Speaker 1: Ever heard of a group called Spam House. They're like
Speaker 1: these warriors against spam, right, but back in two thousand
Speaker 1: and seven they got hit, like slammed with this massive
Speaker 1: cyber attack, the storm Worm.
Speaker 2: Oh yeah. It's a classic example really of how even
Speaker 2: the people fighting against these threats they can become target themselves.
Speaker 2: It's a real reminder of what we're dealing with in
Speaker 2: this world.
Speaker 1: Yeah, for sure. And that's actually what's got me so
Speaker 1: I don't know interested in this book, we're looking at
Speaker 1: operationalizing threat intelligence. It's like they want to give us,
Speaker 1: you know, the actual tools and knowledge to really understand
Speaker 1: and be ready for these threats. And forget the Hollywood
Speaker 1: hacking stuff. We're talking actual strategies here exactly.
Speaker 2: And a big part of that, a big part of
Speaker 2: it is understanding what threat intelligence actually is, because honestly,
Speaker 2: it's often misunderstood.
Speaker 1: Right, It's got to be more than just like data, right,
Speaker 1: Oh way, more.
Speaker 2: Think of it this way. Imagine you're trying to bake
Speaker 2: a cake, but you've just got this random pile of ingredients.
Speaker 2: You might get lucky maybe, but chances are, you know
Speaker 2: it's going to be a mess. Threat intelligence. It's like
Speaker 2: having a recipe. It's about taking those raw ingredients that's
Speaker 2: your data, malware samples, ips, whatever, and you're planting it,
Speaker 2: you analyze it, and then and only then can you
Speaker 2: turn it into something you can actually use, like to
Speaker 2: build up a security posture you can rely on.
Speaker 1: So it's not just about the info, it's about the
Speaker 1: right info and knowing what to do with it.
Speaker 2: Yeah, precisely. And just like you know there are different
Speaker 2: cakes for different things, there are different I guess you
Speaker 2: could say flavors of threat intelligence. Yeah, and each one
Speaker 2: has a purpose.
Speaker 1: Okay, I'm following. Can you give me an example.
Speaker 2: Sure, Let's say you find a malicious URL. Okay, so
Speaker 2: tactical intelligence that's your immediate response block it, but strategic
Speaker 2: intelligence that might tell you this url it's part of
Speaker 2: something much bigger, maybe a whole campaign going after a
Speaker 2: French bank specifically. Right Suddenly, it's not just reacting to
Speaker 2: a single thing. You're seeing their motives, how they work,
Speaker 2: which means you can get ahead of it, protect yourself,
Speaker 2: protect others.
Speaker 1: That's huge. It's like I don't even know the difference
Speaker 1: between dodging a bullet and like knowing the entire battlefield exactly.
Speaker 2: But here's the thing, and it's a big one. Not
Speaker 2: all threat intelligence is equal. Just because something says it's
Speaker 2: intelligence doesn't mean it's accurate, it's reliable, or even that
Speaker 2: it matters to your situation, you know.
Speaker 1: So then how do you even how do you filter
Speaker 1: all that out? How do you tell what's good what's garbage?
Speaker 2: That's well, you have to think critically. You got to
Speaker 2: look at the source. Has anyone else backed this up?
Speaker 2: Does it fit with what other credible sources are saying?
Speaker 2: And this is key, is it even relevant to your
Speaker 2: specific threats?
Speaker 1: So even in security, you got to be what like skeptical,
Speaker 1: like a journalist checking their sources or something.
Speaker 2: Undred percent, because making a decision based on bad intel
Speaker 2: it can be worse than having none at all. You're
Speaker 2: opening yourself up without even realizing it.
Speaker 1: Okay, that's that's a little scary, but it makes sense.
Speaker 1: So we've got what threat intelligence is, why it matters?
Speaker 1: What about the people behind the attack? Though? Who are
Speaker 1: these people? Why are they doing it? Is it always
Speaker 1: about money?
