Threat Intelligence Academy

Starting and Growing a Cybersecurity Career

Sergio Caltagirone — Thu, 25 May 2023 18:01:29 +0000

*All content on this post was human-generated from 20 years of experience.

Cybersecurity is a large field of study and practice. It can be daunting to start and grow a cybersecurity career. However, cybersecurity spans from extremely technical work to legal, policy, governance, and project management providing opportunities to almost everyone’s unique skills and talents. Two areas of particular interest are the connected fields of digital forensics and threat intelligence.

After over 20 years practicing in the field and mentoring and hiring hundreds in the field, I’ll share some insights for those who want to grow in this area. Maybe most importantly, I’ll share some “hidden” knowledge that is not widely discussed.

Training and Education

Here is what you need to know: training, and education are not very important to managers – they’re nothing but proxies for experience. Experience matters far more to hiring managers. In fact, after 3-4 years in your cybersecurity career and with a well-written resume you could remove the education section from your resume and you’d be fine (I don’t recommend that, but use it as an illustrative point).

Cybersecurity Certifications

Cybersecurity certifications can be important for two reasons (1) you trying to break into a specialty or new to cybersecurity, (2) your job requires it. Certifications can be a path to experience. Otherwise certification chasing is not going to dramatically improve your career over time. In fact, you’ll find many professionals after 7-8 years start removing certifications from their resumes. Instead take courses which develop specific knowledge skills or areas you need to improve.

Traditional Education/Higher Education

Unlike many other fields, traditional education matters less in a cybersecurity career. Degrees in cybersecurity are still not universal and alone don’t provide much context to your skills and abilities. HOWEVER, many jobs will require a 2 or 4 year degree (of which I completely ethically disagree with) and therefore they may be a necessary ticket to getting some positions.

What I, as a hiring manager, actually do love are those with non-technical higher education degrees – philosophy, journalism, literature, history, psychology, politics, etc. Partnered with some technical knowledge these individuals are usually the most capable individuals I’ve ever hired.

Remember: it takes longer to learn how to communicate and think critically than it does to dissect a packet or a binary.

Military Training

Many cybersecurity experts came from the military. This is very valuable experience. It is not a golden ticket to cybersecurity however. For many it comes down to their communication skill in explaining verbally and via their resume how their experience translates into a position. However, it does provide a benefit to a cybersecurity career generally.

Non Cyber/Technical Training

Don’t forget about all of the other skills and abilities you need to rely on! Writing, public speaking, critical thinking and analysis, PowerPoint slide development (I’m not even joking), business dinner etiquette. Think more broadly about your skillset and you’ll find yourself even more marketable.

Starting a Cybersecurity Career

There is an old adage that your first job will determine your career more than other decision. There is SOME truth to that – but most of that truth comes from the decisions we make rather than those which are made for us.

Cybersecurity is a relatively new profession. Therefore, many of the “old adages” need not apply and you have more power and opportunity than you think you do. Your first position in cybersecurity is only a small stepping stone. It isn’t insignificant but it isn’t the determining factor many think. Therefore, at this point in your career focus on just getting a position that follows these general guidelines:

First Cybersecurity Jobs: Where to Start?

Government cybersecurity positions. Governments, ahead of most other employers, will provided and pay for training early in your career. This is a great place to start.
Look for “operational” experience such as in incident response or security operations. Even if your interests lie beyond that area, this experience will make you better in all areas of cybersecurity.
Look for positions in bigger organizations rather than smaller as they usually spend more money on training and employee development.
Ignore your first job title – focus instead of the job’s role and the experience you’re going to gain.
Get a position within a security division of an organization. Not only will this help guarantee you’re going to the position you’re looking for but this will look better on your resume when you progress.
Paid internships are AMAZING. Unpaid internships are exploitation.

Applying for Positions

Applying for positions is a terrible thing. It’s impersonal, imperfect, and highly biased. Here are some things I’ve noticed that can help you.

