The Disclosure Dilemma and Ensuring Defense
summary
Argues that disclosing specific indicators can blind defenders: publicizing APT28 certificate matching leads to the observed disappearance of that telemetry, and Kaspersky’s Slingshot post exposes a router implant used for counterterrorism, after which targets change tradecraft. Shows North Korean groups evolving toward stealthy supply‑chain and crypto theft techniques after repeated disclosures. Proposes a gain‑loss continuum—evaluate sensitivity, uniqueness, scope, and immediate harm versus long‑term collection before deciding what to share.
AI-written summary · about
chapters (14)
- 0:00Disclosure dilemma introduction
- 1:05Speaker background and ATT&CK
- 2:08Intelligence dilemma defined
- 3:55Intelligence equities and adversaries
- 7:04Disclosure dilemma in practice
- 8:29CTI as discipline and process
- 11:59Real-world disclosure impacts
- 14:48CTI pressures and trade-offs
- 16:55Balancing disclosure options
- 19:43Disclosure decision key points
- 20:47Ethical disclosure beyond sales
- 21:50No absolutes in decisions
- 22:54Industry CTI collaboration
- 23:35Summary and resources
related talks
51mCoordinated Disclosure for ML: What's Different and What's the Same
45mKEYNOTE 2 - A Risk Assessment of Logo Disclosures
36mFrom Dork to Diplomat: Communicating Coherently for Vulnerability & Incident Response
46mConnecting the Dots: Threat Intelligence, Cyber Incidents, and Materiality
51mNo More Secrets in Cybersecurity: Implementing ‘Radical Transparency’
40mTotal Security: Investigative Perspectives from Public to Private Sector
48mData-Driven Cyber Indicators of Malicious Insider Threat
45mDefenders Struggle as the Adversary Continues to Break Away