Threat intelligence
- Data →[process]→ Information+context →[analyse]→ Intelligence
- Sector-specific is by far the best
Visibility
-
Network
- SPAN or TAP ports
- 5-tuple or full-packet
- Especially levels 0~3
-
OT asset identification
- Risk of doing identification, not if compromised
Threat detection
- Environment (e.g. configuration changes) vs threat (e.g. TTPs)
- Create baselines (with auto config backups)
- Yara rules
Incident response
- Ensure safety, continuity of operations
- Who calls the shots?
Threat and environment manipulation
- e.g. DNS sinkhole C2, islanding, physically disconnect
- Check logs e.g. user activity
- Cross-reference with threat intel