Podcasts about threat intel

We dive into the murky case of the alleged Check Point Software breach—what hackers claim they stole, why the company says it's "handled," and why that may not be the whole truth. From admin access screenshots to quiet cover-ups, Darnley unpacks the risks and ask the tough questions security firms don't want you asking. Pour yourself a strong cup and tune in—you'll want to hear what they aren't saying.Click here to send future episode recommendationSupport the showSubscribe now to Darnley's Cyber Cafe and stay informed on the latest developments in the ever-evolving digital landscape.

In this episode of Breaking Badness, host Kali Fencl welcomes Wes Young of CSIRT Gadgets and Daniel Schwalbe, CISO and head of investigations at DomainTools, dive into a recent DomainTools Investigations (DTI) analysis involving ValleyRAT and Silver Fox, and how new tools are enabling faster, more accessible analysis for junior and seasoned analysts alike. Whether you're a threat intel veteran or an aspiring analyst, this episode is packed with hard-earned lessons, technical insights, and future-forward thinking. They also unpack the evolution of threat intelligence from early higher-ed days of wiki-scraped snort rules to today's graph-powered AI analysis. Wes shares the origin story behind his platform AlphaHunt, how it's being used to automate and enhance threat detection, and why community sharing remains essential even in an era of advanced tooling.

Grace Chi, co-founder and COO of PulseDive, takes us deep into the often overlooked world of cyber threat intelligence networking. Grace has become a passionate advocate for the human connections that power effective security programs, conducting groundbreaking research on how threat intelligence practitioners share information.What makes this conversation especially valuable is Grace's focus on the practical realities of threat intelligence implementation. She reveals that while formal structure or groups like ISACs provide important frameworks, the most timely and actionable intelligence typically flows through one-to-one relationships and trusted peer networks. These connections become critical during security incidents, when having someone who can provide just-in-time context about a threat can make all the difference between detection and compromise.The discussion tackles common pitfalls in threat intelligence program development, particularly the tendency to invest in platforms without proper implementation planning or ongoing maintenance resources. Grace offers concrete advice for organizations at different maturity levels, emphasizing the importance of starting with clear requirements, assigning dedicated point persons for implementation, and understanding pricing models before making significant investments.For those building threat intelligence capabilities from scratch, this episode provides a roadmap that focuses on identifying organizational pain points, leveraging existing talent, and implementing capabilities incrementally rather than attempting to configure every available feed immediately. Grace also highlights the critical distinction between external intelligence sources and the often-underutilized wealth of internal telemetry and observations.Beyond the tactical aspects, we explore how threat intelligence must be communicated differently to technical teams versus executive stakeholders, and how building a diverse network across multiple channels creates compounding value over time. Whether you're a seasoned security professional or just beginning to explore threat intelligence, this conversation offers insights that will help you build more effective security capabilities through the power of community.

Cybersecurity in Italy: ITASEC 2025 Recap & Future Outlook with Professor Alessandro ArmandoCybersecurity is no longer a niche topic—it's a fundamental pillar of modern society. And in Italy, ITASEC has become the go-to event for bringing together researchers, government officials, and industry leaders to tackle the biggest security challenges of our time.Although we weren't there in person this year, we're diving into everything that happened at ITASEC 2025 in this special On Location recap with Professor Alessandro Armando. As Deputy Director of the Cybersecurity National Laboratory at CINI and Chairman of the Scientific Committee of the SERICS Foundation, Alessandro has a front-row seat to the evolution of cybersecurity in Italy.This year's event, held in Bologna, showcased the growing maturity of Italy's cybersecurity landscape, featuring keynotes, technical sessions, and even hands-on experiences for the next generation of security professionals. From government regulations like DORA (Digital Operational Resilience Act) to the challenges of AI security, ITASEC 2025 covered a vast range of topics shaping the future of digital defense.One major theme? Cybersecurity as an investment, not just a cost. Italian companies are increasingly recognizing security as a competitive advantage—something that enhances trust and reputation rather than just a compliance checkbox.We also discuss the critical role of education in cybersecurity, from university initiatives to national competitions that are training the next wave of security experts. With programs like Cyber Challenge.IT, Italy is making significant strides in developing a strong cybersecurity workforce, ensuring that organizations are prepared for the evolving threat landscape.And of course, Alessandro shares a big reveal: ITASEC 2026 is heading to Sardinia! A stunning location for what promises to be another exciting edition of the conference.Join us for this insightful discussion as we reflect on where cybersecurity in Italy is today, where it's headed, and why events like ITASEC matter now more than ever.

Send us a textWe dive into the complex world of cybersecurity through the eyes of Jeremy from Intel 471, exploring his journey from journalism to cyber threat intelligence. The discussion encompasses the evolution of cybercrime, the significance of ransomware, and future trends impacting cybersecurity.• Transition from journalism to cyber intelligence • Engaging with threat actors in cyber forums • Overview of Intel 471 and its mission • Ransomware trends and their implications • The intersection of nation-state actors and cybercrime • Impact of law enforcement collaboration on cyber investigations • Predictions for cybersecurity trends in 2025 • Importance of securing exposed attack surfaces • Call to action for increased cyber resilienceSupport the showFollow the Podcast on Social Media!Instagram: https://www.instagram.com/secunfpodcast/Twitter: https://twitter.com/SecUnfPodcastPatreon: https://www.patreon.com/SecurityUnfilteredPodcastYouTube: https://www.youtube.com/@securityunfilteredpodcastTikTok: Not today China! Not today

Three Buddy Problem - Episode 13: This is a special edition of the show, featuring Juan Andres Guerrero-Saade's full keynote day remarks at LABScon2024. In this talk, Juanito addresses the current state of the threat intelligence industry, expressing a need for a difficult conversation about its direction and purpose. He discusses feelings of disenfranchisement among professionals, the void in meaningful work, and the importance of reclaiming control and value in cybersecurity. Juan emphasizes the need for researchers, journalists, and even VCs, to be the change to reinvigorate the industry and ensure its relevance and impact. Cast: Juan Andres Guerrero-Saade (SentinelLabs). Costin Raiu and Ryan Naraine are listening to this episode.

