EP128 Building Enterprise Threat Intelligence: The Who, What, Where, and Why

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit the subscribe button in your podcasting app of choice. You can follow the show, argue with your hosts and the rest of the Cloud Security Podcast listeners on LinkedIn. Anton, we have a really fun episode today talking about that fickle thing, threat intelligence, and in particular, The role of understanding yourself in relation to the APTs of the world.

Yes. And while I admit that it wasn't about the cloud, the episode is really fascinating in many regards.

We didn't say cloud once, did we?

I think we did not mention the word cloud even once.

Listeners, I apologize. Turn off the episode now. There's nothing good ahead for you.

Maybe we should say cloud, cloud, cloud now.

Okay, we're good. Listeners, stay tuned in.

Okay. Yes, it's a cloud security episode now because I think I mentioned cloud 3 times.

No, it is a genuinely interesting conversation with a person who's got tremendous background in this area. So perhaps without any further ado, let's welcome today's guest. Today we're joined by John Doyle, a principal intelligence enablement consultant, which I think listeners really means he's a cool threat intel guy you can hire to help make your team better. at Mandiant, which is now part of Google Cloud. John, I want to dive in on how you're making people better at TI. And one of the things you've recently launched, I understand, is a class called Inside the Mind of an APT. Is that right?

Yeah, that's right. So we just launched a class called Inside the Mind of an APT earlier this month. One of the things it's designed to do is help organizations understand and be able to forecast What types of threats they should expect to deal with. So it really kind of breaks down the critical thought process there. It's not just chasing IOCs or kind of raw indicators, but builds that foundational understanding. Okay.

And that foundational understanding, why is that useful about APTs?

Maybe. Sure, absolutely.

Does it matter who's targeting you? Does it matter that it's Fancy Bear versus—

Oh no, it doesn't.

Like, what gives?

Absolutely. Yeah, it does, it does. Understanding actors, understanding motivations behind the activity is really important. So when we say APT, what we're talking about is an advanced persistent threat. Normally that's synonymous with something like a nation-state or state-sponsored actor. So member of a group originating from the FSB, group originating from China's Ministry of State Security. They all have different objectives that they're trying to achieve.

Mm-hmm.

Supporting the state in one way or another, And being able to understand kind of the mapping between groups and how they functionally align themselves and undertake operations gives you the foresight to understand, am I in the crosshair? Is my organization something that will be targeted? And if so, how can I then prioritize defenses against it?

So wait a second. So does it mean that it matters to a very large company, company with an intel team, or does it matter to maybe, dare I say, almost everybody? Like, what is this scope of applicability for trainings like inside the mind of an APT?

Oh, for sure. So there's a whole host of different, I think, audience segments that would benefit from this, irrespective of whatever the company size is, irrespective of whether they have a threat intel team or not. So at the executive level, they're looking at cyber risk as a function of how do I decide where to invest finite resources, both human and monetary capital, So they're trying to forecast and understand, okay, where are those avenues in which I can have a functional difference, right? We can mitigate risk in a specific way.

Mm-hmm.

When you get down to the more tactician level, so security operations center level, it helps with anticipating and understanding the different tactics, techniques, and procedures that these different actor groups use. So at a very high strategic level, it is threat actor prioritization based on targeting priorities that the different groups may have, informed in part by an understanding of the various different doctrines for the countries which feed themselves into what we call intelligence or operational requirements. And then you kind of take it one step further, and it's mapping down to the TTP, the tactics, techniques, and procedure level, to help develop playbooks and things of the like to take a more proactive approach to the mitigation. So eventually minimizing time spent doing things that could be automated or semi-automated.

But wait, wait, wait. So I've met people who upon hearing this would immediately go to, hey, just give me the indicators. I'm going to load them up into the rules. If I have detections, I'll call you back. And they go away. What do you tell those people? Well-meaning, admittedly, but apparently not fully understanding the value of intel.

