Sharing is caring - Threat Intelligence with ACT

In this episode we chat with PhD candidate, and former CISO for mnemonic - Siri Bromander. 

She’s been dedicating her time the past years on improving threat intelligence, specifically the way we can use automation to enrich security incidents and share analysis without losing context. In our discussion we take a closer look at the ACT (Semi Automated Threat Intelligence) platform, which is an open-source platform that Siri has been helping to develop together with the team at mnemonic and several research partners in Norway. If you work in a SOC, or with threat intelligence, this podcast is for you!

Technical level: 3/5

Interested in ACT? Check out the links below!

https://act-eu1.mnemonic.no/

https://github.com/mnemonic-no/act-platform

Host: Robby Peralta
Producer: Paul Jæger

Transcript

Copy Transcript Copied

Speaker 0:03

From our headquarters in Oslo, Norway, welcome to the mnemonic Security Podcast.

Robby Peralta 0:12

Today I have the honor of speaking with somebody that has worn many hats in her career. From everything from a security consultant to a security analyst to a CISO, and now currently a PhD candidate working in the research and development department in mnemonics. Siri Bromander, welcome to the podcast. So Siri, how did you get into this little security world of ours?

Siri Bromander 0:32

Well, yes, I am a uh child of mnemonic. I grew up here. Uh after finishing my master's, I started out as a consultant. I've been uh head of security, CSI, I've been an analyst, and then for the last few years I've been working with threat intelligence and incident response.

Robby Peralta 0:51

Cool.

Siri Bromander 0:51

At the same time, I'm working at a or pursuing a PhD at the University of Oslo, which have put me into the RD department of mnemonic.

Robby Peralta 1:02

Nice. We're very lucky to have people like you.

Siri Bromander 1:04

Alright.

Robby Peralta 1:04

So, what does the uh RD department work with these days?

Siri Bromander 1:07

Uh well in general we're working with different tools and capabilities revolving around the managed security services that or the monitoring services that we are delivering. Uh but over the last four years or so, we've been coordinating our own research project, uh which is funded partly by us and partly by the uh Research Council of Norway. Uh and the project is called Semi-Automated Cyber Threat Intelligence with the abbreviation Act, which is very much easier. We get their act here. Yeah. So and that is um, yeah, well, that's the largest project that the RD department is working on at the moment.

Robby Peralta 1:49

So, what is your uh role in this project?

Siri Bromander 1:51

Well, I do work on that a little bit, and then uh I have my own little project called Threat Ontologies for Cybersecurity Analytics. That has also got an abbreviation, a TOXA, which is easier as well. Uh, and that is holding hands with the ACT project. So um that project is a so-called uh industrial PhD project, uh also supported by the Research Council of Norway. And that's a great way of um enabling industry experience and academic institutions to come together and exchange knowledge, and yeah, so more or less kudos to the Research Council of Norway for giving us this opportunity.

Robby Peralta 2:37

Yeah. So you mentioned this ACT project. Tell us more about that.

Siri Bromander 2:41

Well, um the ACT platform is a product of the ACT plat uh project, and the ACT project is a collaboration between Mnemonic, the University of Oslo, the Norwegian University of Technology and Science, the Nordic Financial CERT Telenor, which is a large telco in Norway, um, the Norwegian National Security Authority, and the CERT Organisation for the Energy Sector in Norway. I think that's all.

Robby Peralta 3:11

The big party.

Siri Bromander 3:12

Yes. And uh I think all those partners more or less had the same challenges as um we did. And as a whole, um the whole project is then representing critical infrastructure, uh telcos, as I said, um, energy, financial institutions, as well as uh well, the academic partners that we have to have.

Robby Peralta 3:33

Cool. And the platform, you said there was a project in the platform.

Siri Bromander 3:36

Yeah, so um the platform was uh we made called ACT. Uh was made to ease the work of the threat intelligence analysts, but also to support the work of a SOC analyst. So uh as I said, ACT is the abbreviation for semi-automated cyber threat intelligence, and it was created to make better use of the threat intelligence that we had. As a whole, the platform enables collection, storing, analyzing, enriching, and sharing threat intelligence. And it aims at um automating as much as possible and what is possible to automate, and then semi-automate what you can't um fully automate. And that means that the analyst will have to be in the loop, and we don't believe it's possible to take the analyst out. Uh, but taking away the repetitive tasks and yeah, well, the task that doesn't really require the analyst to use their skills or they might their mind much. Um and that would, you know, enable them to do more enrichment and analysis.