In this session SecurityWeek speaks to Bennett Pursell, Ecosystem Strategist at the Open Source Security Foundation (OpenSSF) about OpenSSF Siren, a community data-sharing initiative aimed at bolstering the defenses of open source projects worldwide. In this fireside chat, Pursell discusses the origins and goals of OpenSSF Siren, exploring transparent access to data that can help small- and medium-sized businesses during active incidents. Pursell also shares insights on the value of threat intelligence, the shelf life of IOC (indicators of compromise) and how businesses with limited resources can mitigate exposure to risk.(Recorded at SecurityWeek's 2024 Threat Detection & Incident Response Summit)Follow SecurityWeek on LinkedIn

Welcome to Season 3! This week we're bringing you the live recording of our talk at SquadCon during Hack Summer Camp a few weeks back. Our talk was called, “Future Proof Your Career with Cyber Threat Intelligence Techniques.” Many thanks again to the Black Girls Hack Foundation and the SquadCon crew for having us, and to Rebekah Skeete for the killer intro!And, we're fast approaching episode 100 of this podcast! We're doing an AMA with a very special guest host. So, what do you wanna ask us? Email your questions to bareknucklespod@gmail.com, with "AMA" in the subject line. If we air your question, you can expect some special swag your way!

From Private Military Contractors to Mall Cops, the field of security is full of misconceptions, egos, and opportunities to find yourself hung out to dry for other's safety. But when we look behind the curtain into what goes in to threat prevention, we see a much deeper picture. Rob Rawson of Rozin Security joins the show to teach us about the ideas behind effective security, from red teaming, to security breaches, to threat detection and deterrence. Whether on the level of the nation state, a company, community, family, or the individual, we have something to learn about understanding the skills behind securing a location or persons from potential harm, whether it be man made or natural.Rozin Security and their courses can be found at rozinsecurity.com For more from Rob Rawson follow him on LinkedIn: linkedin.com/in/rob-rawsonThis episode has been sponsored by Obsidian Arms, a manufacturer of tools, parts and firearms, as well as operating as an OEM shop for those looking to bring excellence to the market. Their Minnesota-based shop builds and cuts parts out of U.S.-sourced materials. Their gunsmith tools, custom firearms, and capabilities can be found at www.obsidianarms.comSupport the REDACTED Culture Cast at redactedculture.locals.comSSP and boutique products at redactedllc.comFollow us on Instagram at @redactedllc

In this episode, Jacob speaks with cybersecurity researcher Patrick Garrity!Patrick Garrity is a seasoned security researcher at VulnCheck where he focuses on vulnerabilities, vulnerability exploitation and threat actors.In this episode they discuss the importance of integrating threat intelligence into vulnerability management using the Exploit Prediction Scoring System (EPSS), CISA Known Exploited Vulnerabilities Catalog, and the changes in CVSS 4.0!Here are some highlights from the episode:How Exploit Prediction Scoring System (EPSS) can predict exploitationHow vulnerability scanners integrate EPSSCISA's Known Exploited Vulnerabilities (KEV) CatalogThe national security implications of vulnerability managementFollow Patrick on LinkedIn: https://www.linkedin.com/in/patrickmgarrity/VulnCheck Website: https://vulncheck.com/Thanks to our sponsor Keeper Security!Need a FedRAMP authorized Password Manager? See how Keeper can help you comply with CMMC: https://www.keepersecurity.com/cmmc/?utm_source=grcacademy&utm_medium=display&utm_campaign=cmmc_videoStart a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/-----------Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e22&utm_campaign=courses

Parce que… c'est l'épisode 0x431! Préambule Shameless plug 26-28 mars 2024 - Forum InCyber 9-11 avril 2024 - Google Next ‘24 8-11 août 2024 - DEFCON 19 au 21 novembre 2024 - European Cyber Week 19-20 novembre 2024 - C&ESAR 20-21 novembre 2024 - CAID Description Notes À venir Collaborateurs Nicolas-Loïc Fortin Mickael Nadeau Crédits Montage par Intrasecure inc Locaux virtuels par Riverside.fm

In this episode of The Gate 15 Interview, Andy Jabbour welcomes Tom Stockmeyer, Cyware's Director, Enterprise East, ISAC's and Federal. Cyber security leader with experience in helping threat sharing communities such as ISACs and ISAOs and their Member companies improve the fidelity of their intel and accelerate threat intel sharing amongst Members. Tom served in the Marine Corps from 1979 to 1983. He has an MBA from the Michael Coles School of Business, Kennesaw University. Tom has held several executive positions, has served on numerous technology Boards. Tom on LinkedIn.    In the discussion we address: Tom's background from the Marine Corps to technology, entrepreneurship, to Cyware. Information Sharing successes and challenges, ISACs, ISAOs and Cyware helping to secure organizations across the Fortune 1000 and more. Challenges to effective info sharing. A shoutout to the good work being done at Aviation ISAC. Cyware, continuous innovation and automated collective defense. Long weekends and holiday threats. We play Three Questions and talk microwave food, the Marines, classic rock, classic movies and more!   A few references mentioned in or relevant to our discussion include: Cyware Intelligence Sharing is Caring: Collective Defense for a Safer Nation, an article in HS Today by Cyware CEO Anuj Gul, 13 Dec 2023 Cyware Intel Exchange (CTIX) Cyware Collaborate (CSAP) Cyware Solutions for ISACs, ISAOs, and CERTs The Gate 15 Interview: Jeff Troy, President, Aviation ISAC, on public service, cybersecurity, understanding threats (and… colonizing the ocean?)  

Twitter fr0gger https://twitter.com/fr0gger_ Twitter https://twitter.com/mpgn_x64 Livre https://store.securitybreak.io/threatintel Unprotect.io https://unprotect.it/https://unprotect.it/

A Concerned Citizen Visits. This "Concerned Citizen"? Well--he also happens to work in Threat Intel. Brett and he sit down for a talk you do not want to miss. Note--there are no Time Stamps this Episode. This is simple a conversation between two Cyber Peeps.

