Meletis Belsis -CSIRTs

The document discusses the skills and competencies needed for an effective cyber security incident response team. It outlines both personal skills like communication, problem solving, and stress management as well as technical skills in areas like security principles, network protocols, intrusion analysis, and incident handling. The document also maps out certifications from various organizations that correspond to different career levels and security specializations, from basic security knowledge and foundation skills to more advanced intrusion analysis, penetration testing, and risk management roles. Effectively building a skilled incident response team requires considering both personal competencies and technical qualifications.

From #CTISUMMIT. More info here: https://dragos.com/blog/industry-news/meet-me-in-the-middle-threat-indications-and-warning-in-principle-and-practice/ Video here: https://youtu.be/79RdB3aj2vA Discussions on threat intelligence often get bogged down between “machine speed” ingestion of atomic indicators and in-depth analysis of activity taking weeks (or months) to produce. Left in the cold in such debates is a very important but seldom considered middle ground: time-sensitive and incomplete but enriched threat intelligence. In the U.S. Navy and similar services, this is referred to as threat “indications and warning” (I&W) – a step beyond a simple observable refined to ensure accuracy and timely receipt. The goal of I&W is to get actionable, important information to those in need of it most as quickly, efficiently, and accurately as possible, even if as a result some context or other insights are lost. As a result of this activity, consumers are better armed and equipped to deal with and counter threats as they emerge, rather than either reacting to items with no context whatsoever or only reading about their challenges weeks after the fact in a complete intelligence report. This discussion explores the concept of threat I&W within the context of network security generally and threat intelligence specifically to identify this topic as a shamefully ignored middle ground between extremes. The presentation explores the conceptual background behind this idea, then transition to real-life examples of I&W drawn from the speaker’s past activity in threat intelligence, incident response, and military operations.

Shawn Riley presented on the science of security and cyber intelligence analysis. He discussed analyzing the cyber attack lifecycle using the cyber ecosystem model, which views cybersecurity as an interacting system of people, processes, and technology. Riley's threat intelligence method uses the OODA loop to observe attacks, orient on threat actors, decide on indicators, and act by disseminating intelligence reports. His active defense method applies the PDCA cycle to plan defenses based on intelligence, implement countermeasures, check their effectiveness, and provide feedback to improve security over time.

The document discusses the state of threat detection in 2018 and plans for improving threat detection and hunting in 2019. Some key points: - Email still delivers most malware while file-less attacks that evade prevention are rising. Cyber attacks are the top concern for many businesses. - Only 28% of respondents felt preventive defenses were highly effective against targeted attacks. Just 21% believed post-breach detection was highly effective. - Common pain points included insufficient resources, lack of automation for incident response, and alert overload. - Threat hunting involves proactive searching across systems based on expert hypotheses, unlike typical detection techniques. Many organizations do not threat hunt due to lack of time, skills or visibility. - To

Talk that Prof. Mustaque Ahamad from GaTech gave at Global Cybersecurity Leaders Program http://www.cisoacademy.com/gclp2-prof-mustaque-ahamad-april-2015/

The novel coronavirus (COVID-19) has changed the way human think and live. COVID-19 has forced people to embrace new practices such as social distancing and remote working.

This research examines the issue of supply and demand for cybersecurity professionals to determine how to optimize the output of cybersecurity professionals through a supply chain. It was found that progress is impeded by the lack of a clearly defined and standardized definition of a cybersecurity worker and their associated knowledge, skills, and abilities. There is a known shortage of cybersecurity professionals that is affecting the ability of the United States to fulfil the mandate of President Obama who declared that the protection of our digital infrastructure is a national security priority. The problem with this declaration is that a literature review confirms there is no standard definition of a cybersecurity worker, associated skills, or educational requirements. The cybersecurity workforce to which we speak in this report consists of those who self-identify as cyber or security specialists as well as those who build and maintain the nation’s critical infrastructure. Considering the criticality of the national infrastructure, it is time for the US to take immediate steps to coordinate the development of the cybersecurity field and its associated workforce supply chain.

World Continuity Congress conference on 7th October 2015 at Pullman Putrajaya Lakeside by BCM Institute

APNIC Senior Security Specialist Adli Wahid presents on increasing cybersecurity preparedness for large-scale sporting events at the 2021 CNCERT International Partnership Conference, held online on 16 August 2021.