For sure. Yeah. So it's often a longer conversation with those people, but the TL;DR is there's a little more to it. Certainly so on a tactical level, that is an approach, but these actor groups, these nation-state actors, they're called APT for a reason. They're persistent. They're gonna come after you time and time again because of what you operate in, developing intellectual property, in some cases trying to extort money, things of that nature. So having that functional understanding of the various different groups, having that background and familiarization lends itself to you not having to do work time and time again, establishing those playbooks.

So that means the value is not just in doing, in kind of detecting better, but kind of understanding why it matters? Like, I mean, I'm still, I think your answer made sense, but I don't think it would convince everybody who thinks of intelligence as mostly immediately actionable indicators. So would it be about prioritizing? Would it be about understanding what the threat actor may want there? Like, this is the part that I've seen people being puzzled about. It's like they don't not value the intel, but they value— they basically don't quite value the intel outside of IoT, IOCs, indicators, anything you can shove into rules and trigger detections.

Yeah, that's fair. So maybe if we back up and we actually unpack what we mean by threat, or relevant threat in this case.

Mm-hmm.

You know, in my opinion, there's 3 functional inputs for that. There is opportunity, so this is exposed attack surface. There's intent, and there's capability. So intent and capability are things that are focused at just the adversary level. Intent is that strategic piece, so that is what this class is designed to get at. Helping with the organization based on an understanding of what and why they might want to target your specific organization. From there, you can then start to map out capabilities. So that's kind of the named APT numbers that we have.

Mm-hmm. Yeah.

And looking at the TTPs. Opportunity is that other side of the equation, which is what's exposed. So if an actor group's using a specific CVE to exploit whatever service, do we have that patched? So functionally looking across the horizon there, you have almost a strategic lay of the land that then makes itself down to kind of operational and tactical priorities. So while feeding those IOCs into a specific rule set is helpful, that helps deal with that opportunity piece. It doesn't help with the prioritization.

Hmm.

Kind of understanding the whole everybody's out to get us to a, no, no, this is actually scoped down to a reasonable set of actor groups that we should care about specifically for what technologies they might be going after. Which varies a little bit from how IT and most organizations tend to think about their own crown jewels. So it's really getting you into the mind of the actor itself and building that thought process to get you there. That's kind of the genesis of why we were creating this class in the first place.

And I guess what's interesting there is it's not just about the mind of the actor, it's also about your understanding of yourself. Because what you said in there about crown jewels and what they're trying to achieve, that depends on understanding yourself. Anton and I were recently discussing how does an organization go from 0 to 1 on threat detection. What I said was, well, actually they shouldn't necessarily go from 0 to 1. They should go from 0 to whatever point is appropriate for themselves. The first instruction is to know thyself and then maybe to know the adversary and how they relate to that self.

For sure. Yeah, that's a wonderful thing. One of the things we do in threat intelligence is a lot of introspection. So there's a lot of pontification. Big-level words, big thoughts. But part of that is understanding the inherent biases that we all bring to the table. So we do spend a little bit of time talking about that.

Oh, this sounds familiar.

Yeah, so we do spend a little bit of time talking about that in this class from like a collection visibility perspective, and also how we go about approaching it. So I'm from the US, I have a very Western optic. The kind of story I like to tell usually with this is, you know, one of my friends at the company who also tracks kind of the Russian sets, We ran across this interesting targeting of a group called Turla, which ostensibly is mapped to the Russian FSB.

Of course.

He asked, he's like, hey guys, I want to bounce this off of you. They're like, okay, what do you got? He's like, they're targeting a bank in Cyprus. So this is the first time we're seeing them go after the financial sector. That was actually the wrong inference. So me and a few of my buddies who came from other 3-letter agencies in our past. We're like, okay, what other hypotheses are there? What other explanations are there? Eventually, we got back to the point of, well, what's the mission mandate of the FSB, counterintelligence being one of those? Are there any plausible reasons why this bank would fall into a counterintelligence optic? And where we landed is, well, it is important for Putin and the regime to monitor the oligarchs, and they are funneling money through these So we came up with at least one plausible hypothesis beyond like, oh, they're targeting the financial sector because they want to make money now because they're hurt because of sanctions or whatever. All right. Think about this though. Think about those plausible other explanations. So we all kind of come to this with our own inherent biases. And in this case, it was natural how we arrived at these conclusions. But once we started to unpack that a little bit and look through the lens of Russia's priorities, It illuminated a few other dimensions that we didn't consider. Same thing can be said on the defense side, though.