Robby Peralta 4:52

Um make their life easier, basically.

Siri Bromander 4:54

Yeah.

Robby Peralta 4:54

So what was the motivation behind the platform?

Siri Bromander 4:58

Um more often than not, does um analysts do repetitive tasks, often in more than one system. And they have their own way of structuring and storing um their findings. I do think there's loads of analysts out there that will be familiar with Excel spreadsheets. Um we wanted to make one system to do all this and also make the platform introduce something extra, new ways of analyzing and enriching the data, for example. So we believed that we could get more knowledge out of the CTI or uh the so-called CTI that we had.

Robby Peralta 5:40

What is the CTI?

Siri Bromander 5:42

Um well, cyber threat intelligence is by most defined as knowledge about threats that can be used to inform the decisions of how to respond to those same threats. But uh we can all agree or most agree that knowledge is something that resides within um the human brain, or at least uh requires some more than information. So data can be transformed into information, and information can be uh transformed uh by adding context and preparing it for an end user, and you can have knowledge, and and that's really what intelligence is. A lot of the threat intel feeds that are existing around, they are mainly just data or sometimes information. And we need all that data and information, but uh and we need the facts and we need the evidence, but it's not really intelligence until you add uh context and prepare it for an end user, create knowledge.

Robby Peralta 6:46

As whether the platform is open sourced.

Siri Bromander 6:49

Yes.

Robby Peralta 6:50

Why why?

Siri Bromander 6:52

Um there are several reasons for that. But uh first of all, I think um we want to give back to the community. That's the main source of inf uh motivation. Um a lot of the people in research and development are people who are active in the security community and want to collaborate and want to work together and want to contribute on the good side. And threat intelligence is highly dependent on sharing and on collaboration. You can't really be good at threat intelligence alone. You need to collaborate with others, and part of collaborate is using the same tools. And if we open source our tool, then it's good for us that people use the same tool. And it makes it easier to share, but it also makes it easier to uh compare results and discuss the findings that you you make and the analysis you're doing. Yeah, um other reasons for open sourcing, um as always with open source, you would like it to be a community where several parties contribute. And uh we are, as everyone else, uh longing for pull requests on GitHub. Uh if we have um if the people have the opportunity to change and configure the system to their own needs and their own environments without much restrictions and not pay for it, uh then we believe that the decision for using it is slowered um or easier to make. But there are different um open source licenses, and I won't go into the details of it, but we have chosen an open source uh license which does not put much restrictions on on the uses. So you can um you can use our code a lot.

Robby Peralta 8:52

So since it's uh since it's a platform, are there other known technologies used within it uh which obviously come together to make the platform, or did did we did you and all the partners make everything brand new yourselves?

Siri Bromander 9:04

Uh we yeah we've tried to stick with known technologies um and we have used known technologies, but the choice of open source has influenced the choices uh that we have made on different technologies. So it's not like we are using technology which is putting restrictions on the platform. Uh that's the only Yeah.

Robby Peralta 9:26

So I know that there are a lot of threat intelligence platforms out there. Um what is so special? What makes ACT so special compared to them?

Siri Bromander 9:36

Well, uh there is the whole uh open source part, that's a good reason. Free free, a free lunch. Yes, yes, yes, yes. But it wouldn't really be um a good reason if the platform was crap, right? Um so there are other reasons as well. And I I don't want to go through all the different uh platforms trying to pinpoint where we are better, but I do think that a user needs to evaluate what purpose of their chosen platform is and what suits their needs the most. Um and I I find that many platforms are made with different motivations. Uh, some are focusing on collection of vast amounts of data, some are focusing on the graphical user interface, some are emphasizing sharing capabilities or sharing a lot past. Um and our main focus has been and will always be analysis and enrichment.

Robby Peralta 10:34

Okay.

