FIRST CTI LONDON Target Cyber Threat Intelligence CTI

FIRST CTI – LONDON Target Cyber Threat Intelligence (CTI) Team: BUILDING, RUNNING & MAINTAINING A CTI PROGRAM MARCH 2019

WHO ARE WE? MICHAEL SCHWARTZ RYAN MILLER Target Corporation – Director Target Corporation - Sr. Manager Threat Intelligence & Detection Engineering CTI (Strategic Intelligence) 20+ yrs Information Technology / Security 16+ yrs Intelligence Analysis (8 Cyber) FBI USG: Cyber Intel Analyst Lookout US Army: Intelligence Collection / Analyst TARGET: CYBER THREAT INTELLIGENCE TEAM (CTI) Fusion Center Model / CFC Strategic Threat Intel Team Threat Intelligence & Detection Engineering (TIDE) Reactive // Very Proactive // + Predictive

ESTABLISHING A THREAT INTEL TEAM -INTRO

ESTABLISHING A THREAT INTEL TEAM Establishing a CTI Program is Not. Easy… Establishing a Successful CTI Program is Hard… Why Do You NEED Intelligence? Does Your Organization Need a CTI Function?

ESTABLISHING A THREAT INTEL TEAM Many Approaches Many Definitions Many Analytical. Models Many Maturity. Models Lots of Confusion

MOST COMMON MISCONCEPTION External Data Feeds + Internal Log Data + Technology Platform = CYBER THREAT INTELLIGENCE Purely Technical Often Misses Strategic Intel Aspects Inherently Reactive

THE “IC” MISCONCEPTION Production Driven Often Lacks Deep Technical Analysis Vendor Reliant

ESTABLISHING A THREAT INTEL TEAM -BASICS

SIMPLIFIED MATURITY MODEL Reactive Proactive Predictive No One Right Way To Run An Intel Program… Plenty Of Ineffective Ways

TASKS / PRIORITIES CUSTOMERS Global Threat Landscape BUILDING A THREAT INTEL TEAM Campaign Analysis Threat Actor Tracking Intelligence Skill Set Intent / Capability • • PIRs Strategic Analysis Intel Production Threat Landscape Actor Tracking Threats / Trends Vulnerability Tracking External Engagement Info. Sec / Ldrs IT / Infra BISO / LOB TIDE Broader Org Strategic Team TTPs Technical Team (TIDE) Tools Target CTI Model Network Artifacts Atomic IOCs Event Details Technical Skill Set • • • Technical Analysis CSIRT / Case Support Phishing Tracking Infra Tracking Detection Signatures Detection Engineering Cyber Security Ldrs CSIRT Red Team Strategic CTI CUSTOMERS TASKS / PRIORITIES

Global Threat Landscape BUILDING A THREAT INTEL TEAM Threat Actor Tracking E Intent / Capability N TTPs B TTPs L TTPs Tools Target CTI Model • Greater Threat Landscape Visibility Campaign Analysis Network Artifacts Atomic IOCs Event Details A E S • Threat Actor Prioritization & Tracking • Phishing / Malware Tracking • Full Intelligence Lifecycle. Analysis • Kill Chain Analysis • Predictive Analysis

BUILDING A THREAT INTEL TEAM 8 Basic Principles 1. You Have The Most Data 2. Narrow Scope & Focus 3. Technical Analysis. Before Analytic Production 4. Dedicated (Templates) Over Undefined Processes 5. Continually. Refine Processes 6. Automate Wherever. Possible 7. Share! 8. Reward, Train, Explore

ESTABLISHING A THREAT INTEL TEAM -EVOLUTION

0. 5 - 1 FTE Vulnerabilities Vulnerability. Tracking & Analysis Dedication To Vulnerability Tracking Can Help Prioritize Threats Supports Developing Mitigation. Controls

DEVELOPING PROCESSES ENABLES CONSISTENT & REPEATABLE ACTIONS Vulnerability Tracking

2 FTEs Vulnerabilities Phishing Analysis Analyzing Phishing Data Can. Outline Your Active Threat Landscape Supports Developing Mitigation. Controls

DEVELOPING PROCESSES ENABLES CONSISTENT & REPEATABLE ACTIONS PHISHING ANALYSIS

3 - 4 FTEs Vulnerabilities Phishing Trend Analysis Daily Intel Threat Trends & External Intelligence Research Analyze Captured Data For Trend Analysis Current Threat Landscape Reporting That Is Actionable

DELIVER SPECIFIC & TAILORED INTEL TO LEADERSHIP & BUSINESS UNITS Trend Analysis Daily Intel

5+ FTEs Vulnerabilities Phishing Trend Analysis Daily Intel Actor Tracking Strategic Analysis Fraud Support Business Risk Threat Actor. Tracking / Strategic Analysis / Intel Support Develop Workflow For. Tracking Actors & Intelligence. Production External Team Support

ESTABLISHING A THREAT INTEL TEAM EVOLUTION Summary 1. Growth of a CTI Team is a Step-by-Step Approach 2. FOCUS to stop REACTING 3. PRIORITIZE to. Demonstrate VALUE 4. Focus on IMPACT not OUTPUT 5. SHARE & PARTICIPATE 6. Wash, Rinse, Repeat…

RUNNING & MAINTAINING A THREAT INTEL TEAM

RUNNING & MAINTAINING A THREAT INTEL TEAM Successful CTI Programs Require Leadership Support CISO Should Drive Security By Threats (Over Risk ) CTI: Define Actual Threats Replacing Hypothetical. Risk

CTI Needs To Know ENTIRE Org RUNNING & MAINTAINING A THREAT INTEL TEAM Assessing threats requires knowledge of EVERYTHING Hardware / Software / Platforms / Vendors / Access / Initiatives Developing a CTI Team is HARD WORK Doing it Over is HARDER Retention Training? Education? Conferences? Freedom? Growth? Summary Employees Interests/ Desires / Motivations Everyone finds interest in different areas Offer changes / growth

MEASURING SUCCESS OF A CTI PROGRAM

MEASURING SUCCESS OF A CTI PROGRAM Qualitative vs. Quantitative How Do You Measure Intelligence? Qualitative. Measurements For CTI: Was leadership surprisedby an event? Has CTI impacted business processto initiatechange? What business units have incorporated CTI into workflow ?

FINAL THOUGHTS 1. CTI is Hard Work… 2. CTI is a Team Sport 3. Very Little History of CTI to Model. After 4. Forge Your Own Path Thank You! 5. Share Successes & Failures To Grow

BOTTOM LINE Highly Motivated, Sophisticated & Persistent Threat Actors Want To Steal Sensitive Data From Your Organization – Competent & Effective CTI Programs Are Not Optional Thank You!

QUESTIONS?