Intelligence-Driven Incident Response, 2nd Edition (5th Early Release)

Description

Cyber-threat intelligence isn’t a new concept, simply a new name for an old approach: applying a structured analytical process to understand an attack and the adversary behind it. The application of threat intelligence to network security is more recent, but the basics haven’t changed. Cyber-threat intelligence involves applying intelligence processes and concepts—some of the oldest concepts that exist—and making them a part of the overall information security process. Threat intelligence has many applications, but one of the fundamental ways it can be utilized is as an integral part of the intrusion-detection and incident-response process. We call this intelligence-driven incident response and think it is something every security team can do, with or without a major capital investment. It’s less about tools, although they certainly help sometimes, and more about a shift in the way we approach the incident-response process. Intelligence-driven incident response will help not only to identify, understand, and eradicate threats within a network, but also to strengthen the entire information security process to improve those responses in the future. Using a well-conceived incident response plan in the aftermath of an online security breach enables your team to identify attackers and learn how they operate. But only when you approach incident response with a cyberthreat intelligence mindset will you truly understand the value of that information. In this updated second edition, you'll learn the fundamentals of intelligence analysis as well as the best ways to incorporate these techniques into your incident response process. Each method reinforces the other: threat intelligence supports and augments incident response, while incident response generates useful threat intelligence. This practical guide helps incident managers, malware analysts, reverse engineers, digital forensics specialists, and intelligence analysts understand, implement, and benefit from this relationship. In three parts, this in-depth book includes: The fundamentals: get an introduction to cyberthreat intelligence, the intelligence process, the incident response process, and how they all work together Practical application: walk through the intelligence-driven incident response (IDIR) process using the F3EAD process: Find, Fix, Finish, Exploit, Analyze, and Disseminate The way forward: explore big-picture aspects of IDIR that go beyond individual incident response investigations, including intelligence team building 1. Introduction Intelligence as Part of Incident Response History of Cyber Threat Intelligence Modern Cyber-Threat Intelligence The Way Forward Incident Response as a Part of Intelligence What Is Intelligence -Driven Incident Response? Why Intelligence -Driven Incident Response? Operation SMN SolarWinds Conclusion Sources : 2. Basics of Intelligence Intelligence and Research Data Versus Intelligence Sources and Methods Models Using Models for Collaboration Process Models OODA Intelligence Cycle Using the Intelligence Cycle Qualities of Good Intelligence Levels of Intelligence Tactical Intelligence Operational Intelligence Strategic Intelligence Confidence Levels Conclusion 3. Basics of Incident Response Incident-Response Cycle Preparation Identification Containment Eradication Recovery Lessons Learned Kill Chain Targeting Reconnaissance Weaponization Delivery Exploitation Installation Command and Control Actions on Objective Example Kill Chain Diamond Model Basics of the Diamond Model Extending the Model ATT&CK & D3FEND ATT&CK D3FEND Active Defense Deny Disrupt Degrade Deceive Destroy F3EAD Find Fix Finish Exploit Analyze Disseminate Using F3EAD Picking the Right Model Scenario: ROAD RUNNER Conclusion 4. Exploit Tactical Versus Strategic OODA Loops What to Exploit? Gathering Information Information Gathering Goals Mining Previous Incidents Gathering External Information (aka Conducting a Literature Review) Extracting and Storing Threat Data Standards for Storing Threat Data Data Standards and Formats for Indicators Data Standards and Formats for Strategic Information Process for Extracting Managing Information Threat-Intelligence Platforms Conclusion 5. Analyze The Fundamentals of Analysis Dual Process thinking Inductive, Deductive, and Abductive Reasoning Case Study: The OPM Breach Analytic Processes and Methods Structured Analytic Techniques Target-Centric Analysis Conducting the Analysis What to Analyze? Enriching Your Data Leverage Information sharing Developing Your Hypothesis Evaluating Key Assumptions Judgment and Conclusions Things that are Gonna Screw You Up, Aka Analytic Bias Accounting for biases Conclusion 6. Strategic Intelligence What Is Strategic Intelligence? Sherman Kent: Father of American Intelligence Analysis The Role of Strategic Intelligence in IDIR Intelligence Beyond Incident Response Building a Frame with Strategic Intelligence The Strategic Intelligence Cycle Setting Strategic Requirements Collection Analysis Processes for strategic intelligence Dissemination Moving towards anticipatory intelligence Conclusion About the Authors