Siri Bromander 10:35

Um to gain more than we had uh before because of the platform. Uh and in order to do that, we have created a quite strict data model uh using or based on ontologies and graph representation. Um well, which is knowledge representation. And I think that is the main strength of our platform. It gives us the opportunity to put some of our knowledge about threat intelligence into the platform itself uh through describing how the data is and is not connected to each other.

Robby Peralta 11:11

So the word ontology just flew right over my head, but I understood that the data model is important.

Siri Bromander 11:17

Yes, it is.

Robby Peralta 11:18

Strict.

Speaker 11:19

Yes.

Robby Peralta 11:20

Explain that.

Siri Bromander 11:21

In um so it's strict in the ways it describes um thoroughly how uh data points are connected to each other and how they're not. Uh but in addition, our data model uh does not allow for deleting anything. Uh and if something is put in, you can't delete, but you can retract by adding a new piece of information saying um this is not true. So I now know that what I did know was not true. And in this way, we enable an anal um an analyst to uh travel in time, knowing what information was available at a given point of time, which is very useful, for example, when you're evaluating why a decision was made. So, what did we know at that time, and also for example, for tracking a threat actor's behavior and capabilities over time.

Robby Peralta 12:16

Interesting.

Siri Bromander 12:17

The last part, which is important with the strict data model, is that because when you hear strict, you think it may restrict you from doing a lot, which is kind of true. So um if you're very strict as to what information can be related to what and what can't be related to what, you will very fast find out what information is missing. So if you want to add information about, for example, a threat actor uh using a specific tool in the ACT platform, uh I will also have to add information about the incident, an event, a sample of that tool uh attributed to that threat actor. And because we often do not have that information, we allow for what we call placeholder objects. So that provides a very good visualization of what information is missing and also what information that source would have had to have in order to make the statement they did. So you cannot claim to know what this threat actor ha that this threat actor has used this tool if you haven't really seen the incident or the samples.

Robby Peralta 13:28

And so it shows you what information you're missing then.

Siri Bromander 13:30

Yeah. But you but using placeholders makes it possible to add the information in the platform but without really knowing which incident or which event or which sample, but you know they exist.

Robby Peralta 13:44

Interesting.

Speaker 13:45

Yeah.

Robby Peralta 13:46

So who should be using this type of platform and the functionality that's associated with the platform?

Siri Bromander 13:52

Well, the main goal was to create a platform to use by threat intelligence analysts or threat hunters or whatever name you want to use for it. Um, in different scenarios um for collecting, storing, enrichment, analysis and sharing. So uh they would obviously use it. Um but we also find that the platform gives value to SOC operators and uh incident responders. So everyone in need of giving context and background to the data they're looking at should consider using a platform like ACT to help understand the well more or less the threats they are facing.

Robby Peralta 14:30

You mentioned SOC operators. Um what's the how how does it help them?

Siri Bromander 14:34

Well, intended use for a security operations center would be for enrichment in the day-to-day operation. So whenever you work on an incident or alert at your organization uh or your or um in your operation center, you would be able to enrich that with all the uh related threat intelligence to that piece of information that you have. Uh this means that you would be able to know more when you make a decision on how to respond to that threat. For example, what has been reported on an IP address before, which known incidents are linked to that IP before, what threat actors those incidents have been attributed to. And from there you may find like several uh indicators to work on to investigate further.

Robby Peralta 15:25

So what is our how has our experience with it uh been so far internally in the mnemonic sock?

Siri Bromander 15:30

It's been very useful. Um we're able to see things we wouldn't have been able to see if not using the app platform, which is Brave, good. Uh we have been able to create new knowledge about threats and incidents that we haven't seen before, and the threshold for using it is not very low, but it's natural because it kind of changes the way you're working. Excuse me. Um, or an analyst, how they're working. But we seem to see a pattern of of analysts going from yeah, maybe to wow, this really helped me in my day-to-day work. And it's given me insights that I wouldn't be able to have if I didn't use it. So uh we just see things that's not possible to see in spreadsheets.

Robby Peralta 16:13

Finally, we get rid of Excel. Yeah. Great. So I'm interested. I'm I'm all in. Where do I go to uh to check it out?