Write a cover letter for positions you really want. As a hiring manager this is my only chance to get to know you and you can tell me any story you want.
Focus on the EXPERIENCE and RESULTS on your resume. Don’t tell me what you did but what happened because of it. If you can’t do that on a resume I can’t trust you can explain the impact of your actions in your daily job.
Apply directly on a company site instead of a job board site. In many cases these systems are not connected and many managers and HR people don’t look at the job boards often enough but those who directly apply get attention.
Positively interacting with people from your potential employer and hiring manager on social media can be very helpful – especially if you establish some sort of informal relationship well before you apply.
Use your social network – tell people you’re looking, have people ask others on your behalf.
Ask directly if they have an internship program which isn’t advertised (many companies do).

Growing Your Cybersecurity Career

A dirty secret in the cybersecurity community: where you work or have worked has more weight than what you did. There are many reasons for this (none of them good or ethical) but it is important for those choosing a career path to understand the reality of the situation. Therefore, choose your employer more critically than you choose your job.

Cybersecurity is ALWAYS changing – therefore, while many like to have a career path mapped out, many find the map expires after too long as the field changes. Therefore, be flexible and creative in your career path. There is no “one path” or “right path.” That same note applies to general progression – in many cases you’ll need to explore a ‘lateral’ position change to get tangential experience before you can move ‘vertically.’

Changing jobs (and employers) is critical to your cybersecurity career path. The quickest and most effective way to improve your career is to quit. While this message is unfortunate I can’t help but give you the truth. You should probably change employers every 3-5 years. Leaving a position after less than a year is a ‘red flag’ without an explanation, but in this industry anything more than a year is generally reasonable.

Another important element is communication and community. It is important to write or contribute to blog posts. Consider writing for an academic journal at some point. Write and distribute blog posts about things you learn. Attend and present at conferences. These are all important elements to growing your career and sharing knowledge with others.

Career Progression

While there is no formula or common consensus as to a standard career progression. As a long-time manager here is what I’ve seen for individual roles across the industry.

An internship should last 3-9 months possibly up to a year. Internships are not guaranteed to turn into full-time employment nor should you expect that. In fact, at the end of your internship I recommend you start applying to many positions so as to gauge your market worth before accepting the first position offered. Never accept an unpaid internship. That is just exploiting you. The cybersecurity domain has enough money to pay everyone working a reasonable salary.
You can expect to spend 1-2 years in an entry or associate position before either being promoted or (more likely) changing jobs into a full individual contributor role.
You can expect to spend another 2-3 years as an individual contributor before being promoted or (more likely) changing jobs into a senior role.
A senior individual contributor in cybersecurity should have expected 4-5 years in the field before being promoted to this level. Expect to be at the senior level for anywhere between 2-6 years depending on your specialty – a more unique and in-demand specialty will be promoted quicker usually.
It is usually at this level and time that professionals begin to consider whether they want to stay individual contributors or move into management. Being a great individual contributor is not an indicator as to how good of a manager you will be – these are radically different skill sets. Therefore, find manager mentors and talk to them and have them evaluate both your management skills and your desires before selecting management. Note: managers should not necessarily be compensated more than their employees. Managers don’t carry any more responsibility or risk than any individual contributor – the skills and objectives are just different. Furthermore, it is individual contributors rather than mangers that are usually terminated for performance and therefore carry higher risk overall.
A principal individual contributor in cybersecurity should have about 10 years or more in the field to reach this level.
Above principle are individual contributor titles like: lead, technical director, distinguished, expert, etc. These levels are usually reached after 13-17 years in cybersecurity.

For management roles, timelines are radically different because the skill sets necessary to be an effective manager are far different than those that make you successful in cybersecurity in general.

Selecting a Cybersecurity Specialty

At some point in your early cybersecurity career you should consider selecting a specialty. I would recommend this about 3-5 years into your professional career.

Being in cybersecurity is like being an engineer or doctor in many ways. There are some generalists but that isn’t how people succeed in these field. Instead, you start your career in the general field but then you specialize. In cybersecurity you can specialize in lots of topics. Plus, many topics are tangential which means these areas can give you latitude to float across them more easily.

Most importantly, you’re not stuck in a specialty!! All you need to do is follow the advice below to start a new specialty when you want. Like medicine and engineering, many fundamentals transfer across specialties which will make transitioning easier.

