Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Building Effective Threat Intelligence Sharing
Search
Sponsored
·
SiteGround - Reliable hosting with speed, security, and support you can count on.
→
Scott J. Roberts
July 23, 2017
Technology
140
1
Share
Building Effective Threat Intelligence Sharing
A SANS Webex I did... awhile ago?
Scott J. Roberts
July 23, 2017
More Decks by Scott J. Roberts
See All by Scott J. Roberts
LLM SATs FTW
sroberts
0
1.2k
STRAT - A System-Centric Approach to Cyber Resilience
sroberts
0
68
Tortured Responders Dept - Scott & Rebekah's Edition
sroberts
0
150
Skynet the CTI Intern: Building Effective Machine Augmented Intelligence
sroberts
0
180
DRIVING INTELLIGENCE WITH MITRE ATT&CK: LEVERAGING LIMITED RESOURCES TO BUILD AN EVOLVING THREAT REPOSITORY
sroberts
0
110
Exploring Threat Intelligence: Insights and Tools from Vertex Synapse
sroberts
0
100
Homemade Ramen & Threat Intelligence
sroberts
2
600
Introduction to Open Source Security Tools
sroberts
3
5k
Japanese Manufacturing, Killer Robots, & Effective Incident Handling
sroberts
0
150
Other Decks in Technology
See All in Technology
MIX AUDIO EN BROADCAST
ralpherick
0
140
Even G2 クイックスタートガイド(日本語版)
vrshinobi1
0
190
TUNA Camp 2026 京都Stage ヒューリスティックアルゴリズム入門
terryu16
0
670
20260326_AIDD事例紹介_ULSC.pdf
findy_eventslides
0
370
JSTQB Expert Levelシラバス「テストマネジメント」日本語版のご紹介
ymty
0
110
Oracle AI Database@Google Cloud:サービス概要のご紹介
oracle4engineer
PRO
5
1.3k
Bref でサービスを運用している話
sgash708
0
220
CloudFrontのHost Header転送設定でパケットの中身はどう変わるのか?
nagisa53
1
250
40代からのアウトプット ― 経験は価値ある学びに変わる / 20260404 Naoki Takahashi
shift_evolve
PRO
4
750
AWSで2番目にリリースされたサービスについてお話しします(諸説あります)
yama3133
0
110
Blue/Green Deployment を用いた PostgreSQL のメジャーバージョンアップ
kkato1
1
230
GitHub Actions侵害 — 相次ぐ事例を振り返り、次なる脅威に備える
flatt_security
12
7.3k
Featured
See All Featured
ReactJS: Keep Simple. Everything can be a component!
pedronauck
666
130k
Optimizing for Happiness
mojombo
378
71k
What's in a price? How to price your products and services
michaelherold
247
13k
GraphQLとの向き合い方2022年版
quramy
50
14k
Paper Plane (Part 1)
katiecoart
PRO
0
6.3k
How to audit for AI Accessibility on your Front & Back End
davetheseo
0
230
Building Experiences: Design Systems, User Experience, and Full Site Editing
marktimemedia
0
470
WCS-LA-2024
lcolladotor
0
510
Embracing the Ebb and Flow
colly
88
5k
Stop Working from a Prison Cell
hatefulcrawdad
274
21k
WENDY [Excerpt]
tessaabrams
9
37k
ラッコキーワード サービス紹介資料
rakko
1
2.9M
Transcript
Building Effective CTI Sharing
Scott J Roberts
Comments? Use #ctisharing and/or @sroberts
Table Stakes
Talk to Legal
TLP https://www.us-cert.gov/tlp
• WWWWH&W • Example: My Story • What To Do
Next?
Why?
Your Security Will Improve
You Will Improve Others Security
Share More Get More
A rising tide raises all boats
When?
Ingestion vs. Production
When You’re Ready to Act
When You’re Ready to Reciprocate
When You Can Be Confident
Who?
Formal Groups
Open Source Groups
Informal Groups
BONUS: Orgs With Similar Technology...
BONUS: Competitors
What?
Indicators of Compromise
Tactics, Techniques, & Procedures
Reports
Techniques, Methods, & Capabilities
(Legally Required) Pyramid of Pain https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
Sharing Hierarchy of Value* * The Author acknowledges this is
a rip off
How?
Don’t Ask to Join
Be Trusting
Be Trustworthy
Be Action Oriented
BONUS: The Best Groups Have A Written Set of Expectations
& Procedures
Where?
Mailing Lists
Chat
Semi Structured
Threat Intelligence Platform
Hybrid
Example: My Story
This is Kyle @kylemaxwell
Kyle & I started a Slack
We Invited Folks We Knew Shared Tools & Techniques We
Invited More Folks
Kyle Invited Mark @markpars0ns
Mark Invited Me to Another Slack
Met New Folks Shared Intelligence Collaborated On Investigations Demonstrated Value
to My Boss
So I Invited My Coworker John @swannysec
What To Do Next?
What To Do Next • • • • • •
Go Make Friends & Share Intelligence
Join Me @ SANS Rocky Mountain 2017 for FOR578