#SecurityConfidential #DarkRhinoSecurity Phillip is an offensive security professional, educator, mentor, author, and frequent public speaker. His passions outside of the technical side of cybersecurity are sharing resources, professional networking, and bringing people together. He is also the host of The Hacker Factory Podcast and his new podcast, the Phillip Wylie Show. Phillip is the concept creator and coauthor of The Pentester Blueprint: Starting a Career as an Ethical Hacker. 00:00 Introduction 00:18 Our Guest 01:45 Phillips Origin Story 04:06 Wrestling a 750 pound bear 07:41 From Wresting to Cyber 10:12 What motivated Phillip to pursue Ethical Hacking? 11:43 Vulnerability management: What are we getting wrong? 14:52 Changing the Mindset 26:51 What is the role of Threat Intel? 28:08 Asset Intel approaches31:05 Ransomware: It's still growing34:35 The Hacker Factory Podcast34:59 The Phillip Wylie Show36:17 News from Phillip37:44 Connecting with Phillip ---------------------------------------------------------------------- To learn more about Phillip visit :https://www.linkedin.com/in/phillipwylie/https://www.thehackermaker.com/Podcasts:https://www.thehackermaker.com/the-hacker-factory-podcast/https://www.thehackermaker.com/phillip-wylie-show/ To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com ---------------------------------------------------------------------- SOCIAL MEDIA: Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio! Instagram: @securityconfidential and @OfficialDarkRhinoSecurity Facebook: @Dark-Rhino-Security-Inc Twitter: @darkrhinosec LinkedIn: @dark-rhino-security Youtube: @Dark Rhino Security ​

Derek is delighted to have Megan Samford joining him today!Megan is an executive experienced in Product Security programs, ICS/OT, PSIRTs, Threat Intel, and Critical Infrastructure Protection. She is currently the VP and Chief Product Security Officer of Energy Management at Schneider Electric.Megan is a well-rounded and fascinating person! In addition to being a cyber-emergency manager, she is a critical infrastructure protection hero, the founder of many things, a mother, a rock hunter, and a genealogy enthusiast! She loves shopping, interior design, and cars-specifically 300zx!In today's episode, Megan tells her story, discusses her career trajectory, and shares her experience, insight, advice, and free resources for anyone considering a career in cybersecurity.Show highlights:How Megan's mother helped Megan grow into her full potential.Megan talks about being part of the first graduating class of the world's first accredited degree program in Homeland Security and Emergency Preparedness at Virginia University.How Megan gained a core foundation for critical infrastructure while doing an internship at the governor's office in 2007.Megan discusses her first encounter with policy work and explains how much she loved it.Megan talks about being promoted to leading critical infrastructure for the Commonwealth of Virginia when she was only twenty-six.What Megan did that allowed her to get promoted to lead critical infrastructure for the Commonwealth of Virginia at only twenty-six years of age.Why do people like working with Megan professionally?How Megan got to work at GE, and how she ended up working at Schneider Electric.Megan dives into the work she does with ICS4ICS.Megan shares free resources via ICS4ICS for FEMA online incident command system training.Links and resources:(CS)²AI Derek Harp on LinkedInSchneider ElectricMegan Samford on LinkedInICS4ICS training

Podcast: (CS)²AI Podcast Show: Control System Cyber SecurityEpisode: 79: Achieving Leadership Roles in an Early Cybersecurity Career with Megan SamfordPub date: 2023-04-25Derek is delighted to have Megan Samford joining him today!Megan is an executive experienced in Product Security programs, ICS/OT, PSIRTs, Threat Intel, and Critical Infrastructure Protection. She is currently the VP and Chief Product Security Officer of Energy Management at Schneider Electric.Megan is a well-rounded and fascinating person! In addition to being a cyber-emergency manager, she is a critical infrastructure protection hero, the founder of many things, a mother, a rock hunter, and a genealogy enthusiast! She loves shopping, interior design, and cars-specifically 300zx!In today's episode, Megan tells her story, discusses her career trajectory, and shares her experience, insight, advice, and free resources for anyone considering a career in cybersecurity.Show highlights:How Megan's mother helped Megan grow into her full potential.Megan talks about being part of the first graduating class of the world's first accredited degree program in Homeland Security and Emergency Preparedness at Virginia University.How Megan gained a core foundation for critical infrastructure while doing an internship at the governor's office in 2007.Megan discusses her first encounter with policy work and explains how much she loved it.Megan talks about being promoted to leading critical infrastructure for the Commonwealth of Virginia when she was only twenty-six.What Megan did that allowed her to get promoted to lead critical infrastructure for the Commonwealth of Virginia at only twenty-six years of age.Why do people like working with Megan professionally?How Megan got to work at GE, and how she ended up working at Schneider Electric.Megan dives into the work she does with ICS4ICS.Megan shares free resources via ICS4ICS for FEMA online incident command system training.Links and resources:(CS)²AI Derek Harp on LinkedInSchneider ElectricMegan Samford on LinkedInICS4ICS trainingMentioned in this episode:Join CS2AIJoin the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education. Preroll MembershipOur Sponsors:We'd like to thank our sponsors for their faithful support of this podcast. Without their support we would not be able to bring you this valuable content. We'd appreciate it if you would support these companies because they support us! Network Perception Waterfall Security Tripwire KPMG CyberThe podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Join our creative mastermind and stand out as a cybersecurity professional: https://www.patreon.com/hackervalleystudio Become a sponsor of the show to amplify your brand: https://hackervalley.com/work-with-us/ Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Continue the conversation by joining our Discord: https://hackervalley.com/discord   Impactful Moments 00:00 - Introduction 01:22 - What is Threat Intelligence? 02:17 - How did you get into Threat Intel? 03:20 - All Source vs Threat Intelligence 04:09 - What was the transition into cyber like? 07:03 - What is the salary potential for Threat Intel analysts? 09:00 - What skills do Threat Intel Analysts need? 10:09 - How to answer tough Threat Intel interview questions 10:47 - What does the first day on the job look like? 12:07 - What are the expectations of a Threat Intel Analyst? 13:18 - What expectations should an Intel Analyst have for their employer? 16:51 - Are threat intel feeds valuable? 18:26 - Chris' first big threat intel “win” 22:24 - How have you changed as an analyst over the years? 24:22 - How to stand out in cybersecurity 27:24 - Advice for those breaking into Cyber Threat Intel   Be sure to subscribe to Hacker Valley Studio, the premiere cybersecurity podcast for cybersecurity professionals.