Some cybersecurity specialties include: compliance, governance, security operations, incident response, threat intelligence, digital forensics, architecture design, security product development or management, secure coding and development, malware analysis, law and policy, etc.

You ‘select’ a specialty in three ways:

Gain experience, knowledge, or education in that specific area
Get a mentor that also specializes in that area
Contribute to communities of that specialty
‘Advertise’ your specialty: rewrite your resume focusing on your experiences in that area, modify your social media presence around that area, create content like blogging around that area
Lastly, get a job focused on that specialty (using your mentor and communities you’ve built in previous steps)

Mental Health

I’ve been very open with my burnout, stress, and anxiety challenges. Read More.

Remember, you are not your job. Your value is not determined by your work or your employer.

Try not to carry the world. Yes, you want a job that makes a difference. Cybersecurity is important, worthy, and an honorable field. But, don’t give more than is reasonable. You are your best advocate, fight for yourself. It’s okay for a job to be a job and not a “passion” or “what you love.”

Some Things That Helped Me

A common question I get regularly is: what helped you achieve success in your career? Let me answer that here.

Communication. More than any other skill, my time spent learning how to write and present to a variety of audiences is the most important skill I have. It doesn’t matter how good your ideas are, if you cannot communicate them they don’t matter much.
Friendship, Honesty, and Community. I only leave friends behind wherever I go. I reach out to learn from others. I’m an introvert, this isn’t easy, so when I feel myself wanting to shrink back is when I give myself the push to be more outgoing.
Analysis. The ability to collect, research, and explore data and ask the right questions to efficiently get to actionable results. One of my greatest teachers was were studies in theology which taught me effective textual and literary analysis techniques – how to find clues and contextual information in obscure and ancient writings.
Give Help and Ask for Help. Nobody lives in a vacuum and it is only together that we thrive. When someone asks for help you should try to give it. And in turn, you should not be ashamed to ask for help.

Watch the Webinar

The post Starting and Growing a Cybersecurity Career appeared first on Threat Intelligence Academy.

ChatGPT, Artificial Intelligence, and Cyber Threat Intelligence: a moment in time

Sergio Caltagirone — Fri, 03 Feb 2023 17:29:22 +0000

It is safe to say that the Chat GPT function from OpenAI has created a firestorm of conversation about the applications of artificial intelligence (AI) in knowledge work and scholarship, which includes cyber threat intelligence. Can ChatGPT really replace the thought and knowledge work done by many people? That question is outstanding and I cannot answer, nor can anyone yet with any certainty.

But, it’s application to various topics, including cyber threat intelligence, is in question – and by proxy, it’s impact on those topics.

So, let me provide some perspective after 20 years of cyber threat intelligence AND having employed artificial intelligence and machine learning in this space for the last 10 years at least.

Before we pass any judgements, we must be clear of which we are speaking. Chat GPT is a ‘chat bot,’ a simulated human chat client. Its role is not of ‘knowledge maker.’ While it is impressive as to what it can produce, there is no question that using this particular AI for larger ‘knowledge making’ applications would be a mistaken application of this technology. AI models are very specific to their function and expected output. When used outside those applications there are many well-known errors. You wouldn’t use a self-driving application to write a historical essay.

So, my first point is: using ChatGPT in the production of threat intelligence would be a misapplication of this specific technology implementation. ChatGPT is a ‘chat bot’ designed and engineered to simulate human conversation and interaction. It was not built as a ‘expert system’ which the type of AI and ML would need to be to ‘speak more authoritatively’ on a subject. The output of ChatGPT sounds authoritative not because of its ability to analyze knowledge but because it uses short declarative sentences in active voice as we normally do in conversation. Unfortunately, when we communicate knowledge, we also use short declarative sentences in active voice. Do not confuse sentence syntax with knowledge.

My second point is: machine learning and artificial intelligence implementations are ripe for adversarial interference. Its actually very easy, without defense mechanisms, for humans to influence AI and ML models to produce incorrect output (both intentionally and unintentionally). Therefore, without verifiable defense mechanisms against adversarial environments (and verified inputs for which it learns), one should not trust the output of AI and ML. See research on bias in AI.

