These Aren't the Threats You're Looking For: How Our APT Focus Ruins CTI
summary
Argument: overemphasis on APTs misdirects CTI and resources. Evidence: Red Canary’s 2020 top‑10 shows no malware exclusive to state actors; CrowdStrike Overwatch reports ~50% Q4 2020 intrusions are eCrime or unattributed; Verizon sees cyber espionage at ~3% vs web/crimeware higher. Examples and tools: Cobalt Strike, Mimikatz, encoded PowerShell, Bazar loader → Ryuk. Method: MITRE ATT&CK + ATT&CK Navigator mapping; remedy: set requirements and do threat modeling to prioritize common, high‑impact threats.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:37About me
- 3:46What is an APT, anyway?
- 5:19Early uses of the term APT
- 7:26Problems with the term
- 9:03Fear, uncertainty, and doubt
- 11:46Probability bias
- 12:54Public-private CTI migration
- 14:51Why is too much APT focus harmful?
- 16:47Top 10 threats from 2020
- 18:39Comparing top threat types
- 20:08Comparing top breach patterns
- 21:24Boring old crimeware
- 22:48Ransomware
- 23:36Business Email Compromise (BEC)
- 25:01ATT&CK Technique Overlap
- 26:58Australian Copy Paste Compromises
- 27:51What this tells us
- 28:54Where our major problem lies
- 29:37Requirements
- 31:35If you don't do threat modeling...
- 32:15If you do threat modeling...
- 33:11Takeaways
related talks
42mKeynote: The Expanding Universe of Cyber Threats
40mThreat Informed Planning with Macro-level ATT&CK Trending
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
25mDisparate Data, Distorted Decisions: Vendor Data Bias in CTI
38mSightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild