Latest / CYBR.Signal / Threat Intel - Choose Wisely!

Transcript

Threat Intel - Choose Wisely! · CYBR.Signal

• 0:00
  SPEAKER_00: Hey everybody, happy Cyber Sunday.
• 0:02
  SPEAKER_00: Michael Farnum here.
• 0:03
  SPEAKER_00: Hope you are doing well.
• 0:05
  SPEAKER_00: I want to talk about threat intel, threat intelligence.
• 0:10
  SPEAKER_00: Not going too deep into it.
• 0:12
  SPEAKER_00: You know, these are usually short, so just kind of wanted to give uh some thoughts that I've been having on it and what some of my customers have been looking for over the last couple of years in the threat intel space.
• 0:25
  SPEAKER_00: So usually when I'm asked about threat intel and threat intel providers or threat intel platforms from a customer, my first question, and it it's this a lot with all kinds of different technologies they ask about, but the first question out of my mind or out of my mouth is what are you trying to do with it?
• 0:43
  SPEAKER_00: And what I mean by that is are you looking for threat and an actual threat intel platform or a tip as we would call it that you're going to use within your environment to consolidate a lot of different threat intel into one spot so you can do whatever you want with it?
• 1:04
  SPEAKER_00: Um are do you are you really just or well are you looking for very specific thread intel, maybe uh any kind of reputation type of thread intel where somebody is doing uh domain name uh squatting, you know, any of that stuff, making a similar domain name as you are?
• 1:26
  SPEAKER_00: Are you looking for stuff around uh tracking your uh what your if somebody's looking for what your execs are doing or something like that, maybe you need to protect some of your executives or anybody within your uh that's in in your environment or in your uh company that's important that's going to be traveling or something.
• 1:47
  SPEAKER_00: Those are kind of edge use cases, but a lot of people look at them.
• 1:51
  SPEAKER_00: Are are are you sorry just trying to give some context in your like your security operations center?
• 2:01
  SPEAKER_00: So maybe you've already got a sim and you are pulling a lot of different telemetry into that, or just pulling some telemetry, whatever you know, kind of your um use cases are that you're trying to get out of your SIM, and maybe you want some context around that.
• 2:18
  SPEAKER_00: Um, maybe some of that context would be hey, I see a vulnerability in my environment.
• 2:24
  SPEAKER_00: Is does that vulnerability have uh current attacks that are going on using that um using that vulnerability so you can prioritize your vulnerabilities.
• 2:39
  SPEAKER_00: So there's all kinds of things you need to think about when you're thinking about a or talking about threat intel, and you really have to hone in on your use case.
• 2:48
  SPEAKER_00: Now I know not everybody knows what all those use cases are, but one of the things I tell my customers is exactly that you have to know what your use cases are.
• 2:58
  SPEAKER_00: What are you trying to solve for?
• 3:00
  SPEAKER_00: Are you looking for larger context in your sim?
• 3:03
  SPEAKER_00: Are you looking for very specific edge cases?
• 3:06
  SPEAKER_00: Are you trying to get a tip, a threat and tell platform that's consolidating all of that stuff in one place?
• 3:12
  SPEAKER_00: If you're just looking for context, you need to look for custom or look for vendors, I'm sorry, that are going to allow you to get a feed from them and not have to buy a bunch of other stuff if that's what you're looking for.
• 3:26
  SPEAKER_00: If you're uh some some vendors out there that are Threat Intel vendors will have a feed that's available, but they're gonna make you buy more stuff before you can even get that feed.
• 3:37
  SPEAKER_00: So you have to consider if that's something you need.
• 3:41
  SPEAKER_00: Um, and and that doesn't mean that's a bad thing.
• 3:44
  SPEAKER_00: You might want to listen to that vendor and say, okay, well, what are the modules or whatever that I have to get before I can get a feed?
• 3:52
  SPEAKER_00: And maybe you know, if they they'll give you a use case that you didn't think of before.
• 3:57
  SPEAKER_00: So that doesn't mean that's a bad thing, it's just something you need to consider.
• 4:00
  SPEAKER_00: There are a lot of cybersecurity, those Intel threat intel providers that will give you a feed, nothing but a feed.
• 4:06
  SPEAKER_00: And you also need to consider some free sources out there.
• 4:09
  SPEAKER_00: There are a lot of free Threat Intel sources that you can use that may not require you to go out and get a lot of uh commercial stuff.
• 4:19
  SPEAKER_00: So think about your use case, make sure you know what the vendor's offering, listen to the vendor when they're telling you what they offer.
• 4:27
  SPEAKER_00: That if they want to only just get you a feed, they'll make you look at something else.
• 4:31
  SPEAKER_00: Look at what those are, get informed of that, and then make sure you look up your free resources as well.
• 4:37
  SPEAKER_00: I'll include some links to some free resources uh in the in the body here in the in the text in the comments.
• 4:46
  SPEAKER_00: So besides that, if you got any questions or comments, please let me know.
• 4:49
  SPEAKER_00: Happy Cyber Sunday, see you next week.