My third point is: that it is important that for intelligence to be accurate not only must its output be critically examined, but so must the mental processes by which it is produced. ChatGPT is a ‘blackbox’ meaning that its full analytic process is designed to be hidden from the user. In fact, without all the facts I would argue that ChatGPT likely uses significant amounts of ‘fuzzy logic’ and other probabilistic and predictive approaches which inhibit the ability to question its logic. This means that we cannot actually verify ChatGPT used appropriate structured techniques, strong hypothetical generation and testing, and bias reduction that we require to produce good intelligence.

My fourth and last point is: ChatGPT is not secure (as are most ‘community ML’ programs). It learns from the input of its users. All of your input to ChatGPT are also sent back to the company to build better algorithms. Therefore, with the sensitivity of many cyber threat intelligence topics, I would recommend against sending the ChatGPT engine any sensitive content or questions.

Therefore, it would be a mistake for intelligence analysts and producers to leverage ChatGPT in anyway in their work until these questions can be addressed effectively.

This is not due to any fear of AI but simply because of the issues I’ve described above and their criticality to the production of quality intelligence. Machine learning and artificial intelligence can be leveraged in a threat intelligence processes, but it must address the issues I’ve outlined first.

The post ChatGPT, Artificial Intelligence, and Cyber Threat Intelligence: a moment in time appeared first on Threat Intelligence Academy.

CART: The 4 Qualities of Good Threat Intelligence

Sergio Caltagirone — Mon, 31 Oct 2022 14:02:46 +0000

I write often of poor quality threat intelligence which pervades the security community. Poor quality threat intelligence not only has a heavy cost on its consumers, it also threatens the confidence threat intelligence consumers place in their providers. Confidence is the cornerstone of threat intelligence. Nobody will take intelligence from an untrustworthy source and act – at least they shouldn’t. It is important that the producer and consumer trust each other. That trust needs to be based on transparency and verification.

However, how does one appropriately assess threat intelligence? The first step must be to identify the qualities which define “good” threat intelligence. However, these are not binary qualities – there is a clear gradient based on use case. Timeliness is a good example of this gradient as some intelligence (likely more strategic) has a more fluid timeliness requirement while tactical threat intelligence has stricter requirements.

Further, one single threat intelligence source will not likely be able to satisfy all qualities simultaneously. For instance, it is unlikely any one provider will have complete visibility across Diamond elements or Kill Chain phases and consumers will have to rely on more than one to achieve satisfactory completeness.

The four qualities are (CART): Completeness, Accuracy, Relevance, and Timeliness.

Completeness

Threat intelligence must be sufficiently complete to provide effective detection and (hopefully) prevention. For instance, providing a domain indicator used in the exploitation of only one victim is not sufficient for other victims and therefore the intelligence is effectively incomplete and unhelpful.

Accuracy

Threat intelligence must save organizations more in success than it costs them in errors and mistakes.

Relevance

Threat intelligence must address a threat to the organization in a method that allows for effective action. Intelligence addressing threats not faced by the organization is of no value. Further, intelligence delivered in a type or method not usable by the organization is also unhelpful.

Timeliness

Threat intelligence must be received and operationalized fast enough to make an impact more valuable than the cost of the threat intelligence itself.

The post CART: The 4 Qualities of Good Threat Intelligence appeared first on Threat Intelligence Academy.

Intelligence or Marketing? Which is it and how to tell using the ADEPT model

Sergio Caltagirone — Sun, 05 Jun 2022 14:26:24 +0000

It is common to ask whether a blog or whitepaper by a cybersecurity company is marketing FUD (fear, uncertainty, doubt) or valuable threat intelligence. Funding bias is a real issue. Particularly in funded research studies. Funding bias (or sponsorship bias) is more subtle in cyber threat intelligence because private cybersecurity companies rely on customers to stay in business and employ their staff. It is common for companies to use threat intelligence as a component of marketing. Let’s first put this to rest: on principle this is not wrong.

The real issue for customers, readers, users, analysts, etc. is to find out if a company’s ‘intelligence’ posting has actual intelligence value or whether it is intelligence disguised as a marketing or sales generator.

