Course Overview:

TechNow’s TN-911: Cyber Threat Intelligence (CTI) Analysis and 800-172 Updates Seminar, is a one day seminar that covers the objectives of TechNow’s TN-905: Cyber Threat Intelligence Analysis five day course in a one day seminar format plus some other security enhancements of 800-172.  Upon request, this seminar can be presented in multi-day format based upon the depth of knowledge required. The NIST PUB 800-172 security enhancement update to 800-171 regarding 03.11.1 Risk Assessment, introduces the security enhancements of a Threat Awareness Program, Threat Hunting, and Predictive Cyber Analytics.  TN-911 distills the TN-905 CTI five day course and aligns it to assessing compliance with 800-172.  For the seminar, selected course labs are converted to demos, and the important points and outcomes of topics are presented. The TN-911 CTI Seminar discusses the applicability of the 800-172 security enhancements to the organization being assessed, and how to think about the the appropriate strength of the controls related to the organizations criticality of the information and the risk involved for contracted work with the DoD.

TechNow’s TN-911: Cyber Threat Intelligence Analysis Seminar addresses significant changes that have been made to SP 800-172 in transitioning to Revision 3, regarding new enhanced security requirements based on (1) the latest threat intelligence and (2) empirical data from cyber-attacks.  With the intent of addressing CUI that may be associated with a critical program or a high value asset.

Those programs and assets are potential targets for advanced persistent threat (APT).  Cyber Threat Intelligence supports the required functions of NIST 800-172 of Penetration Resistant Architecture (PRA), Damage Limiting Operations (DLO) and Cyber Resiliency (CRS).

Regarding 800-172 This seminar includes:

• 3.2.1E Awareness Training (rev 3 – Advanced Literacy and  Awareness Training)
• 3.11.6E Supply Chain Risk Management SCRM (rev 3 withdrawn, moved to other controls)
• 3.11.7E SCRM Planning (rev 3 withdrawn, moved to other controls)
• 3.12.1E Penetration Testing
• 800-172, 3.11 Risk Assessment
  • 03.11.01E Threat Awareness Program
  • 03.11.02E Threat Hunting
  • 03.11.03E Predictive Cyber Analytics.

TN-911 CTI Seminar directly discusses 3.11 topics:

    03.11.01E Threat Awareness Program:

    Share threat information, including threat events of 03.11.01E is specifically covered as:

• Create Indicators of Compromise (IOCs) using STIX
• Understand a solution for collecting, storing, distributing and sharing cyber security indicators and threats about cyber security incidents analysis and malware analysis.
• How to assess an environment to validate:
  • Support for day-to-day operations to share structured threat information efficiently.
  • Confirming the presence of curated, frequently updated feeds, and the automation of enrichment   workflow
  • Contextualization of intelligence with internal data to prioritize alerts and improve detection
  • Updated threat hunting based upon inbound Threat Intelligence

    03.11.02E Threat Hunting:

    Introduction to Threat Hunting practices to effectively search for indicators of compromise and to detect, track, and disrupt threats that evade existing controls.

• How to assess an environment to validate:
• A formalized process is being followed for Threat Hunting
  • Phases of trigger (incident or CTI), SIEM utilization, and response
• Integration of machine learning to provide proactive, automated, and scalable Threat Hunting
• Leveraging threat intelligence for proactive threat hunting by querying historical logs for indicators of compromise (IOCs) from feeds to identify:
•  Dormant threats
•  Advance Persistent Threats (APT)

    03.11.03E Predictive Cyber Analytics

    Introduction leveraging data, machine learning, and real-time analysis with automation to anticipate threats before they occur.

• How to assess an environment to validate:
  • Data aggregation from network logs, user activities, system logs, and external threat intelligence feeds into a centralized platform like a SIEM
• Use of machine learning algorithms to identify patterns, uncover correlations, and spot anomalies in real-time
• Integration with incident response workflows
• Staff skill competency level and integration into Predictive Cyber Analytics to mitigate advanced adversarial techniques against machine learning such as:
  • Attacks of Evasion, Poisoning, and Model Tampering
  • Utilization of exercises or Red Teaming to validate practices and effectiveness of Predictive Cyber Analytics.