Grit in the context of behavior is defined as “firmness of character; indomitable spirit.” Andres Andreu, a NYC bred leader, has a career built on grit and sheer perseverance with experience spanning from the D.E.A. to corporate America.Co-Host, and cybersecurity sales veteran Doug Gotay and I post up with Andres and talk about overcoming adversary as a youth, his time within the D.E.A., his mastery in the judo philosophy, and traversing his unique skillset and mentality into success in the boardroom. TIMESTAMPS0:03:46 - Reflection on Growing Up in Queens in the 1980s0:07:30 - The Judo Philosphophy: Discussion on Physical and Mental Strength Resilience for Life and Business 0:15:10 - Transitioning from NYC to the DEA 0:19:05 - Reflections on the DEA Hiring Process and Title Three Intercepts0:23:07 - Self-Taught Technology and Creative Problem Solving 0:27:49 - The Origins of Blockchain Technology 0:29:27 - Analytical thinking in Government Investigations 0:31:47 - The Impact of Intelligence Sharing on Drug Enforcement Coordination 0:33:45 - Threat Intelligence and its Role in Cybersecurity 0:36:05 - Proactive Security Strategies 0:38:34 - Understanding the Global Dynamics of Information Sharing 0:40:47 - Human Trafficking and Technology's Role in Prevention 0:43:30 - Analysis of Metadata and Its Impact on Law Enforcement Investigations  vs. Cybersecurity Investigations 0:48:52 - Personal Security During Time at the DEA 0:51:01 - The Benefits of Adapting to Different Situations 0:54:39 - The Human Element of Sales 0:56:17 - Understanding the Need for Key Man Insurance Policies 0:58:15 - Executive Kidnapping and the Need for Balance in Business and Physical Fitness 1:01:23 - Executive Protection and Cybersecurity Transitioning 1:04:26 - The need for Soft Skills and Technical Chops 1:07:46 - Finding Balance in Professional Development 1:09:06 - The Importance of Self-Growth and Seeking Help for SuccessSYMLINKSLinkedInGalleryWebsiteDRINK INSTRUCTIONpicEPISODE SPONSORN/ACONNECT WITH USBecome a SponsorSupport us on PatreonFollow us on LinkedInTweet us at @BarCodeSecurityEmail us at info@barcodesecurity.com

Welcome to the Trusted Security Podcast – a podcast dedicated to bringing the latest news on information security and the industry. This episode features the following members: Geoff Walton, Alex Hamerstone, Whitney Phillips, Skyler Tuter. Get ahead of the new PCI requirements PCI 4.0 is coming! Find out how the new requirements will affect your organization's goals and prepare now, with a PCI DSS assessment from TrustedSec. Penetration testing the cloud isn't the same as your network Go to TrustedSec.com to get our guide on how to get the most out of your cloud penetration test. Join the TrustedSec Discord Community TrustedSec is on Discord! Join our server to interact with the security community and the TrustedSec team. Go to discord.gg/trustedsec to join. Stories Title: Realtek Vulnerability Under Attack: Over 134 Million Attempts to Hack IoT Devices URL: https://thehackernews.com/2023/01/realtek-vulnerability-under-attack-134.html?m=1 Author: Ravie Lakshmanan   Title: Extract Actionable Intelligence from Text-based Threat Intel using Sentinel Notebook URL: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-extract-actionable-intelligence-from-text-based/ba-p/3729508 Author: Vani Asawa   Title: Dashlane publishes its source code to GitHub in transparency push URL: https://techcrunch.com/2023/02/02/dashlane-publishes-its-source-code-to-github-in-transparency-push/ Author: Paul Sawers

VIDEO EPISODE HERE. Excellent discussion with security expert, hacker, famous father, husband  and former military professional from the UK, GARY RUDDELL. A former Military Intelligence operator turned hacker and Cyber Threat Intelligence specialist, Gary has almost two decades of sec experience across the Government and Finance sectors. He is On a personal mission to educate 25,000 people in cyber-security. More on Gary here. You can join his newsletter here.New Exclusive Content at CCJ PRIME. For less than 1 cup of coffee a month you can have it all. Exclusive videos, in-depth interviews, Premium Resources for Skills training and Brand Building and Brand Protection. CLICK HERE TO SUBSCRIBE to PRIME. https://glow.fm/cybercrimejunkiesprime/. Support the show

Jump in and join the conversation!Get daily cyber threat briefings with Simply Cyber every weekday. https://simplycyber.io/streams for all the details.Simply Cyber's mission is to help purpose driven professionals make and and take a cybersecurity career further, faster.

checkout our website: https://www.brakeingsecurity.com Follow and subscribe with your Amazon Prime account to our Twitch stream: https://twitch.tv/brakesec   Twitter: @infosystir @boettcherpwned @bryanbrake @brakesec Find us on all your favorite podcast platforms! Please leave us a 5 star review to help us grow!

In episode 77 of The Cyber5, we are joined by our guest, Eric Lekus, Senior Manager for Threat Intelligence at Deloitte. Eric delivers for Deloitte's internal security team and is not a client-facing consultant.  We talk about how to evolve cyber threat intelligence in a SOC environment, beyond basic indicators of compromise (IOC) integration. We discuss the different stakeholders a CTI team has beyond a SOC, but also focus on what a CTI team needs to push and pull from a SOC to be relevant for a broader audience. We also outline success metrics for a CTI team. Four Takeaways: 1. Indicators of Compromise are a Baseline Activity, Not Holistic Threat Intelligence Indicators of compromise consist of known malicious IPs and domains. Stakeholders expect security teams to be doing this as a baseline. However, IPs and domains can change in the matter of seconds so it's not fruitful to only rely on IOCs to be integrated into a SIEM that alerts with other network traffic and logging.  2. A Security Operations Team Already Has A Rich Source of Baseline Activity; Enrich with Threat Intelligence Security teams should be integrating many sources of logging, such as IPs from emails, using threat intelligence to alert on malicious activity. This should then establish two-way communication where a threat intelligence team is pulling information from the SOC to enrich and provide feedback. A SOC team is generally writing tickets for alerts and a threat intelligence team can't just ask for bulk data; therefore automation to integrate into threat intelligence platforms is critical. A SOC analyst will ask, “what's in it for me” and a threat intelligence professional should address this. 3. Threat Intelligence Should be a Separate Entity from the SOC; They Have Numerous Customers The following services are generally associated with cyber threat intelligence teams. Since the SOC is a major stakeholder, the CTI usually has the following functions: Adversary infrastructure analysis Attribution analysis Dark Web tracking Internal threat hunting Threat research for identification and correlation of malicious actors and external datasets Intelligence report production Intelligence sharing (external to the organization) Tracking threat actors' intentions and capabilities Malware analysis and reverse engineering Vulnerability Research and indicator of compromise analysis (enrichment, pivoting, and correlating to historical reporting) 4) Success for Security Teams Means Reducing Risk Through Outcomes Regardless of who the stakeholders are in an organization, improving security should be focused around reducing risk and influencing outcomes for disrupting actors. This should be accomplished in alignment with the executive team and the culture of the organization. Showing how you are reducing risk over time is what makes threat intelligence teams successful in the eyes of business executives. 