In my 20 years of experience with years of working alongside marketing and sales while managing and operating intelligence teams, I have some unique insight into this problem. It’s not easy and it’s always a balance. On one hand, you want to publish the absolute best intelligence possible AND you want everyone to know about it – this is where marketing and sales comes in. The more people know about useful intelligence the more useful it becomes. We cannot ignore that unique value proposition to cyber defense. On the other hand, I want to stay employed and continue to employ others doing great work – and we need sales and marketing support to do that. Cyber threat intelligence at scale cannot be a volunteer effort, and as we should expect to pay people for their time and skills, we should expect intelligence analysts to get paid as well.

Therefore, every public release of intelligence from a private company is necessarily part of sales and marketing – even if unintentional. But, it’s not binary either, as every public intelligence release is neither “only sales” nor “only intelligence.” So, we need to find a way to distinguish when a piece of content is more marketing or more intelligence.

I’ve developed this simple rubric that I use daily in both the production of intel (to prevent falling into traps) as well as the consumption of intel (to help quickly identify useful intelligence).

This rubric I call the ADEPT Model to evaluate threat intelligence and marketing.

It is very simple. The ADEPT model has five elements: Avoidance, Defenses, Emphasis, Pitch, and Technicality. Every piece of public threat intelligence content can be evaluated on whether it has the element or not: giving it a 1 or 0 score for that element. Simply add up all the points across the five elements and the more ADEPT (points) a piece of content receives the more intelligence value it likely contains. As an analyst I must always preface that all models are bad, but some are useful. I also consider this model terrible, but at the same time useful 🙂

The 5 ADEPT Elements

Avoids mentioning product categories, product names, or buzzwords: words like ‘orchestration’ or other buzzwords in threat intelligence is inappropriate.
Defenses a reader can take themselves regardless of product: good intelligence will always provide useful defensive action regardless of product.
Emphasis on the activity, instead of the product responsible for finding it: most marketing will focus on the business case, while intelligence will focus on the activity.
Pitch for a product or service is left to the end: businesses must pitch their products or services, but these must be at the end or clearly differentiated from the intelligence.
Technically competent material: while threat intelligence should try to avoid ‘jargon’ it won’t hide from accuracy.

ADEPT Example: Intelligence vs Marketing

Learn ADEPT and the whole practice of Cyber Threat Intelligence here at the Threat Intelligence Academy! (see what I did there?)

The post Intelligence or Marketing? Which is it and how to tell using the ADEPT model appeared first on Threat Intelligence Academy.

Writing Your First Journal Article and Submitting to the Journal of Threat Intelligence and Incident Response

Sergio Caltagirone — Fri, 04 Mar 2022 20:53:33 +0000

The Journal of Threat Intelligence and Incident Response focuses on topics, lessons, and knowledge of immediate practical value to practitioners in these fields. What does that mean? It means the editors are looking for knowledge that has worked for you or your organization in finding, tracking, remediating, and understanding cyber threats.

MOST cybersecurity professionals have never submitted a journal article in their career. This means for most, the idea of submitting a journal article may be new or even a bit frightening. Second, journals have historically been known and understood only in the most privileged environments and circles leaving many individuals behind and left-out of contributing through this mechanism.

So, considering all that I wanted to create a short page on demystifying the process and reduce some stress about what this is about.

Also, read this JTIIR Quick Start.

Am I, or Is This Idea, Good Enough for a Journal?

“Our doubts are traitors, and make us lose the good we oft might win, by fearing to attempt.” – William Shakespeare

First, stop asking if you or your ideas are good enough. They are. In the progress of everyone’s career we solve a problem that others want to know “how did you do/know that?!” That’s it. It’s good enough. 😊 The purpose of this Journal is to capture, propagate, and archive all those improvements we’ve all made so the community can build on those to everyone’s benefit.

This means we’re looking for content applicable to ALL professional levels. Your idea is not “too basic” for submission.

Check the Topics of Interest page to make sure your idea is relevant to the purpose of the journal.

Where To Get Ideas?

Another question I normally get: where do I get an idea to submit?

Have you written a blog or whitepaper, presented a webinar, recorded a video, submitted or presented at a conference? Those are great places to start and JTIIR submissions can come from all those sources.

Have you solved a problem during your work that led to a significant impact on finding, tracking, or remediating cyber threats?

