Intelligence-Driven Incident Response

Intelligence-Driven Incident Response

by Rebekah Brown, Scott J. Roberts
Released August 2017
Publisher(s): O'Reilly Media, Inc.
ISBN: 9781491934944

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to live online training experiences, plus books, videos, and digital content from O’Reilly and nearly 200 trusted publishing partners.

Start your free trial

Book description

Using a well-conceived incident response plan in the aftermath of an online security breach enables your team to identify attackers and learn how they operate. But, only when you approach incident response with a cyber threat intelligence mindset will you truly understand the value of that information. With this practical guide, you’ll learn the fundamentals of intelligence analysis, as well as the best ways to incorporate these techniques into your incident response process.

Each method reinforces the other: threat intelligence supports and augments incident response, while incident response generates useful threat intelligence. This book helps incident managers, malware analysts, reverse engineers, digital forensics specialists, and intelligence analysts understand, implement, and benefit from this relationship.

In three parts, this in-depth book includes:

  • The fundamentals: get an introduction to cyber threat intelligence, the intelligence process, the incident-response process, and how they all work together
  • Practical application: walk through the intelligence-driven incident response (IDIR) process using the F3EAD process—Find, Fix Finish, Exploit, Analyze, and Disseminate
  • The way forward: explore big-picture aspects of IDIR that go beyond individual incident-response investigations, including intelligence team building