Google Patch, Powershell tips from NSA, Russia, China & Cyber Threat Intel Cybersecurity News CyberHub Podcast June 23rd, 2022 Today's Headlines and the latest #cybernews from the desk of the #CISO: Google Patches 14 Vulnerabilities With Release of Chrome 103 NSA shares tips on securing Windows devices with PowerShell Tech executives urge government to share cyber threat intel Russian Cyber Spying Targets 42 Ukraine Allies Chinese Hackers Distributing SMS Bomber Tool with Malware Hidden Inside Story Links: https://www.securityweek.com/google-patches-14-vulnerabilities-release-chrome-103 https://www.bleepingcomputer.com/news/security/nsa-shares-tips-on-securing-windows-devices-with-powershell/ https://thehill.com/policy/cybersecurity/3533685-tech-executives-urge-government-to-share-cyber-threat-intel/ https://www.securityweek.com/microsoft-russian-cyber-spying-targets-42-ukraine-allies https://thehackernews.com/2022/06/chinese-hackers-distributing-sms-bomber.html “The Microsoft Doctrine” by James Azar now on Substack https://jamesazar.substack.com/p/the-microsoft-doctrine The Practitioner Brief is sponsored by: Your BRAND here - Contact us for opportunities today! ****** Find James Azar Host of CyberHub Podcast, CISO Talk, Goodbye Privacy, Digital Debate, and Other Side of Cyber James on Linkedin: https://www.linkedin.com/in/james-azar-a1655316/ Telegram: CyberHub Podcast ****** Sign up for our newsletter with the best of CyberHub Podcast delivered to your inbox once a month: http://bit.ly/cyberhubengage-newsletter ****** Website: https://www.cyberhubpodcast.com Youtube: https://www.youtube.com/c/TheCyberHubPodcast Rumble: https://rumble.com/c/c-1353861 s Facebook: https://www.facebook.com/CyberHubpodcast/ Linkedin: https://www.linkedin.com/company/cyberhubpodcast/ Twitter: https://twitter.com/cyberhubpodcast Instagram: https://www.instagram.com/cyberhubpodcast Listen here: https://linktr.ee/cyberhubpodcast The Hub of the Infosec Community. Our mission is to provide substantive and quality content that's more than headlines or sales pitches. We want to be a valuable source to assist those cybersecurity practitioners in their mission to keep their organizations secure. Thank you for watching and Please Don't forget to Like this video and Subscribe to my Channel! #cybernews #infosec #cybersecurity #cyberhubpodcast #practitionerbrief #cisotalk #ciso #infosecnews #infosec #infosecurity #cybersecuritytips #podcast #technews #tinkertribe #givingback #securitytribe #securitygang #informationsecurity

Author of the #noStarch book "The Art of Cyberwarfare" (https://nostarch.com/art-cyberwarfare)  Topics: discusses his book,  threat intel as a service,  why people enjoy malware analysis? Should people 'hack back' and what legal issues are around that? How do you soften the messaging if you have an insider threat team? www.infoseccampout.com for more information about our 2022 conference in Seattle, WA on 26-28 August 2022! Our full 90 minute stream with Jon, including 30 minutes of audio you won't get on the audio podcast is available at the $5 USD Patreon level, or via our VOD at our Twitch Broadcast site (https://twitch.tv/brakesec) Twitch VOD Link: https://www.twitch.tv/videos/1308277609 Thank you to our Patreon and Twitch supporters for their generous donations and subs and bits!

GreyNoise Intelligence, a Washington D.C.-based cybersecurity startup that analyses internet scanning traffic to help organizations separate threats from internet “background noise,” has landed $15 million in Series A funding to expand its threat collection capabilities and help protect organizations from emerging vulnerabilities.

GreyNoise Intelligence, a Washington D.C.-based cybersecurity startup that analyses internet scanning traffic to help organizations separate threats from internet “background noise,” has landed $15 million in Series A funding to expand its threat collection capabilities and help protect organizations from emerging vulnerabilities.

In this episode I talk with David Monnier who is a threat intel expert. We talk about everything from Russia & Ukraine to how his technology is enabling organizations to make educated risk based decisions on how to best secure their environment. This was a fantastic conversation and I hope you enjoy it. If you enjoy the podcast please go leave a review on the platform you listen, like it & share the podcast. You can also follow the podcast on social media at the links below.Follow the Podcast on Social Media!Instagram: https://www.instagram.com/secunfpodcast/Twitter: https://twitter.com/SecUnfPodcastPatreon: https://www.patreon.com/SecurityUnfilteredPodcastDavid's Social Media:https://www.linkedin.com/in/davidmonnier/ https://team-cymru.com/Support the show

Author of the #noStarch book "The Art of Cyberwarfare" (https://nostarch.com/art-cyberwarfare)  Topics: discusses his book,  threat intel as a service,  why people enjoy malware analysis? Should people 'hack back' and what legal issues are around that? How do you soften the messaging if you have an insider threat team? www.infoseccampout.com for more information about our 2022 conference in Seattle, WA on 26-28 August 2022! Our full 90 minute stream with Jon, including 30 minutes of audio you won't get on the audio podcast is available at the $5 USD Patreon level, or via our VOD at our Twitch Broadcast site (https://twitch.tv/brakesec) Twitch VOD Link: https://www.twitch.tv/videos/1308277609 Thank you to our Patreon and Twitch supporters for their generous donations and subs and bits!