Do you have unique insight or unique perspective on a substantial unsolved or controversial problem within threat intelligence and incident response?

All of those are great areas to consider.

I’ve Submitted to a Conference, Why Should I Submit to a Journal?

First, great job! Thank you for contributing anywhere for the benefit of the community.

A conference is a great place to share ideas but rarely are they good places to archive ideas so that they’re relied upon years later. Some conferences stream or post their conference presentations but many do not. Nor are conference presentations reviewed for content accuracy and rigor.

We encourage you to not only give conference presentations but then consider writing your content up in journal form so that it can be further strengthened through review and archived and shared far into the future.

How Long Does It Need to Be?

As long as it needs to be is the only answer. Length is never a consideration for acceptance. In fact, THE SHORTER THE BETTER.

I personally recommend that for an articles with the greatest impact to target between 4 and 10 pages.

How Should I Start Writing a Journal Article?

Start simply. Just state the problem you had or the problem you see. Then state your solution. Try to make that no more than 3 or 4 sentences. Forget formatting or length.

Imagine a person pulled up a chair next to you and with wide eyes asked you “how did you do that?!” I like to call this part, “The Journey.”

Now, just tell them.

When you’re done go back and break up the journey into 3-5 parts. You can call these “sections.” And now examine if each section is sufficient. Imagine the person next you asks, “can you tell me more about that?” And, “why did that work? Would it work for me?” Provide a little more insight and evidence that what you did worked and would likely work for others. Have others tried it too and did it work? We call this “rigor.”

Start finding external references – search for others who’ve worked on something similar and inject those where they fit.

Now, look deeper for related work. Has anyone else written anything similar to what you’re discussing? Most likely they have – write that up in a few paragraphs into a “Prior Works” section.

Write an introduction, paint a picture for your audience. How did you “find” the problem? How common is the problem you’re describing? What would be the benefit of solving it?

Write a conclusion, take your introduction and turn it around – start with your solution (“here is what we did”) and then end with the problem statement (“and we’ve shown this approach to effectively do X”).

Lastly, go back to the top where you write those originally 3-4 sentences and you’re going to turn that into an “abstract.” All you do is state the problem, provide a sentence for each of the 3-5 parts, then state the value of what you’ve done. Now CUT! Cut it down to 150 words or less.

Congratulations! You’re basically done! You should have all the ingredients of a Journal article. An abstract, introduction, prior works, 3-5 sections describing your solution along with citations and evidence, and a conclusion.

The hardest part is to format what you’ve done using this Style Guide.

Do I Need to Write the Whole Thing?

NO!

Writing a “article” is a scary endeavor. It’s not easy for most of us (including me).

Plus, you may not be willing to make a commitment. What if you spend weeks writing an article and it gets rejected? Nobody wants that.

You can submit just an abstract, draft, or outline and the editors will provide you feedback on (1) whether the idea is a fit and (2) whether it approaches the problem and topic properly for a journal article.

However, the more of an article you provide – even just a draft or outline, the more we can evaluate and provide more valuable feedback.

But, I fully and personally recommend you try to write the whole thing before you submit. The reason? Because in the end you’ll have a fabulous piece of work you can submit or post elsewhere even if not in the JTIIR. Plus, if you’ve not written a journal article, or have had little practice, I suggest you try it!

How Do I Submit?

When you’re ready you’ll create an account and submit HERE.

After I Submit, What Happens Next?

First, your name is entirely removed from the submission. We won’t know who you are to prevent bias.

Next, your submission will be evaluated as to its fit for the purpose of the journal. We won’t be evaluating you or your idea. We need to make sure your submission is within our scope which you can find here.

Then comes the biggest part: your submission will be sent to two or more reviewers. We try to match your subject with the reviewers that have the greatest experience in that area. The reviewers will then provide feedback and recommendations that you’ll receive.

An editor will then consider the reviewer’s comments and recommendations and decide whether to accept your submission. There are several categories: accept with no revisions, accept with minor revisions, accept with significant revisions, or reject.

Finally, if you’re accepted then your article will be scheduled. It’s important to understand that we are limited to a reasonable number of articles in each issue. Therefore, your submission may be accepted but scheduled for a later issue. This is common for any journal.