So say more about that.

Oh, for sure. They're looking at it from a high-value asset. Okay, we need system availability here. We need to make sure that this system doesn't break. This is our critical dataset, this database, this other asset. That's cool. That's important. Don't get me wrong. Threat actors sometimes don't care about that. So there's a misalignment and a misappropriation as to what the defenders think. in what the adversaries think.

So this is actually useful. So it's almost like—

That's very high praise from Anton. I mean, this is actually useful.

It's useful if you sit in a SOC. It is useful in general. I mean, it's useful for the sake of humanity. I get that. But it's also useful for the blue team.

It's also useful if you're a CISO defending.

Yeah. Yes. Yeah. But so in that sense, in your class, you also talk about like cyber doctrines and things that at first glance would not be useful to a line defender in the SOC. But from that explanation follows that actually even that can be useful. So for example, whether these are Iranians or Russians or Koreans—

North Koreans.

Could you go through maybe defender-relevant differences from your class? Again, I'm trying to argue, remotely argue with people who say, I don't care, just give me the indicators. I hear that voice in my head from people sometimes I meet in the field. You can convince me and then I can convince them that there are defend the relevant differences that you can learn from, say, studying Iranian cyber doctrine. It sounds really cool though, cyber doctrine, by the way.

Sounds cooler than it should maybe. So, John, maybe what's the difference that's relevant for your SOC 1 and then maybe what's the difference that's relevant for your SOC 2?

All right, that's fair. So let's take Russia and China as examples here, and we could definitely touch on DPRK and Iran. They're just a little bit different.

Mm-hmm.

And actually, that's a teaching point, right? They all think about this problem a little bit different, how they go about employing cyber operations to meet different objectives. DPRK is financially strapped, like sanctions and the various initiatives that the U.S. US and other governments have taken have really hurt them. So they have had to, you know, advance their ability to generate currency, illicit revenue generation for the regime to bolster their coffers. That is a lot different than looking at something like China, who has a longer-term chess approach. They've been committing cyber espionage for 20-plus years, focused primarily on intellectual property to bolster their global competitiveness for their domestic industry. 2 wildly different use cases.

Yes.

Both still very relevant though to kind of our calculus here. So if we look at the China case, they literally have doctrine like their 5-year plan, which outlines their national priorities on a 5-year time horizon. We have been able to correlate over time, oh, there's a lot of targeting against specific verticals, industry verticals based on what is identified there. So for Functionally, you see China using its cyber program as a tool of statecraft to be able to bolster its domestic competitiveness, to be able to bolster its military superiority, or at least catch up, where they don't have to invest in research and development, which usually operates on longer time horizons and is hella expensive.

Hmm.

2 completely different use cases. Now, if we shift to Iran a little bit, Iran, for a very long time, anytime there would be some sort of a global démarche or something disparaging, their de facto, let me respond, let me retaliate back, doing something under escalatory measures is, let's conduct a cyber operation. Let's deploy a wiper. Let's do a DDoS attack, something of that nature. Now, they've been shifting a little bit in the past year. You can start to predict how an organization would play out. The case I like to give when it relates to Iran, actually it's a little dated at this point, but Sands Casino in Las Vegas.

Oh yes, I remember that case.

Remember this one?

Is this the fish tank story?

Is this the fish tank story?

No, not the fish tank story. Not the fish tank story. There's another story, different time.

Oh, what's the Sands Casino story then?