The sky IS NOT falling with this one. Is it important? Yes. Does it highlight an area that's under-researched and likely contains additional attack vectors and techniques? Absolutely. Resourceshttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629ehttps://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bughttps://github.com/NVISOsecurity/nviso-cti/blob/master/advisories/29052022%20-%20msdt-0-day.mdJohn Hammond's Excellent CVE-2022-30190 VideoBlog: https://offsec.blog/Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfwTwitter: https://twitter.com/cyberthreatpov

In episode 73 of The Cyber5, we are joined by Snap Finance Chief Security Officer Upendra Mardikar. We discuss how threat intelligence is used in application programming interface (API) security and development security operations (devsecops). Any organization building an application has data or user-generated content as the primary product.  Once connected to customers, consumers, clients, or partners there is a new set of security considerations generated. The API serves as the software intermediary that allows two applications to talk to one another. It's bad enough if an attacker exfiltrates sensitive data, but imagine if they are able to gain visibility to see who is querying for the data held in the application. Imagine if Russia can see who is querying certain individuals in a credit bureau data set. That's a whole other set of problems organizations face.  As we've talked about in previous podcasts, devsecops is the security of protecting the software development lifecycle (SDLC). We talk about why API security should be added to the wider MITRE ATT&CK framework and further discuss the impact of organizational immaturity as it relates to tackling API and DevOps security.  Five Key Takeaways: 1) APIs are at the Forefront of Digital Transformation and Must be Protected APIs go north/south between the company and customers and east/west establishing interconnectivity between different applications within the enterprise.  A giant need exists to go “outside the firewall” to observe threats that are attacking APIs because they are fundamental to many enterprise functions, regardless of industry.  2) API Security is Very Immature in Enterprise Many security practitioners focus on north/south protections of APIs and implement firewalls and DDoS protections to keep intruders out of the environment. However this is a myopic strategy because it does not protect against lateral movement and privilege escalation when an attacker compromises perimeter security. When perimeter security is compromised, protecting east/west APIs becomes critical. We are seeing trends around Zero Trust. Zero Trust is based on the premise that location isn't relevant and users and devices can't be trusted until they are authenticated and authorized. To gain security from a zero trust security model, we must therefore apply these principles to our APIs. This aligns well since modern API-driven software and apps aren't contained in a fixed network — they're in the cloud — and threats exist throughout the application and infrastructure stack. An API-driven application can have thousands of microservices, making it difficult for security and engineering teams to track all development and their security impact. Adopting zero trust principles ensures that each microservice communicates with the least privilege, preventing the use of open ports and enabling authentication and authorization across each API. The end goal is to make sure that one insecure API doesn't become the weakest link, compromising the entire application and data. 3) Integrating API Security into the MITRE ATT&CK Framework API Security is different from traditional application security (OWASP), which is integrated into the MITRE ATT&CK Framework along with attacks on servers, endpoints, and TLS, etc. API security focuses more on the potential attacks of exposed, internet-facing microservices in addition to the business logic. API security primarily focuses on: Users: The most common API vulnerabilities tend to be centered around issues with an authorization that enables access to resources within an API-driven application. Transactions: Ensuring that transport layer security (TLS) encryption is enforced for all transactions between the client and application ensures an extra layer of safety. Since modern applications are built on microservices, software developers should enforce encryption between all microservices. Data: It is increasingly important to ensure sensitive data is protected both at rest and while in motion and that the data can be traced from end-to-end. Monitoring: This means collecting telemetry or meta-data that gives you a panoramic view of an application, how it behaves and how its business logic is structured. 4) Improvements for Threat Intelligence Against APIs of Applications  Threat intelligence providers need to go beyond the features of user stories, but also be able to alert and automate when malicious actors are targeting the microservices of APIs as the business logic of these APIs are more central to business operations.  5) Threat Intelligence Should Try to Integrate with Threat Hunting to Conduct Proper Malicious Pattern Matching, Reducing False Positives Pattern matching to detect malicious behavior over legitimate user traffic has evolved over time: Netflow: track network traffic emanating from the routers to the endpoints Applications: track application traffic to deter anomalies of authentication Data: track data flows in motion and at rest in the data lakes Devices: mapping devices to determine proper asset inventory Users: tracking user behavior such as off business hour queries to sensitive databases The industry still needs solutions that detect and correlate these behaviors at scale because thus far this has been extremely fragmented.

@bettersafetynet @infosystir @boettcherpwned @bryanbrake @brakeSec   Discord Invite! "please click OK to accept the Code of Conduct in the 'Rules-and-info' channel" https://discord.gg/jhzm4bK9 #AmazonMusic: https://brakesec.com/amazonmusic  #Spotify: https://brakesec.com/spotifyBDS #Pandora: https://brakesec.com/pandora  #RSS: https://brakesec.com/BrakesecRSS #Youtube Channel:  http://www.youtube.com/c/BDSPodcast Apple Podcasts: https://podcasts.apple.com/us/podcast/brakeing-down-security-podcast/id799131292 #Google Play Store: https://brakesec.com/BDS-GooglePlay Our main site:  https://brakesec.com/bdswebsite #iHeartRadio App:  https://brakesec.com/iHeartBrakesec #SoundCloud: https://brakesec.com/SoundcloudBrakesec #Patreon:  https://brakesec.com/BDSPatreon #Player.FM : https://brakesec.com/BDS-PlayerFM #Stitcher Network: https://brakesec.com/BrakeSecStitcher #TuneIn Radio App: https://brakesec.com/TuneInBrakesec

There exists a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings). Thanks to the research and open source tools of several researchers, it's now trivial to elevate to SYSTEM on most Windows Operating Systems.Resources:https://github.com/Dec0ne/KrbRelayUphttps://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.htmlhttps://github.com/cube0x0/KrbRelayhttps://github.com/Dec0ne/KrbRelayUpSocial:https://twitter.com/cyberthreatpovhttps://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw

