This presentation forms part of the CTA's Threat Intelligence Practitioners' Summit
Thursday 29 September 2022, 15:00 - 15:30
Samir Mody (K7)
The traditional, fundamental principles of efficacy vis-a-vis threat intelligence (TI) pertain to relevance, action-orientation and timeliness. In more recent times our ideas of good TI also encompass context and diversity, however these hold good only as long as the fundamental principles remain inviolate.
Given the sheer volume of threats that plague our cyber world, the automated generation, vetting and distribution of complex, relational metadata is a modern requirement for any decent TI feed. The catch is that automation in TI automatically puts a great strain on those very fundamental principles of efficacy mentioned earlier. The pressure to provide quantity often leads to a compromise on quality, although efficacy per se is in the mind of the perceiver, i.e. subjective.
In this presentation we explore some criteria from a security labs' perspective to determine efficacy for a TI feed. This being done, we then provide tips on how to automatically process raw telemetry to generate a higher value feed. Thus we shall determine how to establish trust in a TI feed, both what you consume and what you generate, to help bridge the gap between mere theoretical TI and threat intelligence in practice.
 |
Samir Mody Samir Mody graduated from the University of Oxford in 2000 with a first-class Master’s degree in chemical engineering, economics and management. He spent over nine years at Sophos UK, the final three years as Threat Operations Manager of SophosLabs. Since August 2010 he has been running K7 Labs in Chennai, India. Samir has actively contributed to the IEEE Taggant System project and other industry collaborations such as AMTSO and CTA. He has co-authored and/or presented papers and participated in panel discussions at various international security conferences (EICAR, VB, AVAR). Samir’s interests include reading (philosophy, politics, history, literature and economics), sport and classical music. |