Speaker 2: Well, money is a big driver, sure, but it's not
Speaker 2: the only one. You've got activists, they're driven by ideology, right,
Speaker 2: Nation states doing espionage. And then there are people, I
Speaker 2: don't know, maybe they're bored, maybe they just want to
Speaker 2: see what they can do, you know, notoriety.
Speaker 1: Wow, so you're saying someone could launch an attack just
Speaker 1: for kicks.
Speaker 2: It's more common than you'd think, honestly. And then you
Speaker 2: have the cases where well, it's not so clear cut.
Speaker 2: You have researchers, security people, they become the targets.
Speaker 1: That's chilling.
Speaker 2: Yeah, the book mentions a researcher got targeted just for
Speaker 2: looking at a blog. It makes you realize how exposed
Speaker 2: you can be online, even if you think you're just
Speaker 2: you know, browsing, right. It shows the stakes are really
Speaker 2: high here, and you got to understand the different players
Speaker 2: what they want. It's not always you know, black and white.
Speaker 2: Sometimes the people you think you're protecting yourself from, well
Speaker 2: they're the ones you'd least expect.
Speaker 1: Okay, yeah, I'm definitely this is all pretty interesting. So
Speaker 1: how do these analysts, the people doing this work, how
Speaker 1: do they even go about finding this intel? It sounds
Speaker 1: incredibly complicated.
Speaker 2: It is complex, yeah, but it's not like magic or anything.
Speaker 2: It's a process, a structured way of doing things, identifying
Speaker 2: the threats, analyzing, mitigating the whole nine yards.
Speaker 1: So not like the movies, all the frantic typing and
Speaker 1: screens flashing exactly.
Speaker 2: Thread Intelligence it relies on methodologies, you know, proven ways
Speaker 2: of doing things, like there's the thread intelligence life cycle.
Speaker 2: This framework, it breaks everything down into manageable stages, so
Speaker 2: from the planning stages all the way to putting the
Speaker 2: intelligence together and getting it out there. It helps analysts
Speaker 2: stay organized and make sure they're looking at everything they
Speaker 2: need to.
Speaker 1: So it's like having a roadmap when you're dealing with
Speaker 1: all this stuff exactly.
Speaker 2: And like any good map, it helps you get where
Speaker 2: you need to go much more efficiently and effectively.
Speaker 1: Okay, so there's a structure to this which makes it
Speaker 1: seem a little less i don't know, like a foreign language.
Speaker 1: But what about the work itself? I mean, how do
Speaker 1: these analysts actually stay safe digging into you know, the
Speaker 1: dark side of the internet. The book mentioned OPSEEC and
Speaker 1: that whole idea of researchers getting targeted is well a
Speaker 1: little unnerving to say the least.
Speaker 2: Oh, it's absolutely crucial, especially if you're dealing with you know,
Speaker 2: actual threat actors or really sensitive stuff. Can you imagine
Speaker 2: the pressure of trying to blend in online, knowing that
Speaker 2: one wrong move and boom, you compromise your whole security,
Speaker 2: maybe even your safety.
Speaker 1: Yeah, that's a lot. It sounds well like a spy
Speaker 1: movie almost, So what do they do.
Speaker 2: It's definitely more than just like using a VPN or
Speaker 2: having good passwords, although those those are important, of course,
Speaker 2: But the book talks about get this crafting digital personas
Speaker 2: almost like undercover agents online.
Speaker 1: So they create these fake identities so they can like
Speaker 1: blend in and not get caught. That's wild exactly.
Speaker 2: You might create a whole backstory online profiles, even think
Speaker 2: about it, a digital footprint, to make you look like
Speaker 2: someone you're not, someone who'd fit in those circles without
Speaker 2: raising any red flags.
Speaker 1: It sounds like a tough thing to get right. How
Speaker 1: do they know, you know? How much detail is enough
Speaker 1: without like going too far and actually getting in trouble.
Speaker 2: Well, yeah, that's that's the balancing act, isn't it. You've
Speaker 2: got to be convincing enough to get what you need,
Speaker 2: but not so much that you cross a line and
Speaker 2: put yourself at risk. It takes a deep understanding of
Speaker 2: the communities they're infiltrating, right, how they talk, the culture everything.