In episode 71 of The Cyber5, guest Nisos moderator and teammate Matt Brown is joined by security practitioner Matt Nelson. They talk about a recent intelligence blog Matt Nelson wrote about how to operationalize intelligence for the SOC and some outcomes that an incident response team looks for from intelligence. They also talk about how to make intelligence more broadly used for investigations and discuss the intelligence market more holistically. Three Key Takeaways: 1) Threat Intelligence Augments Threat Hunting in the Security Operations Center (SOC) Intelligence requirements are critical throughout the business and not just limited to the SOC. Threat intelligence can be a significant help to the threat hunting and detection team. The outcomes that threat hunting teams generally look for are: Cyber Kill Chain: Analyzing payload, including commands it's running, attack hosting infrastructure, what ports is the infrastructure using to communicate, etc. Target Verification: Identifying who and how they are being targeted and for what intent is often missing context when just looking solely at forensics data.  Collection Intent of Attacker: Trying to determine what kinds of data the attackers are aiming for. This is hard to determine simply from forensics data.  Target of Opportunity Versus Targeted Attack: Determining if attacks are targeting the many or the select few is critical for defense strategies. If targeting efforts are directed solely at IT personnel with admin access, that's more significant than a “spray and pray” campaign.  Outcomes: Outlining detections, protection strategies, and awareness campaigns. 2) Evolving Threat Intelligence Beyond the SOC Threat intelligence is not just cyber news or indicators of a compromise (IoC) feed. Threat intelligence is useful for insider threat, fraud, platform abuse, corporate intelligence, and supply chain risk.  3) Single Data Aggregators for Enterprises (SIEMs, TIPs, MISP) Aren't the Panacea  The SIEM is not the greatest place for threat intelligence data because there are too many internal logs that aren't relevant. The TIPs are mostly focused externally and good for IOCs and correlating threat intelligence that's not useful. It's simply repeating what is already known.  MISP (https://www.misp-project.org/) is open source but can be effective with the right resources. Data modeling and getting the right taxonomy of the data is the most critical. 

In this episode (originally recorded in November of 2021) we speak with Palo Alto Networks, VP of Threat Intel, Ryan Olson. Ryan helps define what threat intelligence actually is and how to get started building a program. He aptly reminds us that producing threat intel for the sake of threat intel is a waste of time. More importantly you first have to ask yourself, “Who's going to be using this information?”.Tweetables“Producing threat intel for the sake of threat intel is a waste of time. What you should be doing is thinking ‘Who's going to take the information that I have produced and use that to make a better decision?' Because that's the goal of threat intelligence, to help a system, or a person, or a team, or a company make better decisions that will help secure them better.” — Ryan Olson [0:04:24]“If I could give people one recommendation, if you can get access to your SSL traffic so that you can decrypt it and you can inspect it, you will have a much better chance at detecting bad stuff in your network than you would without it.” — Ryan Olson [0:29:58]Links Mentioned in Today's Episode:Ryan Olson on LinkedInUnit 42Unit 42 on TwitterUnit 42 Palo Alto Networks CareersComprehensive, full-stack cloud security Secure infrastructure, apps and data across hybrid and multi-cloud environments with Prisma Cloud.

Neil Clausen, regional CISO for Mimecast in Boston joins the podcast this week to take us through SIEM detection strategies, the best use of threat intel, running tabletop exercises, and Purple Teaming. Neil is seasoned security practitioner, who along with his leadership role at Mimecast lectures at Northeastern University College onDatabase Management, Security, and other IT-related courses. He's also been on advisory boards for McAfee and Cisco and has built and managed SOC functions.

https://twitch.tv/brakesec www.brakeingsecurity.com @infosystir on Twitter @bryanbrake @boettcherpwned

Watch the live stream: Watch on YouTube About the show Sponsored by FusionAuth: pythonbytes.fm/fusionauth Special guest: Ian Hellen Brian #1: gensim.parsing.preprocessing Problem I'm working on Turn a blog title into a possible url example: “Twisted and Testing Event Driven / Asynchronous Applications - Glyph” would like, perhaps: “twisted-testing-event-driven-asynchrounous-applications” Sub-problem: remove stop words ← this is the hard part I started with an article called Removing Stop Words from Strings in Python It covered how to do this with NLTK, Gensim, and SpaCy I was most successful with remove_stopwords() from Gensim from gensim.parsing.preprocessing import remove_stopwords It's part of a gensim.parsing.preprocessing package I wonder what's all in there? a treasure trove gensim.parsing.preprocessing.preprocess_string is one this function applies filters to a string, with the defaults almost being just what I want: strip_tags() strip_punctuation() strip_multiple_whitespaces() strip_numeric() remove_stopwords() strip_short() stem_text() ← I think I want everything except this this one turns “Twisted” into “Twist”, not good. There's lots of other text processing goodies in there also. Oh, yeah, and Gensim is also cool. topic modeling for training semantic NLP models So, I think I found a really big hammer for my little problem. But I'm good with that Michael #2: DevDocs via Loic Thomson Gather and search a bunch of technology docs together at once For example: Python + Flask + JavaScript + Vue + CSS Has an offline mode for laptops / tablets Installs as a PWA (sadly not on Firefox) Ian #3: MSTICPy MSTICPy is toolset for CyberSecurity investigations and hunting in Jupyter notebooks. What is CyberSec hunting/investigating? - responding to security alerts and threat intelligence reports, trawling through security logs from cloud services and hosts to determine if it's a real threat or not. Why Jupyter notebooks? SOC (Security Ops Center) tools can be excellent but all have limitations You can get data from anywhere Use custom analysis and visualizations Control the workflow…. workflow is repeatable Open source pkg - created originally to support MS Sentinel Notebooks but now supports lots of providers. When I start this 3+ yrs ago I thought a lot this would be in PyPI - but no

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)Episode: Threat Intelligence with Sergio CaltagironePub date: 2022-03-16Dale Peterson's guest on the Unsolicited Response show is Sergio Caltagirone, VP of Threat Intel at Dragos.   What is good threat intel? How does threat intel "reduce harm by reducing operational meantime to recovery"? Should an asset owner care about the various threat actors named by Dragos, Mandiant and others? Does it matter if it was Petrovite or Erythracite? Why are the top recommendations in Dragos and other threat intel annual reports the typical, same as they always are, recommendations? What is the value if this is the case? What does an asset owner need to have in place to make use of threat intel? How does threat intel deal with the fact we are very bad at calculating or predicting likelihood? Why did you feel the new Journal of Threat Intelligence and Incident Response was needed? Links: Dragos 2021 Year In Review Webinar with Sergio on 2021 Year In Review Sergio's Threat Intel Class at the Threat Intelligence Academy S4x22, April 19-21 in Miami South Beach The podcast and artwork embedded on this page are from Dale Peterson: ICS Security Catalyst and S4 Conference Chair, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Dale Peterson's guest on the Unsolicited Response show is Sergio Caltagirone, VP of Threat Intel at Dragos.   What is good threat intel? How does threat intel "reduce harm by reducing operational meantime to recovery"? Should an asset owner care about the various threat actors named by Dragos, Mandiant and others? Does it matter if it was Petrovite or Erythracite? Why are the top recommendations in Dragos and other threat intel annual reports the typical, same as they always are, recommendations? What is the value if this is the case? What does an asset owner need to have in place to make use of threat intel? How does threat intel deal with the fact we are very bad at calculating or predicting likelihood? Why did you feel the new Journal of Threat Intelligence and Incident Response was needed? Links: Dragos 2021 Year In Review Webinar with Sergio on 2021 Year In Review Sergio's Threat Intel Class at the Threat Intelligence Academy S4x22, April 19-21 in Miami South Beach

Most Cyber Insurance companies belong to multiple Threat Intel services and Security rating companies for monitoring and analyzing their customers security posture and their cyber insurance rates.  Threat Intel is very valuable for the Cyber insurers for monitoring their clients deep dark web and other areas of concerns as another data set in their scoring.

