnerabilities.
External intelligence sources
include open source intelligence, or OSINT,
information sharing and analysis centers, or ISACs,
reliability factors, and dark web monitoring.
OSINT includes collecting publicly available information
from websites or forums to spot emerging threats.
ISACs provide threat intelligence
and collaboration among industries.
Next, reliability factors assess the trustworthiness
of external sources,
ensuring that the gathered intelligence is credible.
Finally, dark web monitoring tracks criminal activities
and potential data leaks
that could signal a targeted attack.
Let's learn more about open source intelligence, or OSINT,
information sharing and analysis centers, or ISACs,
reliability factors, and dark web monitoring.
First, we have open source intelligence.
Organizations use open source intelligence, or OSINT, tools
to gain insight into what data attackers
could easily gather about their business.
OSINT refers to the collection
of publicly available information
from sources like websites, social media, and forums.
It helps security teams
to understand their organization's external exposure
and how attackers might exploit this information.
For instance, tools like Maltego or Shodan
allow security teams to see
what publicly-facing systems or vulnerabilities
could be visible to attackers.
So OSINT can help organizations
stay one step ahead of adversaries
by showing them the same surface-level information
that attackers are able to access.
Additionally, OSINT can be leveraged by defenders
to gain insights into attackers' tactics,
techniques, and procedures, or TTPs.
By studying the digital footprints
and communications of threat actors,
security teams can gather intelligence
on how attackers are planning and executing their campaigns.
This might involve monitoring threat actor forums,
dark net marketplaces,
or even public exploit databases
where attackers share or sell information
about new vulnerabilities and attack methods.
So OSINT serves as a powerful tool
for both understanding
an organization's external vulnerabilities
and gaining valuable insights into attackers' methods.
By utilizing publicly available data,
organizations can view their own digital footprint
through the eyes of potential attackers
and take proactive measures to mitigate risks.
Furthermore, by studying the OSINT TTPs of threat actors,
defenders can stay ahead of emerging threats
and tailor their security strategies accordingly.
Second, we have information sharing and analysis centers,
or ISACs.
ISACs are organizations that facilitate collaboration
among companies within specific industries
to share cybersecurity information and intelligence.
ISACs help businesses collectively understand
and respond to cyber threats
by pooling resources and knowledge.
For example, the Financial Services-ISAC
is a well-known group
that enables banks and other financial institutions
to share information
about emerging threats and vulnerabilities,
helping to protect the entire financial sector
from coordinated attacks.
Similarly, other industries have their own ISACs,
such as the Health-ISAC for healthcare,
the Energy-ISAC for the energy sector,
and the Aviation-ISAC for aviation,
each providing sector-specific intelligence
to enhance cybersecurity resilience.
A more complete list of ISACs
can be found at https://www.nationalisacs.org/members.
ISACs often provide regular threat reports,
alerts, and best practices
that organizations can integrate
into their security measures.
Some ISACs offer paid membership tiers,
granting access to more detailed
and real-time intelligence,
while others provide basic services at no cost,
such as alerts and community discussions.
So for enterprises,
investing in a paid membership can provide deeper insights,
enabling quicker responses to emerging threats.
This is important,
because by sharing information
about threats seen by one organization,
others can act more quickly to mitigate similar risks.
For instance, if a member of a healthcare ISAC
detects a specific ransomware strain
targeting electronic health records,
they can share that intelligence with other hospitals,
reducing the chances of widespread damage.
This collaborative approach allows companies
to enhance their threat detection capabilities
while improving overall industry resilience against attack.
Third, we have reliability factors.
Reliability factors refer to the evaluation
of the credibility and trustworthiness
of external intelligence sources.
In cybersecurity, this means ensuring
that the information gathered
from a third-party intelligence feed
is accurate and timely.
Various products like Recorded Future
or Mandiant Threat intelligence
provide external data that organizations use
to enhance their security postures.
But it's important to assess the reliability
of these sources.
This is where the Admiralty Scale comes into play.
The Admiralty Scale is a system commonly used
to evaluate both the source of intelligence
and the information provided.
The Admiralty Scale assigns two ratings,
one for the reliability of the source,
ranging as a grade from A to F,
and another for the accuracy of the information
ranging on a scale from 1 to 6,
where one is the most reliable.
This scale helps security teams
gauge whether the intelligence
is coming from a trusted source
and how likely it is that the information is accurate.
For example, an A1 rating
would indicate a highly reliable source
with confirmed credible information,
while an F6 rating would suggest an unreliable source
with unverified information.
So the use of the Admiralty Scale
prevents inaccurate intelligence
from wasting resources or even increasing vulnerabilities.
For instance, if a threat feed
falsely identifies a benign website as malicious,
it could lead to unnecessary remediation efforts
or business disruptions.
Similarly, if a company mistakenly overreacts
to false intelligence about a phishing campaign,
it might divert resources
from addressing actual more critical threats.
So for enterprises, ensuring the reliability
of external intelligence is critical,
because inaccurate or unverified information
can lead to misinformed decisions
which may result in financial losses or wasted resources.
To avoid such issues,
organizations often use multiple sources of intelligence
and employ cross-verification techniques,
ensuring that the intelligence they act upon
is not only timely but also trustworthy and accurate.
Additionally, the Admiralty Scale
adds an additional layer of rigor
in evaluating this intelligence,
helping to prioritize responses
based on the reliability and credibility of the information.
Fourth and last, we have dark web monitoring.
Dark web monitoring involves tracking and analyzing activity
on hidden parts of the internet,
often used by cyber criminals for illegal activities
like selling, stolen data,
offering hacking services,
or sharing vulnerabilities.
Enterprises can use dark web monitoring tools,
such as DarkOwl, to keep an eye on criminal marketplaces
for signs that their data has been compromised,
or that they are being specifically targeted
by threat actors.
For instance, if an organization's user credentials
appear for sale on the dark web,
it likely indicates a breach,
prompting the organization to immediately reset passwords
and investigate the source of the leak.
Dark web monitoring is important in enterprise security
because it provides early indicators
of potential data breaches or planned attacks.
By actively watching the dark web,
companies can detect
whether their sensitive data is being sold
or when hackers are discussing attacks
on their organization.
This early detection can give an enterprise valuable time
to respond to breaches before they escalate.
So remember, external intelligence sources
help organizations to identify
potential threats and vulnerabilities
from outside their own network.
These sources include open source intelligence, or OSINT,
information sharing and analysis centers, or ISACs,
reliability factors, and dark web monitoring.
OSINT collects publicly available information
to spot potential threats.
Next, ISACs enable industry-specific collaboration
on cybersecurity intelligence.
Then reliability factors, like the Admiralty Scale,
are used to evaluate the trustworthiness
of intelligence sources
to ensure informed decisions are based on credible data.
And finally, dark web monitoring
helps track criminal activities and detect data leaks,
providing early warning signs of potential breaches.
Together, these external intelligence sources
provide a comprehensive approach
to identifying and mitigating cyber threats.