Sands Casino story is Sheldon Alderson, their executive, Oh, this guy. Yeah. He publicly made a statement, something on the order of like, the US should detonate a nuclear bomb on Iran. They came back, the Supreme Leader came back and was like, yeah, US, you should muzzle your dog. That's a paraphrase, but it's pretty close, pretty close paraphrase. A month later, Sands Casino had their network wiped, $40 million of damage to reconstitute the network itself. So something that defenders don't typically view, something that more kind of like a marketing team or comms team would view, is what is publicly being said by executives. However, there's secondary implications on the cyber side in certain cases, especially when you look at nation states that act a little bit outside of what would be normal bounds, right? So espionage is something you kind of expect, but using cyber operations as a retaliatory measure Is a little bit different. And that's something that Iran and North Korea tend to do with a little more regularity. Definitely on the Iran side, a little less on the DPRK side, though.

Huh. Pretty interesting. So I guess, I mean, like, really pushing on this, can I predict what's going to happen to me if I understand the motivation of, say, 10 cyber-active countries well enough? Like, do we really get that much power out of this, or is it like a nice-to-have?

You can help prioritize where your defenses are.

Yeah.

So there's a focus. You see the groups, you see what they've targeted historically. You can infer from doctrine whether you might be part of that crosshair, and then you can start to identify, is there a delta? What I've identified as my high-value assets versus what actually they've targeted in the past. And if you find a delta, then it is, oh, maybe we need to fortify defenses on this. Maybe we need audit rules in place. to take a look at access controls for these type of individuals, you know, have been targeted and such. So it's really, if you inject threat intelligence upfront in the defensive lifecycle, you can help shape good decisions that will cost a lot less money, help prevent breaches and things of that nature, detect it quicker, reduce dwell time. Vice, the ingestion of TTPs, ingestion of those IOCs, which still have their purpose, but it's just a different use case.

So then there is predictive power even for teams that ultimately kind of say, hey, give me the indicators, because ultimately you are solving problems that are very real for the defenders but aren't just about give me something to detect on. It's like the doctrinal differences would affect how my planning should go, where I should expect a blow kind of thing if this happens in the real world. connect to CNN to IDS, back to this argument. If something happens in the real world, what do we do as defenders, right?

Yeah, for sure. You hit the nail on the head with that.

OK. So to further go down that path, and I think to mention the dreaded— well, by some people, averred— attribution, right? So some of this— and as far as I recall, you do mention it in the class. So for many minds, this type of level of intel is connected to attribution. What's your best advice, given that you've been doing this for so many years? What's your best advice to both CISOs and maybe their teams? And ideally, I'd like 2 types of advice, for a really well-resourced org that really understands it, and maybe to a less enlightened org.

Yeah, so a few of our colleagues actually put out a paper about kind of navigating the trade-offs of attribution. It's fundamentally important for organizations to understand who is going after them and why, period. But where the variance comes in is, does the organization need to do attribution themselves? And they put out a beautiful white paper, they've done some talks and podcasts and stuff. We can include links to that. Where attribution is important is following the different actor groups that target your specific organization. So sometimes attribution gets confused with identification. And identification could be at the group level, it could be at the organization level, it could be at the person level. Look, most organizations not gonna get to person-level attribution, and you shouldn't.

Mm-hmm.

If you're government, maybe you get lucky, maybe you have, you know, sources and methods and squirrely things happening. But at the organization level, it does help because you could then take a look and say, instead of taking the left-to-right approach, looking at technical data and trying to work back to intent and motivation, You can then look at actor group, where it maps to, and mission mandate, and then start working right to left instead of left to right. So instead of looking at logs and technical data working back, you can look at mission mandate and say, we don't have coverage, we don't have heat maps or playbooks created for this group. Maybe we need to start following them, or at least go down this path of having a cursory discussion about, is this worth prioritizing? So attribution is kind of one of those fascinating discussions that we just gave kind of the 30-second snippet on there.

What's the difference between attribution and identification?

I was trying to resist asking that question. No, I couldn't resist. But you couldn't.

No, no, it's totally fair. Identification is a subset of attribution.

Okay.