    3.2.1E Awareness Training (rev 3 – Advanced Literacy and  Awareness Training)

•       Validate that training addresses APT

    3.11.6E Supply Chain Risk Management SCRM (rev 3 withdrawn, moved to other controls)

      Validate cybersecurity supply chain risk management C-SCRM:

• Cross-functional team responsible for supply chain risk management (SCRM) and C-SCRM
• Validating standard risk management with respect to supply chain
  • FARM (Frame, Assess, Respond, and Monitor)
  • Tasks outlined in NIST Pub 800-161

    3.11.7E SCRM Planning (rev 3 withdrawn, moved to other controls)

• This is discussed in topic 3.11.6E

    3.12.1E Penetration Testing

        Validate the organization is progressing through standardized Penetration Testing Protocols.

• Evaluate Penetration Test reports for completeness and scope.

Attendees to TN-911: Cyber Threat Intelligence (CTI) Analysis and 800-172 Seminar will receive TechNow approved course materials and expert instruction.

Seminar Duration: 1 day (more upon request)

Seminar Objectives:

• Learn to comprehend and develop complex scenarios
• Identify and create intelligence requirements through practices such as threat modeling
• Utilize threat modeling to drive intelligence handling and practices 
• Breakdown tactical, operational, and strategic-level threat intelligence
• Generate threat intelligence to detect, respond to, and defeat focused and targeted threats
• How to collect adversary information creating better value CTI
• How to filter and qualify external sources, mitigating low integrity intelligence
• Create Indicators of Compromise (IOCs) in STIX
• Move security maturity past IOCs into understanding and countering the behavioral tradecraft of threats
• Breaking down threats mapped against their tradecraft to tweak IOCs
• Establish structured analytical techniques to be successful in any security role
• Learn and apply structured principles in support of CTI and how to communicate that to any security role.

Seminar Prerequisites:

• Security+,  or equivalent experience

Course Overview:

TechNow has worked worldwide enterprise infrastructures for over 30 years and has developed demos and labs to exemplify the techniques required to demonstrate technologies that effectively support CTI.  This course integrates well with our courses TN-575: Open Source Network Security Monitoring and TN-865: Wireshark Network Traffic and Security Analysis .

TechNow develops Cyber Ranges and makes them available for conferences in support of annual meetings for Cyber Threat Response Teams.  Developing scenarios and reacting to them appropriately is a big part of the value in understanding the contexts required to comprehend valuable CTI.   As with many advanced TechNow security courses, there is a large hands-on ratio.  This course helps Cyber Protection Teams (CPT), Defensive Cyber Operations (DCO), and Mission Defense Teams (MDT) to collect, analyze and apply targeted cyber intelligence to defensive operations in order to proactively act on and tune response to attacks by cyber adversaries.  CPT, DCO, and MDT can take preemptive action by utilizing CTI, understanding CTI tools, techniques and procedures (TTPs) needed to generate and consume timely and relevant intelligence to improve resilience and prevention.

This course focuses on the collection, classification, and exploitation of knowledge about adversaries and their TTPs. .  MDT puts us close the mission and helps define the internal context to be analyzed against the CTI.  TechNow pushes the student to truly understand how to think about and use CTI to make a difference.

Attendees to TN-905: Cyber Threat Intelligence Analysis will receive TechNow approved course materials and expert instruction.

Date/Locations:

Course Duration: 5 days

Course Objectives:

• Learn to comprehend and develop complex scenarios
• Identify and create intelligence requirements through practices such as threat modeling
• Utilize threat modeling to drive intelligence handling and practices 
• Breakdown tactical, operational, and strategic-level threat intelligence
• Generate threat intelligence to detect, respond to, and defeat focused and targeted threats
• How to collect adversary information creating better value CTI
• How to filter and qualify external sources, mitigating low integrity intelligence
• Create Indicators of Compromise (IOCs) in formats such as YARA, OpenIOC, and STIX
• Move security maturity past IOCs into understanding and countering the behavioral tradecraft of threats
• Breaking down threats mapped against their tradecraft to tweak IOCs
• Establish structured analytical techniques to be successful in any security role
• Learn and apply structured principles in support of CTI and how to communicate that to any security role.

Course Prerequisites:

• Security+,  or equivalent experience

Comments

Latest comments from students

Liked the class?  Then let everyone know!