Threat intelligence at the cloud

Threat Intelligence At The Cloud

Or Katz - Principal Security Researcher

Ezra Caltum - Senior Security Researcher

Hide and Seek

Akamai Cloud

The Playground? Who is Hiding?

Who is Seeking? The Goal of the Game?

Threat Actors

Find malicious activity and create actionable threat intelligence

Hide: Threat Actors

Seek: Akamai Threat Research Team Akamai’s State of The Internet Report

Research Publication Thought Leadership

The Platform •  167,000+ Servers •  750+ Cities •  92 Countries

The Data •  2 trillion hits per day •  260+ terabytes of

compressed daily logs

Playground: Akamai’s Content Delivery Network (CDN)

Data Centers

End User

The Goal: Threat Intelligence

Highlights of threat intelligence: •  New insights •  Forecast future threats •  Digested output •  Actionable

According to Gartner: “Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard”

Why Threat Intelligence At the Cloud?

Volume, Velocity and Variety

Leading to better: • visibility to threat landscape • Insights • Future threats forecasting • Security level

Case Study – Slow & Low

Customer: “Some of the Web site accounts had been taken over, I suspect that it was a brute force attack”

Web Brute Force

Also known as: Password guessing attack

User: Ezra Password: 123456

Brute Forcer

Web Application

Brute Force - Common vs. Advanced

Common •  Attack method – Brute force flood •  Attacking resources – single/few •  Detection technique – Noisy logs •  Protection - Rate control

Advanced •  Attack method – Brute force slow and low •  Attacking resources – multiple/Botnet •  Detection technique – ? •  Protection - ?

Slow & Low – On Site Threat Intelligence

Step 1 (on-site) Analyzing each IP address activity per Web application

Step 2 (on-site) Analyzing aggregated Web

application login attempts per hour

Resource Application

5 ~ 12 login attempts per hour ~50 login attempts per hour

Slow and Low – At Cloud

Step 3 (cloud) Tracking brute forcer across the cloud!

Monitoring all IP addresses activity on all targeted Web application

1.  Each Botnet member target 100 ~ 300 Web applications 2.  Botnet execute ~10,000 login attempts per hour over Cloud

network 3.  Botnet is running over the same virtual hosting service provider 4.  The Botnet was active at least few months before detected

On-site vs. Cloud

On-Site Cloud

Brute Force Botnet

Brute Force by Industry Segment

Actionable Insight

•  Tactical controls - Block any login attempts initiated from detected Botnet •  Strategic controls - Adjust security control brute force rate mitigations •  GEO intelligence - Restrict GEO login •  Present threat Intel. - Detection based on cross targeted correlation •  Future threat Intel. - Forecasting based on industry intelligence

Summary

•  Cloud platform can yield unique actionable threat intelligence •  Cloud threat intelligence introduce the ability to use cross targets, cross

industry and evasive techniques in order to produce unique threat intelligence

•  Using gaming techniques while at work is fun! •  When you are 195cm tall it is hard to find good hiding places

Ezra Caltum - @aCaltum Or Katz - @or_katz

Threat intelligence at the cloud

Data & Analytics

Transcript of Threat intelligence at the cloud

group-ib.com Threat Detection System Group−IB THREAT ... · group-ib.com How Threat Intelligence Works • Your security systems continuously detect threats. • Threat Intelligence

Advanced Threat Protection · 2020. 9. 25. · Intelligence Microsoft Defender Advanced Threat Protection Azure Active Directory Office 365 Advanced Threat Protection Microsoft Cloud

Staying Sharp on Security - Realcomm · Staying Sharp on Security Cloud threat intelligence Compromised accounts Takeaways from the Microsoft Security Intelligence Report Microsoft

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

OpenDNS Cloud-Security & Threat Intelligence - Cisco · OpenDNS Cloud-Security & Threat Intelligence . 2 CONFIDENTIAL AUTHORITATIVE DNS Owns and publishes ... SporB_OpenDNS_Advanced

THREAT INTELLIGENCE - CrowdStrike

Counter Threat Unit™ Threat Intelligence

Kaspersky Threat Intelligence Portal...Threat Intelligence Resource Subscribers to Kaspersky’s Threat Intelligence Portal enjoy a single point of entry to: Kaspersky Threat Data

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Threat Intelligence - NCC Group · Introduction Threat intelligence: a maturing defence differentiator Understanding the types of threat intelligence: from the generic to the specific

Crowd-Sourced Threat Intelligence

SMARTER Threat Intelligence · Our threat intelligence is derived from the Webroot® Threat Intelligence Platform, our proprietary cloud-based security analysis architecture designed

Oracle and KPMG Cloud Threat Report 2019 · 2019-03-22 · currently has a problematic shortage of existing skills? ORACLE AND KPMG CLOUD THREAT REPORT 2019 Deﬁning Edge Intelligence:

State of Threat Intelligence Studyf6ce14d4647f05e937f4-4d6abce208e5e17c2085b466b98c2083.r3.cf1.rackcdn.c…Operationalizing Threat Intelligence .....11 2016 Threat Intelligence Agenda

THREAT INTELLIGENCE PLATFORMSdocs.media.bitpipe.com/io_12x/io_128188/item_1253423/ThreatCon… · Effective threat intelligence management is an ongoing effort. The threat landscape

Threat Intelligence Solution Demonstration

NETSCOUT THREAT INTELLIGENCE REPORT · NETSCOUT Threat Intelligence LETTER FROM NETSCOUT THREAT INTELLIGENCE Today, attackers can release enormous terabit-per second-scale DDoS attacks

Shellshock Threat Intelligence Report