"Meet Me in the Middle: Threat Indications & Warning to enable..."
summary
Argues for a usable middle ground between brittle atomic IOCs and months‑late reports: produce verified, minimally contextualized alerts that let SOCs act now. Shows CrashOverride’s public indicators arriving months to years after the December 2016 outage (hashes June 2017, full lifecycle Oct 2018) and Shamoon‑3’s December 2018 wiper where McAfee and FireEye tie prior activity to later destruction, illustrating the cost of delay. Recommends embedding CTI with ops, sharing enriched indicators, and publishing 24-hour preliminary reports that are actionable.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 2:55What is intelligence
- 7:46Threat intelligence levels
- 15:51Indications and warnings concept
- 22:15Real-world examples
- 30:44Why INW matters now
- 36:43Actionable threat intelligence
- 37:04Q&A session
related talks
20mCalcifying Crisis Readiness
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
40mTotal Security: Investigative Perspectives from Public to Private Sector
01h 11m2024 Security BSides // Adam Pennington
40mBuilding a CISO Response Strategy to Advanced Threats
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
46mConnecting the Dots: Threat Intelligence, Cyber Incidents, and Materiality
35mThese Aren't the Threats You're Looking For: How Our APT Focus Ruins CTI