Right, it's a very finite one, but for instance, cyber operation happens We use abstractions, so we use names like APT 1, which is just shorthand for saying it has multiple different characteristics that we have observed over time and correlated over time. Here they are, but you know, that's very long, so we just, you know, smush it down. APT 41, for instance, instead of saying APT 41, which we assess is MSS front company, blah blah blah. Right. It's helpful to know APT41, its affiliation with the Chinese element that's running it, so the intelligence service that's running it, because then you can then start to work backwards. What else do I know about the MSS and their operations? And really this course kind of goes into all of this. So the way we've got it structured, we hit cyber risk, we talk about collection and bias and how to use intelligence. Then we go into it. We go into how operations are conducted by different nation-states. We give kind of a mental model or framework in there, and then we focus pretty heavily on kind of the big 4 cyber actors: Russia, China, Iran, North Korea, starting off at that high level, like, why do they care?

Those are the big 4?

Yeah, yeah, the big 4.

What about the US and Israel?

Oh, yeah. So the framework can be applied to any of them. It's just a bulk of our customers are kind of interested in those, so the focus area is there, and there's enough variance Between the way each operates, that it paints a pretty fulsome picture—not a perfectly full enumeration, but a representative one.

I guess I've always just been kind of surprised that U.S. activity gets so left out of the conversation. We see a lot of organizations struggle to operationalize this. What's your advice on how to operationalize T.I. successfully?

That is a tricky question. It sure is.

My job. Yeah.

Yeah.

I don't know that I can do it justice in 2 minutes, but we're going to try. Yeah, it's really identifying what the use cases are for TI. So having that understanding upfront then allows you to build out workflows where the integration points are for TI at various different audience levels. So at the risk management level, at the strategic planning, the CISO level and stuff, it's understanding who's coming after you, building out a threat profile. At the more operational level, so your incident response, or I guess SOC Tier 2, SOC Tier 1, You start looking at what playbooks are in place for the different groups based on that prioritization. So really kind of that cyber threat profile acts as your holy grail, your starting point. Then you can track over time various different adversary groups, whether it's open source reporting, whether it's commercial reporting from different vendors. And then more at the tactical level, kind of like Anton was joking about earlier, yeah, integration of the IOCs. You know, not looking at this over a time horizon, it's just give me everything, let's pipe these feeds in. and apply different rules based on it.

Okay. So keep your use cases in—

And I have 30 seconds left there, so I didn't do too bad.

No, no, no. It's very useful. I think that it's useful because ultimately a lot of technical defenders don't get that. And to me, when I try to convince more technical defenders of the value of TI, I use similar arguments. So that, to me, makes perfect sense, is that these are the crisp 2-minute points you can make.

Yeah. One of the areas that's been emerging for a few years now, but I don't think gets adequate representation, is using threat intelligence for adversary simulation. Or even emulation. There is a technical difference. It would take us way too long to go into that though, but taking purple team and red team elements, understanding the actor groups based on that prioritization, who are targeting the industry or targeting the geo, and then trying to emulate it to see whether the defenses would tip. So, you know, ramp up a little more based on these CTPs. Oh, you didn't detect it? Cool. That's a finding. That's a finding that they can action later on, on the blue team side.

Got it. Okay. So I guess I kind of asked my traditional half of closing question just now, which was how do you operationalize this and what's your advice? I'll ask our final traditional closing question, which is what recommended reading do you have for our audience? And it can be anything, something about this, something not about this.

Sure. So we have a website right now. If you're interested in the class, it's mandiant.com/InsideTheMind. That's one word. We'll include the link there. And that's going to give you kind of a breakdown as to what's covered in the course pricing structure. Cool thing is it's all on demand. This is like $2,000 US per seat, and you get essentially 5 master's level courses folded into like 12 hours. So you get kind of the nuts and bolts, the meat of it really baked in, in a way that you wouldn't get in any type of class that exists out there in the market today. So that would be my recommendation. Go check that website out. What we do do as part of the courseware itself is we've got like a 40-page document that acts as a participant guide that really holistically covers like the TL;DR for each of the countries across all the different areas.

Got it. All right. Well, John, thank you so much for joining us today. Really appreciated this. And it's always fun to talk about the difference between the different groups.

Guys, thanks so much for the opportunity.

Yep. Thank you. And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @Anton_Chuvakin and @Anton_Petrov. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Thank you, Roni.