Upload File

threat/risk information sharing and analytics...2016/09/14  · architecture design assurance system...

  • Home
  • Documents
  • Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation
10
TEAM Threat Operational Threat & Risk Information Sharing and Analytics

Upload: others

Post on 03-Jul-2020

4 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation

TEAM Threat

Operational Threat & Risk Information Sharing and Analytics

Page 2: Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation

Cory Casanave

Model Driven Solutions

Vijay Mehra

KYM Advisors

Introductions

Page 3: Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation

Situational awareness across cyber/physical threats and risks

System Analysis Architecture Design Assurance System Focus

Situational Awareness Threat information sharing

Threat information federation Real-time analytics

Information focus

• Externally visible subsystems

• Vulnerabilities • Attack Vectors

Page 4: Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation

IOT & Critical

Infrastructure

Terrorism Crime Cyber Natural Disasters

Integrating Framework for Threats and Risks

What we need is an integrating framework that supports automated data mapping

Sharing & Analytics

Sharing & Analytics

Sharing & Analytics

Sharing & Analytics

Sharing & Analytics

An integrating framework that helps us deal with all aspects of a risk or incident

A federation of risk and threat information sharing and analytics capabilities

Page 5: Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation

5

Problems To Be Solved

» There is a critical need to understand and mitigate threats and risks – to “connect the dots”.

» The Landscape of threats is changing • Multiple attack vectors, cyber/physical and other

• Advanced threats utilize multiple vulnerabilities

» There are multiple communities addressing the same threats • Cyber/physical, emergency management, safety, defense,

etc.

» No comprehensive consistent semantic framework • Existing systems provide insular treatment of threat/risk

relationships

• Comprehensive system would allow system-of-systems interoperability (private/private, public/private)

Page 6: Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation

Transformation from one information sharing data format to another

• Example: STIX Cyber Event to NIEM IEPD

Analytics of information federated from multiple sources

• Examples:

• Fusion center “connects the dots” between a stolen laptop (from NIEM) and a cyber incident (From STIX)

• Bio hazard detected by automated instruments and collaborated by local health care professionals

Primary classes of use cases

Page 7: Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation

Approach

Construct a conceptual model informed by existing schema, research and best practices

• This conceptual model is independent of specific data structures, technologies and terminologies

Define mapping models between the conceptual model and purpose/technology schema

Make both models sufficiently precise that they can drive automated bridging between any mapped schema

The mapping approach complements, rather than competing with, the many exchange formats and technologies. Works with XML, Semantic web and proprietary formats.

Conceptual Model

Cyber Cyber

Criminal Criminal

Cyber Infrastructure

Cyber Terrorism

Cyber Disasters

Map

/Brid

ge

Highlight O(N) vs. O(N^2)

Page 8: Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation

Conceptual Model Inputs NIEM

(General)

STIX (Cyber)

OGC (Geo)

KDM (Risk)

SEI (Safety)

EDXL (Emergency)

FIBO (Finance)

Conceptual Model NIST Framework

CAL OES (Health)

ISO (Risk)

ISO (Units)

RMS (Custody)

There is still more to do to fully integrate the above and we anticipate more inputs and use cases

MAP

STIX, NIEM, EDXL, Others

Page 9: Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation

Specification Document (PDF): http://tinyurl.com/qdfl6jl

http://www.threatrisk.org/spec/RevisedSubmission/Revised%20Operational%20Threat%20Risk%20Submission.pdf

Specification Document (.DOC): http://tinyurl.com/p6ykkrm

http://www.threatrisk.org/spec/RevisedSubmission/Revised%20Operational%20Threat%20Risk%20Submission.doc

Specification .ZIP with all models: http://tinyurl.com/o2vkkss

http://www.threatrisk.org/spec/RevisedSubmission/Revised%20threat-risk%20Submission%20machine%20readable%20files.zip

Web view of models: http://tinyurl.com/q29clvk

http://www.threatrisk.org/spec/Threat%20Risk%20Model.html

Community portal: http://threatrisk.org/

Draft specification artifacts

http://tinyurl.com/qdfl6jl
http://www.threatrisk.org/spec/RevisedSubmission/Revised Operational Threat Risk Submission.pdf
http://www.threatrisk.org/spec/RevisedSubmission/Revised Operational Threat Risk Submission.pdf
http://tinyurl.com/p6ykkrm
http://www.threatrisk.org/spec/RevisedSubmission/Revised Operational Threat Risk Submission.doc
http://www.threatrisk.org/spec/RevisedSubmission/Revised Operational Threat Risk Submission.doc
http://tinyurl.com/o2vkkss
http://www.threatrisk.org/spec/RevisedSubmission/Revised threat-risk Submission machine readable files.zip
http://www.threatrisk.org/spec/RevisedSubmission/Revised threat-risk Submission machine readable files.zip
http://www.threatrisk.org/spec/RevisedSubmission/Revised threat-risk Submission machine readable files.zip
http://tinyurl.com/q29clvk
http://www.threatrisk.org/spec/Threat Risk Model.html
http://threatrisk.org/
Page 10: Threat/Risk Information Sharing and Analytics...2016/09/14  · Architecture Design Assurance System Focus Situational Awareness Threat information sharing Threat information federation

10 #ThreatRisk

http://www.ThreatRisk.org Threat & Risk Information

Sharing Community

Join the community!