The post Writing Your First Journal Article and Submitting to the Journal of Threat Intelligence and Incident Response appeared first on Threat Intelligence Academy.

Combining the Diamond Model, Kill Chain, and ATT&CK

Sergio Caltagirone — Fri, 07 Aug 2020 17:10:41 +0000

Diamond Model, Kill Chain, and MITRE ATT&CK Oh My! So many models to choose. Luckily, you do not have to choose. These three seminal cybersecurity and intrusion analysis models are not conflicting, in fact, they are complementary, you use all three – together.

The Diamond Model is for analysts to hunt, pivot, analyze, group, and structure mitigation for intrusions. (Diamond Model of Intrusion Analysis)

The Kill Chain is a phase-structured detection and defense-in-depth against adversary operations ensuring a broadly capable cybersecurity defense. (Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains)

The MITRE ATT&CK framework classifies adversary tactics and techniques to “convey threat intelligence, perform testing through red teaming or adversary emulation, and improve network and system defenses against intrusions.” (MITRE ATT&CK™: Design and Philosophy)

Each model has different, but interrelated, use cases and by combining them an organization can build a more effective cyber defense program. Here are some examples of how you can combine these models:

Diamond “Phase” Meta-feature Maps Malicious Events to the Kill Chain As analysts discover malicious activity using the Diamond Model’s 720 hunting strategies, they can organize the activity by Kill Chain using the Diamond Model phase meta-feature. Importantly, Diamond Model Axiom 4 states, “every malicious activity contains two or more phases which must be successfully executed in succession to achieve the desired result.” For most analysts, the Kill Chain is the intrusion phase model they use to organize malicious events.

Diamond Activity Thread Analysis Uses the Kill Chain Phase Ordering Analysts naturally form Diamond Model Activity Threads when associating events. An Activity Thread is a Kill Chain phase-ordered causally linked set of malicious events which help analysts identify intelligence gaps and new hypotheses.

MITRE ATT&CK Tactics are Kill Chain Phases The ATT&CK framework classifies malicious activity into tactics and techniques. The ATT&CK tactics are a phase-ordered Kill Chain. While ATT&CK utilizes different phases for their framework from the original Kill Chain paper (as do many organizations and analysts), the specific phases are not the defining feature of the Kill Chain but rather the approach and methodology.

MITRE ATT&CK Techniques Describe Diamond Model “Methodology” Meta-feature The Diamond Model long lacked a consistent and effective taxonomy for classifying malicious behavior and methodology until MITRE ATT&CK even through the model had a “place holder” for such a momentous occasion. Analysts can use the Diamond Model “methodology” meta-feature to classify the behavior of each event for further analysis and inclusion in detection and mitigation strategies.

Threat Hunting with the Diamond Model Yields New ATT&CK Tactics and Techniques The ATT&CK taxonomy requires that analysts have previously discovered and analyzed a malicious technique prior to its inclusion in ATT&CK. Using the Diamond Model’s threat hunting “approaches” and threat hunting strategies analysts can more efficiently find new threats for ATT&CK classification. Anyone is welcome to submit new ATT&CK tactics and techniques here.

In summary, make sure you are using the full features of these models together to maximize cyber defense operations:

Diamond Model malicious events are mapped to the Kill Chain using the “phase” meta-feature, which is also the ATT&CK tactic.
Diamond Model malicious events are mapped to ATT&CK techniques using the “methodology” meta-feature.
Diamond Model Activity Threads use the Kill Chain analysis to develop defense and detection-in-depth strategies including “vertical correlation” for hunting hypothesis development.
ATT&CK tactics are a phase-ordered Kill Chain.
Analysts threat hunting with the Diamond Model approaches and strategies will find new malicious techniques to complete the ATT&CK taxonomy.

All three models work together to enable the development of comprehensive hunting, detection, defense, and mitigation strategies. We will discuss how these models can be used cooperatively in strategy development and why it is no coincidence these models are so well intertwined in future Moderately Confident posts. Stay tuned!

The post Combining the Diamond Model, Kill Chain, and ATT&CK appeared first on Threat Intelligence Academy.