Other People's Analysts
Over the last 6 years, I have been entrenched in Cyber Security.
Packet capture Network Forensics Identity and Access Management Threat Intelligence During my nPulse Technologies days (acquired by FireEye), I relearned all the network packet stuff that I had been taught in college. The OSI network layers, VLANs, Q-in-Q… oh boy! Reassembling packets (with python no less) was a REALLY fun exercise… never made it into the product, since there were open source tools that did it better (faster?).. but I did it…. then came the challenge of using the reassembled data in an application.
Imagine this now, you’re a cyber analyst. You’ve got some juicy intel from your ISAC (FS-ISAC? NH-ISAC?) … or maybe it’s from your industry buddies that you share intel with. You set up your alerting mechanisms, you set up your SIEM, and you wait.
PING! You get a hit! You know now have an IP address that a machine in your network tried to go to. You start your research, do a little OSINT, do some googling… find out it’s a shared host. Oh well.
False Positive.
You tell your buddies, and that’s it for the day.
Guess what just happened? Your group just got smarter because two of you did some work. The first guy set up the intel, and you validated it as a false positive. Since you both shared within your community, you just got smarter! You leveraged a few members of the community to make you all better!
This is the best scenario we have today. Some communities share data. Not many communities allow for automatic sharing of sightings (did you see that IOC in the wild?). NO communities allow you to share what you did in regards to that IOC. Did you block it in a Firewall? Did you mark it as a False Positive?
There aren’t many tools out there that can help this process.. The more we can share, the more we can attribute, the more we can automatically know what’s going on in the network of our peers, the safer we’ll all be.
We'd love to hear your thoughts. Find us on Twitter, LinkedIn or write in to hello@perchsecurity.com
Next: Tackling Expensive and Complicated Information Security
Share this on:
Subscribe to our blog