Speaker 1: So they really are like, I don't know, method actors
Speaker 1: for cyber Okay, so let's say they've done all that,
Speaker 1: got their digital disguises ready, what's next? How do they
Speaker 1: actually find these clues that make up threat intelligence? What
Speaker 1: are they looking for?
Speaker 2: It's a combination of well technical skills, for sure, but
Speaker 2: also good old fashioned detective work. One approach is analyzing malware.
Speaker 2: You can almost think of it like I don't know,
Speaker 2: getting a suspicious package delivered to your door.
Speaker 1: You're not suggesting they open it, are.
Speaker 2: You, No, No, of course not. But in the digital world,
Speaker 2: we've got these things called sandboxes. One example is Joe
Speaker 2: sandboxes like a I guess, you could say, a safe room,
Speaker 2: a controlled environment where they can and like detonate the
Speaker 2: package safely see how it works without actually risking any
Speaker 2: damage to their own systems.
Speaker 1: Makes sense, So they can watch it, see what it does,
Speaker 1: how it behaves, all without unleashing it exactly.
Speaker 2: That's what we called the dynamic analysis, seeing it in action.
Speaker 2: But then they also do static analysis, which is more
Speaker 2: like I guess, carefully examining that package without opening it,
Speaker 2: looking for clues about where it came from what it
Speaker 2: might be.
Speaker 1: So they're getting like the internal and the external view precisely.
Speaker 2: And then there's pivoting. Often you'll find like one small clue,
Speaker 2: maybe a weird domain name, you can unravel a whole operation.
Speaker 2: Really analysts use that one thing to jump to other
Speaker 2: data of maybe IP addresses, emails, using names, whatever they
Speaker 2: can find. Slowly they build up this map of like
Speaker 2: the attackers, whole infrastructure, their movements, everything.
Speaker 1: Wow, it's like I don't know, pulling on a loose
Speaker 1: thread and then the whole sweater comes undone.
Speaker 2: That's a great way to put it. And then sometimes
Speaker 2: you need to go through like mountains of data looking
Speaker 2: for these tiny patterns that we might not even see
Speaker 2: as humans. That's where clustering comes in. Imagine a detective, right,
Speaker 2: they notice the fingerprints at different crime scenes, they all
Speaker 2: have this one weird thing in common. Well, that's kind
Speaker 2: of what these algorithms do. But with digital.
Speaker 1: Data, like digital fingerprint experts making connections we'd miss exactly.
Speaker 2: Algorithms like well, there's tlsh and d hash. They can
Speaker 2: analyze massive amounts of information looking for similarities and you know,
Speaker 2: file hash's code whatever it is. This helps analysts connect
Speaker 2: the dots, find those larger campaigns. Maybe there are multiple
Speaker 2: people attacking multiple targets. Gets complicated.
Speaker 1: Okay, so they're gathering all this data, looking at malware,
Speaker 1: following these digital trails basically, But then what what's the
Speaker 1: last piece of the puzzle. How do you turn all
Speaker 1: that raw info into something useful, something that can actually
Speaker 1: stop the next attack.
Speaker 2: It really is like that, isn't it putting together this
Speaker 2: giant puzzle? But all the pieces are like scattered across
Speaker 2: the Internet, and the puzzle is always changing too, right, Yeah,
Speaker 2: new threats pop up, attackers, they learn, they adapt, which is.
Speaker 1: Where I guess that whole actionable part of thread intelligence
Speaker 1: comes in. Knowing isn't enough. You got to be able
Speaker 1: to actually do something one hundred percent.
Speaker 2: That's the I'd say that's the most important part. You
Speaker 2: got all this raw data, you have to be able
Speaker 2: to turn it into something that you know, people can
Speaker 2: use to make decisions, take action in the whole nine yards.
Speaker 1: Okay, so how does that work in the you know,
Speaker 1: in the real world. Didn't the book use that example?