Siri Bromander 16:20

Uh well there are two options. One requires a little more motivation than the other. First, uh GitHub. All the code is available and the documentation for how to set up your own instance is there. Um the ACT platform is very much dependent on the data that you put in.

Robby Peralta 16:39

Like bring your own data, huh?

Siri Bromander 16:40

Yeah, like every other system, right? Um but we give you an option of bootstrapping it with some initial data, which makes it more fun to play with straight away. Right. Um, and secondly, you can, if you can't be bothered to put up your own instance straight away. Um, then there is an openly available instance of the platform available online. It is read-only, um, but we have populated it with the same data that we suggest you bootstrap strap it if if you put it up yourself. Um that is data openly available from openly available sources like MITRE Attack, Bios Total, Shadow Surveys, and uh quite a lot of TLP white passive DNS data that we've collected since like uh 2013, I think. Okay. Um and in addition, we have added some MISP Galaxies, some Sticks Vocabularies, and quite a lot extracted from openly available threat reports and blogs and feeds and stuff. Things in English prose sources uh using our SKIO system.

Robby Peralta 17:44

Uh uh the Skio system that I understood was uh really cool at least. It was like something that understands language.

Siri Bromander 17:51

Yes, well it's um it's a natural language processing engine created by one of my colleagues.

Robby Peralta 17:57

Alright.

Siri Bromander 17:57

And it's also available on GitHub, the same uh under mnemonic. Um and it really was uh a case of us needing uh data to test the platform, and uh the result was a really good NLP engine. Um so now we're using it for carving out relevant information from from new text. So I have really cool colleagues. So so do I.

Robby Peralta 18:23

So do I. So what is the uh if you look in your little crystal ball for the ACT platform, what's uh what is in the future?

Siri Bromander 18:30

Well, it's not completely uh um finished yet at all. Uh there is work continuously and we develop new features all the time. Um the project itself, the research process project ends sometimes in the first quarter of next year.

Speaker 2 18:45

Okay.

Siri Bromander 18:45

But the work with the platform will still be continued within mnemonic. So some may be transferred to our development department and some new functionality will be developed uh in our first further research activities. I hope. In addition, we we hype and we think that our choice of keeping the platform open source will make others wanting to contribute and develop further further. As I said before, we love pull requests on GitHub.

Robby Peralta 19:16

So please send those to podcast @mnemonic.no.

Siri Bromander 19:19

Yeah, well, or through GitHub.

Robby Peralta 19:21

What other research projects are in the future then, uh, since this is stopping?

Siri Bromander 19:25

Um yes, we have recently joined a Horizon 2020 project. That's an EU project, um, coordinated by TNI, which is a Dutch research organization.

Robby Peralta 19:37

I've heard about that.

Siri Bromander 19:37

Which is um yeah, they're giving us the possibility to use ACT as input to that project and further develop it to enhance our work on tactical uh threat intelligence. That means in this case the techniques in particular. Um, and in that project, we're working with a collection of other European uh corporations like uh Shadow Server, F Secure, and the Austrian Institute of Technology. There's a long list. We're just starting that this uh project this fall, so and so far so good. Yeah.

Robby Peralta 20:09

So we're gonna have another uh more stuff to talk about next time you're on the podcast then.

Siri Bromander 20:12

Yes, hopefully, yes.

Robby Peralta 20:14

So um hopefully people listen to this and get inspired and you know have some questions for you or want to talk to you. How how can they get in touch with you?

Siri Bromander 20:21

Well, um pop us an email as always. Um we do from time to time uh have workshops uh upon requests, and some are organized. And but yeah, get in touch with us uh on email, through GitHub, or I guess through you.

Speaker 1 20:37

Or podcast @ mnemonic.no.

Siri Bromander 20:39

And we'll see how we can facilitate. We'd love to get in touch with people who are interested.

Robby Peralta 20:44

Great. Well, thank you very much for being here with us today. And uh we wish the best of luck moving forward.

Siri Bromander 20:49

Thank you.

Robby Peralta 20:51

Well, that's all for today, folks. Thank you for tuning into the mnemonic security podcast. If you have any ideas or concepts that you would like us to discuss, please feel free to send a mail to podcast at mnemonic.nl