Combating Sleeper Threats With MTTD

I published an article on the IBM Security Intelligence blog : Combating Sleeper Threats With MTTD. The article covers mean time to detect (MTTD) and mean time to response (MTTR).

I cover some of the options available to reduce the MTTD, what elements can be used to define baselines and how to improve security monitoring and maturity by improving the MTTD.

Interactive usage of MISP

The MISP API provides an easy way for interacting with MISP. In most cases you’ll do this via scripting or from external applications. Sometimes it can however be interesting to use the API to do some simple queries via Python on your threat data.

First start Python from the virtual environment.

Then load the libraries and set some variables.

Now you can use the misp variable to interact with MISP.

For example toRead more.

Staying in control of MISP correlations

MISP correlations are a way to find relationships between attributes and indicators from malware or attacks campaigns. Correlation support analysts in detecting clusters of similar activities and pivot from one event to another.

When the volume of data in your MISP instance grows, the number of correlations can however explode and make your system less responsive. I cover some approaches that you can use to stay in control.

Correlation basically is a way forRead more.

Creating a MISP Object, 101

I published an article on the blog of the MISP project on how to create your own custom object: Creating a MISP Object, 101. This is a follow-up to a previous post on how to create your own MISP galaxy or MISP cluster (Creating a MISP Galaxy, 101).

Cyber Resilience Strategy Changes You Should Know in the EU’s Digital Decade

I published an article on the IBM Security Intelligence blog : Cyber Resilience Strategy Changes You Should Know in the EU’s Digital Decade. The article describes the new EU Cybersecurity Strategy and one the proposal for a revised Directive on Security of Network and Information Systems

The EU Commission attempts to improve cyber resilience with the NIS2 Directive and provides an overview of cyber resilience challenges for 5G and IoT. Other topics discussed includeRead more.

Use Elastic to represent MISP threat data

In this post I go through the process of representing threat data from MISP in Elastic. The goal is to push attributes from MISP to Elastic and have a representation with a couple of pretty graphs. This is an alternative approach to using the MISP dashboard (and MISP-Dashboard, real-time visualization of MISP events).

The Filebeat component of Elastic contains a MISP module. This module queries the MISP REST API for recently published event and attributeRead more.

Cybersecurity Ethics: Establishing a Code for Your SOC

I published an article on the IBM Security Intelligence blog : Cybersecurity Ethics: Establishing a Code for Your SOC. The article describes the dilemmas you can face when working in a SOC or doing incident response work.

The articles describes Cybersecurity Ethics Guidance Frameworks, Best Practices and a Practical Approach for Cybersecurity Ethics, including a set of commandments to adhere. For example

Do not use a computer to harm other people. Protect society andRead more.

5G – 101

A short introduction on 5G. What is 5G, why do we need it and where will it be used?

5g 101 from Koen Van Impe

If you want to read about the security threats on 5G then these are a couple of interesting resources:

Updated ENISA 5G Threat Landscape Report to Enhance 5G Security ENISA threat landscape for 5G Networks Cybersecurity of 5G networks EU Toolbox of risk mitigating measures

Handle phishing e-mails with a phishing alert button and TheHive

Your users are the first line of defence against threats, especially for what concerns phishing. One of the ways to get more involvement is offering a simple and easy way to report suspicious messages, such as phishing e-mails. You can do this via a phishing alert button that allows users to notify the helpdesk of a suspicious message. The technology behind such a button is straightforward:

Forward the message; Remove the message from the inbox.Read more.

How to Support Defenders with the Permissible Actions Protocol

In a previous article I described how to defend with the courses of action matrix and indicator lifecycle management. The courses of action matrix describes passive and active actions that defenders can take with a varying type of impact on the attacker (or intrusion). The Permissible Actions Protocol or PAP achieves something similar, but with a focus on what defenders are allowed to do.

PAP is a protocol that describes how much that we acceptRead more.