4 ms·

Hey so I work for one of the orgs that uses cyber threat data to catch bad guys, and I can help explain a bit about what "cyber threat data" actually is. Obvio

Hey so I work for one of the orgs that uses cyber threat data to catch bad guys, and I can help explain a bit about what "cyber threat data" actually is. Obviously the caveat here is I'm speaking as an individual with experience and not really as a rep for my company, but I see a lot of misinformation about what kind of information "cyber threat data" actually is, so I'd like to help clear the air a bit. Also keep in mind I'm a developer, not a guy "in the field". Edit: Just for a little background, I can give you guys some examples of what this "cyber threat data" actually looks like. My company came up with this format called an "IOC", or "Indicator of Compromise" that can be fed into network and endpoint detection tools to search for threats. Here's the website: http://openioc.org/ http://openioc.org/ At the bottom are a few links to some examples, where you can see exactly what "cyber threat data" is, in reality. http://openioc.org/iocs/c32ab7b5-49c8-40cc-8a12-ef5c3ba91311.ioc http://openioc.org/iocs/c32ab7b5-49c8-40cc-8a12-ef5c3ba91311... http://openioc.org/iocs/6d2a1b03-b216-4cd8-9a9e-8827af6ebf93.ioc http://openioc.org/iocs/6d2a1b03-b216-4cd8-9a9e-8827af6ebf93... http://openioc.org/iocs/ea3cab0c-72ad-40cc-abbf-90846fa4afec.ioc http://openioc.org/iocs/ea3cab0c-72ad-40cc-abbf-90846fa4afec... http://openioc.org/iocs/72669174-dd77-4a4e-82ed-99a96784f36e.ioc http://openioc.org/iocs/72669174-dd77-4a4e-82ed-99a96784f36e... You've got FileExtension, FileFullPath, PID, EventLogItem, DriverItem, and so on. It's not like this information can't be identifiable, as it's not anonymized, but it's just plain unfair to say this is your email address, social security number, browsing habits, or anything like that. This isn't data about you.

bagels 12y ago
So, what is the misinformation, and the corrected information?
ingler 12y ago
> This isn't data about you. It's espionage by a government against its citizens. It is about us.
- diminoten 12y ago
  ...did you not read anything I just wrote?
  - ingler 12y ago
    I thought the topic of the thread was government espionage, not the private interests that are partnering with the government.
    - diminoten 12y ago
      I urge you to read the linked article so you get an idea of what this conversation is actually about.
      - ingler 12y ago
        I know what this conversation is about. We've all been watching the .gov surveillance/espionage Beast rise for our entire lives.
        diminoten 12y ago
        If you think this is about espionage or surveillance, then you A) didn't read the article linked and B) didn't read any of what I wrote.
unethical_ban 12y ago
Why does there need to be secrecy and indemnity for corps sharing non-PII data? Everything I've heard about these CISPA-esqe sharing schemes is that the gov wants to have corps share potentially unmasked data with the gov AND with each other without risk of getting in trouble for privacy violations.
- diminoten 12y ago
  Secrecy mostly because it's live intel -- these aren't your run of the mill hackers, they'll adapt. If you publish your intel each month publicly, they'll just make sure to run your intel against their latest malware and make sure you can't detect them. Indemnity I'm not fully versed on (I'm just a dev, and this is more of a law area), but I get the idea that they want to be able to say, "Block these domains, and watch out for these email addresses -- they're spear phishing addresses" without getting in trouble for sharing those email addresses in the first place. After all, if we're hunting for hackers, and the hackers end up being users of your website, do the hackers suddenly get immunity from being detected? If I see "l33th4x0r12345" as a user on my system, and I know that user just tried a bunch of XSS on my support staff, I'm going to want to let other groups know that "l33th4x0r12345" is a bad actor.
  - unethical_ban 12y ago
    But this is already being done. Look at FS-ISAC - a private email list that shares IOC and spam data between banks and financial institutions. What needs to change in the law that isn't currently allowed?
    - diminoten 12y ago
      This is a valid question, and honestly I'm not sure. Once you're asking this question though, you've gotten past the point I think a lot of folks are hung up on, and that's the content of the intel. I'd just like to get folks to a point where they're understanding that their mother's maiden name isn't getting blasted through the cybersecurity world.
    - 12y ago

bagels 12y ago

So, what is the misinformation, and the corrected information?

ingler 12y ago

> This isn't data about you. It's espionage by a government against its citizens. It is about us.

diminoten 12y ago
...did you not read anything I just wrote?
- ingler 12y ago
  I thought the topic of the thread was government espionage, not the private interests that are partnering with the government.
  - diminoten 12y ago
    I urge you to read the linked article so you get an idea of what this conversation is actually about.
    - ingler 12y ago
      I know what this conversation is about. We've all been watching the .gov surveillance/espionage Beast rise for our entire lives.
      - diminoten 12y ago
        If you think this is about espionage or surveillance, then you A) didn't read the article linked and B) didn't read any of what I wrote.

unethical_ban 12y ago

Why does there need to be secrecy and indemnity for corps sharing non-PII data? Everything I've heard about these CISPA-esqe sharing schemes is that the gov wants to have corps share potentially unmasked data with the gov AND with each other without risk of getting in trouble for privacy violations.

diminoten 12y ago
Secrecy mostly because it's live intel -- these aren't your run of the mill hackers, they'll adapt. If you publish your intel each month publicly, they'll just make sure to run your intel against their latest malware and make sure you can't detect them. Indemnity I'm not fully versed on (I'm just a dev, and this is more of a law area), but I get the idea that they want to be able to say, "Block these domains, and watch out for these email addresses -- they're spear phishing addresses" without getting in trouble for sharing those email addresses in the first place. After all, if we're hunting for hackers, and the hackers end up being users of your website, do the hackers suddenly get immunity from being detected? If I see "l33th4x0r12345" as a user on my system, and I know that user just tried a bunch of XSS on my support staff, I'm going to want to let other groups know that "l33th4x0r12345" is a bad actor.
- unethical_ban 12y ago
  But this is already being done. Look at FS-ISAC - a private email list that shares IOC and spam data between banks and financial institutions. What needs to change in the law that isn't currently allowed?
  - diminoten 12y ago
    This is a valid question, and honestly I'm not sure. Once you're asking this question though, you've gotten past the point I think a lot of folks are hung up on, and that's the content of the intel. I'd just like to get folks to a point where they're understanding that their mother's maiden name isn't getting blasted through the cybersecurity world.
  - 12y ago