In Episode 77, Josh Amishav talks with Nate Warfield about threat intel, CTI League and cloud risk. My three main takeaways from the episode are: How to use tags to easily search Shodan for systems vulnerable to specific CVEs The most common threats the medical sector faces A couple of interesting techniques he uses to collect threat intel For more information, including the show notes check out: https://breachsense.io/podcast 

Jax Scott has had an incredible career from the front lines in Afghanistan all the way to leading Threat Intel teams in the private sector. Hear her inspiring story.Conversation highlights:The of success for the Cultural Support Leader program in AfghanistanHow Jax started her cyber military careerWhat Electronic Warfare Officers doThe difference between threat intel in the military vs the private sectorWhat it's like to serve in the National Guard and work full-time in the private sectorHow Jax balances her incredibly busy scheduleWhat it's like starting a Woman-Owned Small Business (WOSB) and Service Disabled Veteran Owned Small Business (SDVOSB)Why it's so important to engage policymakers on behalf of the special operations forces (SOF) community________________________________GuestJaclyn (Jax) ScottOn ITSPmagazine  

Threat intelligence automation should be how we share, not how “Intel” is produced.Yet, we continue to create more data - generate more noise - introduce more false positive - require more analysis - increase the need for correlation - which, in turn, forces the need for more automation.GuestsCyberSquarePeg (aka Rebecca Ford)On Twitter

Threat intelligence automation should be how we share, not how “Intel” is produced.Yet, we continue to create more data - generate more noise - introduce more false positive - require more analysis - increase the need for correlation - which, in turn, forces the need for more automation.GuestsCyberSquarePeg (aka Rebecca Ford)On Twitter

In episode 44 of The Cyber5, we are joined by Ronald Eddings. Ron is a Security Engineer and Architect for Marqeta, host of Hack Valley Studio podcast, and a cybersecurity expert and blogger have earned him a reputation as a trusted industry leader. In this episode, we discuss the fundamentals of automating threat intelligence. We focus on the automation and analysis of forensic artifacts such as indicators of compromise and actual attacker behaviors within an environment. We also discuss metrics that matter when the objective is to show progress for a security engineering program.  5 Topics Covered in this Episode: Define the Use Cases: (01:19 - 04:17) For a mature security team, the automation of cyber threat intelligence should start with defining use cases. An enterprise should ask, “What problems am I trying to solve?” Detecting malicious binaries on devices is a good place. For example, let's start with a problem that plagues all organizations: phishing. Creating an inbox for phishing emails is a good first step. Then, an organization needs to make a decision whether to automate the extraction of file hashes, URLs, and IPs for analysis or to direct employees not to click on the link or open the file.  Storage and Logging Components that Need to be In Place: (04:17 - 06:59) For security engineering to be effective, data must be available. Security engineers should define a data acquisition strategy by eliciting stakeholder requirements and assessing your collection plan. The right data is often spread across multiple tools and systems. This must be consolidated into one location for automation to be effective. For example, if an organization wants to detect lateral movement from an Advanced Persistent Threat and is only storing a month of Windows event logs, success is unlikely. To be effective, the following logging should be in place: 1) Windows event logs 2) Netflow (which can be expensive) 3) Cloud logs 4) EDR logs from endpoint devices, and 5) VPN and RDP logs. Prioritizing MITRE ATT&CK in Security Engineering: (06:59 - 10:12) When beginning a program, security engineering should resist the temptation to automate APT groups. Instead, they should automate alerts in the reconnaissance stages within MITRE ATT&CK and then work down the cyber kill chain towards exfiltration. Reconnaissance stages are easier to automate and by the time an attack escalates to the lateral movement stage, automation will facilitate and speed human analysis.  Security Orchestration and Automated Response (SOAR): (10:12 - 12:00) Python and Go are helpful languages to learn in the SOAR process and useful with incident response.  Useful Metrics and What Cannot be Automated in Security Engineering: (12:00 - 19:00)  Mean time to detection, response, and remediation are critical metrics for security engineers to measure. Case management systems such as JIRA can facilitate interaction between the security team roles, including SOC, Incident Response, Security Engineering, Threat Hunt, Threat Intel, Vulnerability Management, Application Security, Business Units, and Red Team. Identifying new threats and understanding why a threat occurred is almost impossible to automate and will always require analysis.

In this Black Hills Information Security webcast John breakdowns why he hates threat intelligence… Again… But, he breaks down some of the cool new projects that are focusing on durable […] The post Webcast: Durable vs. Ephemeral Threat Intel appeared first on Black Hills Information Security.

Episode 6 of the podcast covers insights into the impacts of threat intelligence from the perspective of the ultimate red-teamer, Tyler Robinson of Nisos, Inc. Intro (00:27) Question 1 (01:29) – As a red-teamer, when you're doing your job, do you feel threatened by threat feeds, or things like the MITRE Attack framework? Question 2 (03:37) – So you're a sophisticated adversary – do you actually take these things into account in preparing your attack? IE pulling in threat feeds, and matching your approach against frameworks that the target may use. Question 3 (07:00) – So you've done a lot of this over the years, what keeps you up at night, and I'd guess it's probably similar for the black hats out there, when it comes to your success in compromising a target's infrastructure? Question 4 (09:49) – What are the gaps that you see when it comes to modern threat intelligence? Question 5 (11:13) – Where do you see the industry moving in the next year or two? Recap & Take-aways (14:54)