Speaker 1: Ozark International Bank, right right?
Speaker 2: They were getting hit with everything phishing aimed at their employees,
Speaker 2: then you had the really nasty malware trying to get
Speaker 2: into their systems. The whole works that case study. It
Speaker 2: showed how like thread intelligence was crucial for them to
Speaker 2: fight back.
Speaker 1: Yeah, it was like watching I don't know, a cyber
Speaker 1: thriller or something, seeing how they used all these different
Speaker 1: tools and techniques.
Speaker 2: They were able to start making connections. Yeah, between what
Speaker 2: seemed like totally random stuff isolated incidents, figure out the
Speaker 2: attacker's playbook, so to speak, what they were going to
Speaker 2: do next, and then actually strengthen their defenses.
Speaker 1: One thing that I don't know, I found really interesting
Speaker 1: was how important that open source and intelligence was, Like
Speaker 1: using things like tweet deck to see what people were
Speaker 1: saying about the bank, any potential threats out there.
Speaker 2: Oh, it's invaluable ocent as we call it. It's all
Speaker 2: about basically taking information that's already public, could be social media, news,
Speaker 2: those forums where things get discussed, whatever's out there, and
Speaker 2: you use that to get a better picture of the threatscape, like.
Speaker 1: Having I don't know, eyes and ears everywhere listening for
Speaker 1: any sign of trouble exactly.
Speaker 2: And then you've got your tools like virus Total. Analysts
Speaker 2: can upload a file see if any of the anti
Speaker 2: virus engines out there have flagged it.
Speaker 1: As bad, so it's like getting a second opinion, but
Speaker 1: from like a million security experts at once.
Speaker 2: Pretty much. And then platforms something like open CTI that
Speaker 2: gives you one place to manage everything, see the connections,
Speaker 2: work with other people.
Speaker 1: So it's not even just the tools themselves, it's also
Speaker 1: having you know, the right processes, the right people to
Speaker 1: make sense.
Speaker 2: Of it all goodness said it better myself threat intelligence.
Speaker 2: It's a team effort. Really got to have collaboration, communication,
Speaker 2: and everyone needs to be on the same page about
Speaker 2: the threats and how you're going to deal with them.
Speaker 1: This has been I gotta say, it's fascinating how this
Speaker 1: whole field it's like technical stuff, sure, but also it's
Speaker 1: almost like detective work.
Speaker 2: You know, and the stakes are huge, which is why
Speaker 2: you can't You can't go into this without like a
Speaker 2: healthy bit of skepticism. Always question what you think, Yeah,
Speaker 2: you know, look for a different point of view.
Speaker 1: So for someone listening to us, maybe they're feeling a
Speaker 1: bit overwhelmed by all this, what's I don't know, what's
Speaker 1: the one thing they should take away? How do you
Speaker 1: even start to make sense of.
Speaker 2: All this awareness. That's the key threats are out there,
Speaker 2: that's the reality. Learn about how these attackers work, what
Speaker 2: they do, and just be careful what you do online.
Speaker 1: So basic stuff. Don't click suspicious links, be careful what
Speaker 1: information you put out there, keep your systems updated exactly.
Speaker 2: Make yourself a harder target. That's what it's about. Know
Speaker 2: the risks and how to you know, protect yourself.
Speaker 1: And this is something that well, it's always changing, right.
Speaker 1: What's true today might not be tomorrow.
Speaker 2: That's why it's so important to stay up to date,
Speaker 2: keep learning, you know, make sure your security can adapt
Speaker 2: as things change.
Speaker 1: Well, as we wrap up this deep dive into I
Speaker 1: guess the world of threat intelligence, I think the message
Speaker 1: is well pretty clear.
Speaker 2: Knowledge is power, right, and in this day and age,
Speaker 2: especially online, that knowledge it could be the difference between
Speaker 2: well staying safe and becoming a victim.
Speaker 1: That's definitely something to think about. Until next time, Everybody,
Speaker 1: stay curious, stay vigilant, and stay safe,