Threat Intelligence Naming Conventions: Threat Actors, & Other Ways of Tracking Threats

Cyber Threat Intelligence (CTI) analysts must have ways of clustering adversary intrusions to find patterns and make meaningful recommendations to defenders. Incident responders and security personnel must be able to simply interpret those recommendations for actionable results. And yet the ways the community clusters activity and assigns names to it can be extremely confusing and seems inconsistent. Is APT A the same group as FANCY SQUIRREL? If not why not? And does it matter? What is a Threat Group? And how is that different than an Activity Group? Or a Campaign? This webcast presents concepts to consider when clustering intrusions and making assessments on adversary activity. It also highlights some unanswered questions in CTI for future exploration and some potentially problematic areas for analysts. Speaker Bio Robert M. Lee Robert M. Lee is the CEO and Founder of the industrial (ICS/IIoT) cybersecurity company Dragos, Inc. He is also a non-resident National Cybersecurity Fellow at New America focusing on policy issues relating to the cybersecurity of critical infrastructure. For his research and focus areas, Robert was named one of the Passcode's Influencers, awarded EnergySec's Cyber Security Professional of the Year (2015), and inducted into Forbes' 30 under 30 for Enterprise Technology (2016). A passionate educator, Robert is the course author of SANS ICS515 - "ICS Active Defense and Incident Response" with its accompanying GIAC certification GRID and the lead-author of SANS FOR578 - "Cyber Threat Intelligence" https://sans.org/FOR578 with its accompanying GIAC GCTI certification. He may be found on Twitter @RobertMLee