Policy

Information Analysts & Consumers

Tools & Services

Information Sources

Leadership

Standards


Protecting Information: Cybersecurity and Risk Management · 2016-06-06 · Improving Critical Infrastructure Cybersecurity, Guide to Cyber Threat Information Sharing • State government

Trusted and Anonymized Threat Sharing Using Blockchain ......Summary: The Next Generation Threat Sharing Platform • Blockchain can provide real benefits for threat sharing • Reaching

Sharing is Caring: Understanding and Measuring Threat Intelligence Sharing Effectiveness

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

CYBER THREAT DATA SHARING NEEDS REFINEMENT. Without data sharing, it is almost impossible to detect, defend and contain systemic attacks early. While sharing cyber threat data sounds

Dollars and Sense of Sharing Threat Intelligence

Contextualised and actionable information sharing within ...€¦ · in several sharing groups. Hence, threat information sharing groups form a complex eco-system. To ensure information

Cyber Threat Final Report Redacted Cover 5.291 The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-150, Guide to Cyber Threat Information Sharing

Fail frequently to avoid disaster - Pass The Salt and …collaborating on, automating and sharing threat information - e.g. exible sharing groups, automatic correlation, free-text

NIST SP 800-150: Guide to Cyber Threat Information Sharing · Guide to Cyber Threat Information Sharing Chris Johnson, NIST ... Vendor alerts and advisories ... incident management/tracking

Threat/Risk Information Sharing and Analytics€¦ · Operational threat and risk conceptual model and mappings Presenter: Cory Casanave, Model Driven Solutions Organization: Object

Automating Threat Sharing: How Companies Can Best Ensure … · 2020. 5. 20. · Automating Threat Sharing: How Companies Can Best Ensure Liability Protection When Sharing Cyber Threat

An Introduction to Cybersecurity Information …...creating, collaborating & sharing threat information - e.g. ˛exible sharing groups, automatic correlation, free-text import helper,

Sharing is Caring: Understanding and Measuring Threat ... · Sharing is Caring: Understanding and Measuring Threat Intelligence Sharing Effectiveness (#ddti) Alex Pinto Chief Data

TR 103 331 - V1.1.1 - CYBER; Structured threat information ... · CYBER; Structured threat information sharing ... the known array of existing structured threat information sharing

Cyber Surveillance and Threat Intelligence Sharing€¦ · Session 5: Cyber Surveillance and Threat Intelligence Sharing DESCRIPTION: The paucity of data and information on threat

The Mechanics of Cyber Threat Information SharingThe Mechanics of Cyber Threat Information Sharing Session 229, February 23, 2017 Denise Anderson, President, National Health Information

International Multistakeholder Cyber Threat Information ... · a. Types of international cyber threat information sharing regimes – page 54 b. Policy considerations for constructing

Guide to Cyber Threat Information Sharing (Draft) · 31 . NIST Special Publication 800 -150 (Draft) 32 . 33 . 34 . Guide to Cyber Threat . 35 . Information Sharing (Draft) 36 . Chris

Achieving & Measuring the Value of Cyber Threat …...The MITRE Corporation 2018 International Information Sharing Conference McLean, VA Achieving & Measuring the Value of Cyber Threat

The role of Information Sharing in Threat and ... · 20th Annual FIRST Conference – Vancouver 27 June 2008 • Industry stakeholders sharing only with selected partners . . . resulting

Guide to Cyber Threat Information Sharing - NIST Page Special Publication 800 -150 . Guide to Cyber Threat Information Sharing . Chris Johnson Lee Badger . David Waltermire Julie Snyder

HEALTH CARE AND PUBLIC HEALTH CYBER THREAT … · In an effort to determine the needs for cybersecurity threat information (CTI) sharing in the Healthcare and Public Healthcaresector

Cybersecurity Information Sharing Act of 2015...(2) the timely sharing with relevant Federal entities and non-Federal entities of cyber threat indicators, defensive measures, and information

Threat Intel Sharing: Deciphering the APTs secret handshakes

Toward new possibilities in … new possibilities in threat management Key ... When it comes to threat intelligence and information sharing, the cloud ... techniques to aggregate and

Dalla Malware Analysis alla Cyber Threat Information Sharing€¦ · (Cyber) Threat information is any information related to a threat (Indicators, TTPs, Security alerts, etc… )

Threat Information Sharing and GDPR: A Lawful Activity ... · And everything needs to be secure.”3 Threat information sharing addresses these concerns by enabling organizations

Preempting Cyber Fraud: SWIFT Threat Indicator Sharing … · Preempting Cyber Fraud: SWIFT Threat Indicator Sharing Tool ... National Cyber-Forensics & Training Alliance ... Preempting

Magic Quadrant for Security Information and Event Management · AlienVault Open Threat Exchange and Threat Intelligence. AlienVault's Open Threat Exchange community enables sharing

Honeynet Threat Sharing Platform · LINUX SERVER. Indonesia Honeynet Project (IHP) Threat Map 10. Early Warning System (Honeynet Portal at BSSN) 11. Threat Sharing Platform Architecture

2019 06 03b Developing Novel Solutions to Realise EE-ISAC ... · AlienVault Open Threat Exchange (OTX), Malware Information Sharing Project (MISP) or ThreatView’s Cyber Threat &

Cyber risk landscape, cyber threat intelligence and …...2019/07/04  · RESTRICTED Cyber risk landscape, cyber threat intelligence and fostering inter-agency information sharing

TR 103 331 - V1.2.1 - CYBER; Structured threat information ... · • EU Network Information Security Directive, approved 18 December 2015 [i.1]. • Cybersecurity Information Sharing

Sharing Information and Providing Feedback using MISP · PDF fileSharing Information and Providing Feedback using MISP ... MISP2 is an IOC and threat indicators sharing free software