1. Evolution Of Cybersecurity
Role Of Threat Intelligence
Bisakha Chakraborty ITIL, CISA

2. Agenda Story of Evolution Are we at war The Cyber Killchain
Threat intelligence
Questions

5. Video

6. Story Of evolution 1945 1963 ARPANET 1969 1970 1979 1983 Cyberspace
1984
1986
1988
Creeper and CERT
1990
Norton Antivirus
2000

7. Are we at war?
“Cyberwarfare involves the battlespace use and targeting of computers and networks in warfare. It involves both offensive and defensive operations pertaining to the threat of cyberattacks, espionage and sabotage”
Pan European engagement preparedness for Cyberwar
China’s shift in behavior post PLA accusation of cyber espionage for economic gain
India has been attacked by Pakistan Haxor crew leading to breach of Indian military and government . India is developing both offensive as well as defensive security
US is checking its preparedness and deploying techniques to deter sophisticated attacks from adversaries
Russia has become more aggressive in recent years as far as interfering in political processes of other countries are concerned
Middle East is the worst affected from cyber warfare however the capabilities cannot be underestimated taking into light the Stuxnet attacks, Ababil campaign and Saudi Aramaco incident

8. Cyber Kill chain Recon Weaponise Delivery Exploit Install C2
Action on Objectives

9. Power Of Threat Intelligence
Threat intelligence as defined by Gartner is “the evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.”
Identify attacks proactively
Contextual and actionable
Insight into attack methodologies
Enable us to respond to cyber incidents timely
Share known indicators with trusted entities

10. Categorize Threats as relevant to You
Malware – Wannacry, Fireball, Petwrap , Bad Rabbit
Vulnerability – SMB Double pulsar, FREAK, DROWN , Apache Struts , CCleaner
Mobile malware – SMS VoVA, Copycat, Marcher, Triada , Dvmap, Svpeng
Phishing -
Major Breaches – Equifax, Deloitte , Reliance JIO, Amazon Echo, Etherium, SSN breach
Attack groups- APT 10, APT 33, Blackoasis, APT 29

11. Video

12. How to action the intelligence gathered
Intrusion detection system
Firewall
gateway
Proxy
Endpoint protection
SIEM

13. IRP Detection Analysis Recovery Evidence collection Post Incident
Initial assessment of event
Reporting
Identifying stakeholder
Document
Assessment
Triage
Containment
Evidence
Initial Recovery
Evidence collection
Analysis and investigation
forensics
Remediation
Post mortem
RCA
Reporting
Post Incident

14. Questions ?