Publisher resources

View/Submit Errata

Table of contents

  1. Foreword
  2. Preface
    1. Why We Wrote This Book
    2. Who This Book Is For
    3. How This Book Is Organized
    4. Conventions Used in This Book
    5. O’Reilly Safari
    6. How to Contact Us
    7. Acknowledgments
  3. I. The Fundamentals
  4. 1. Introduction
    1. Intelligence as Part of Incident Response
      1. History of Cyber Threat Intelligence
      2. Modern Cyber Threat Intelligence
      3. The Way Forward
    2. Incident Response as a Part of Intelligence
    3. What Is Intelligence-Driven Incident Response?
    4. Why Intelligence-Driven Incident Response?
      1. Operation SMN
      2. Operation Aurora
    5. Conclusion
  5. 2. Basics of Intelligence
    1. Data Versus Intelligence
    2. Sources and Methods
    3. Process Models
      1. OODA
      2. Intelligence Cycle
      3. Using the Intelligence Cycle
    4. Qualities of Good Intelligence
    5. Levels of Intelligence
      1. Tactical Intelligence
      2. Operational Intelligence
      3. Strategic Intelligence
    6. Confidence Levels
    7. Conclusion
  6. 3. Basics of Incident Response
    1. Incident-Response Cycle
      1. Preparation
      2. Identification
      3. Containment
      4. Eradication
      5. Recovery
      6. Lessons Learned
    2. Kill Chain
      1. Targeting
      2. Reconnaissance
      3. Weaponization
      4. Delivery
      5. Exploitation
      6. Installation
      7. Command and Control
      8. Actions on Objective
      9. Example Kill Chain
    3. Diamond Model
      1. Basic Model
      2. Extending the Model
    4. Active Defense
      1. Deny
      2. Disrupt
      3. Degrade
      4. Deceive
      5. Destroy
    5. F3EAD
      1. Find
      2. Fix
      3. Finish
      4. Exploit
      5. Analyze
      6. Disseminate
      7. Using F3EAD
    6. Picking the Right Model
    7. Scenario: GLASS WIZARD
    8. Conclusion
  7. II. Practical Application
  8. 4. Find
    1. Actor-Centric Targeting
      1. Starting with Known Information
      2. Useful Find Information
    2. Asset-Centric Targeting
      1. Using Asset-Centric Targeting
    3. News-Centric Targeting
    4. Targeting Based on Third-Party Notification
    5. Prioritizing Targeting
      1. Immediate Needs
      2. Past Incidents
      3. Criticality
    6. Organizing Targeting Activities
      1. Hard Leads
      2. Soft Leads
      3. Grouping Related Leads
      4. Lead Storage
    7. The Request for Information Process
    8. Conclusion
  9. 5. Fix
    1. Intrusion Detection
      1. Network Alerting
      2. System Alerting
      3. Fixing GLASS WIZARD
    2. Intrusion Investigation
      1. Network Analysis
      2. Live Response
      3. Memory Analysis
      4. Disk Analysis
      5. Malware Analysis
    3. Scoping
    4. Hunting
      1. Developing Leads
      2. Testing Leads
    5. Conclusion
  10. 6. Finish
    1. Finishing Is Not Hacking Back
    2. Stages of Finish
      1. Mitigate
      2. Remediate
      3. Rearchitect
    3. Taking Action
      1. Deny
      2. Disrupt
      3. Degrade
      4. Deceive
      5. Destroy
    4. Organizing Incident Data
      1. Tools for Tracking Actions
      2. Purpose-Built Tools
    5. Assessing the Damage
    6. Monitoring Life Cycle
    7. Conclusion
  11. 7. Exploit
    1. What to Exploit?
    2. Gathering Information
    3. Storing Threat Information
      1. Data Standards and Formats for Indicators
      2. Data Standards and Formats for Strategic Information
      3. Managing Information
      4. Threat-Intelligence Platforms
      5. Conclusion
  12. 8. Analyze
    1. The Fundamentals of Analysis
    2. What to Analyze?
    3. Conducting the Analysis
      1. Enriching Your Data
      2. Developing Your Hypothesis
      3. Evaluating Key Assumptions
      4. Judgment and Conclusions
    4. Analytic Processes and Methods
      1. Structured Analysis
      2. Target-Centric Analysis
      3. Analysis of Competing Hypotheses
      4. Graph Analysis
      5. Contrarian Techniques
    5. Conclusion
  13. 9. Disseminate
    1. Intelligence Consumer Goals
    2. Audience
      1. Executive/Leadership Consumer
      2. Internal Technical Consumers
      3. External Technical Consumers
      4. Developing Consumer Personas
    3. Authors
    4. Actionability
    5. The Writing Process
      1. Plan
      2. Draft
      3. Edit
    6. Intelligence Product Formats
      1. Short-Form Products
      2. Long-Form Products
      3. The RFI Process
      4. Automated Consumption Products
    7. Establishing a Rhythm
      1. Distribution
      2. Feedback
      3. Regular Products
    8. Conclusion
  14. III. The Way Forward
  15. 10. Strategic Intelligence
    1. What Is Strategic Intelligence?
      1. Developing Target Models
    2. The Strategic Intelligence Cycle
      1. Setting Strategic Requirements
      2. Collection
      3. Analysis
      4. Dissemination
    3. Conclusion
  16. 11. Building an Intelligence Program
    1. Are You Ready?
    2. Planning the Program
      1. Defining Stakeholders
      2. Defining Goals
        1. Defining Success Criteria
        2. Identifying Requirements and Constraints
        3. Defining Metrics
    3. Stakeholder Personas
    4. Tactical Use Cases
      1. SOC Support
      2. Indicator Management
    5. Operational Use Cases
      1. ​Campaign Tracking
    6. Strategic Use Cases
      1. Architecture Support​
      2. Risk Assessment/Strategic Situational Awareness
    7. Strategic to Tactical or Tactical to Strategic?
    8. Hiring an Intelligence Team
    9. Demonstrating Intelligence Program Value
    10. Conclusion
  17. A. Intelligence Products
    1. Short-Form Products
      1. IOC Report: Hydraq Indicators
      2. Event Summary Report: GLASS WIZARD Spear Phishing Email—Resume Campaign
      3. Target Package: GLASS WIZARD
    2. Long-Form Products: Hikit Malware
      1. Summary
      2. Basic Static Analysis
      3. Requests for Intelligence: GLASS WIZARD
      4. GLASS WIZARD RFI Response
  18. Index

Product information

  • Title: Intelligence-Driven Incident Response
  • Author(s): Rebekah Brown, Scott J. Roberts
  • Release date: August 2017
  • Publisher(s): O'Reilly Media, Inc.
  • ISBN: 9781491934944