Cyber threat intelligence: Learn to become a cybersecurity tactician | Cyber Work Podcast

it's a celebration here in the studio because the cyber work with InfoSec podcast is a winner thanks to the cybersecurity Excellence Awards for awarding us a best cybersecurity podcast gold medal in our category we're celebrating but we're giving all of you the gift or once again giving away a free month of our InfoSec skills platform which features targeted learning modules cloud hosted cyber ranges hands-on projects certification practice exams and skills assessments to take advantage of this special offer for cyber work listeners head over to InfoSec institute comm slash skills or click the link in the description below sign up for an individual subscription as you normally would then in the coupon box type the word cyber work CY BER wo RK no spaces no capital letters and just like magic you can claim your free month thank you once again for listening to and watching our podcast we appreciate each and every one of you coming back each week so enough of that let's begin the episode welcome to this week's episode of the cyber work with InfoSec podcast each week I sit down with a different industry thought leader and we discussed the latest cybersecurity trends how those trends are affecting the work of InfoSec professionals while offering tips for those trying to break in or move up the ladder in the cybersecurity industry today we're talking about a specific job within the cybersecurity ecosystem that have threat intelligence expert this is a job title that involves both hands on know-how but also a great deal of analytical thinking skills as you're identifying not only threats as they're currently presenting themselves but a whole host of potential threats on the horizon so I mean you can think of threat intelligence as the tactician of security you're not just preparing for the battle in front of you but for the waves of attacks that you might see in the future here to talk with us about this today is Charles de Becque of IBM's x-force Incident Response and intelligence services he's had a connected passel of job titles that encompasses risk management risk analysis and vulnerability assessments all of which have helped him to get to his current position now so we're gonna talk about similar tracks you could start on right now and what challenges you should look forward to in the future welcome to the program Charles thanks Chris thanks Tommy so based on your job and you Haitian background element I ransacked your LinkedIn a little bit for this info but it looks like security and tech aren't the only interest in your life some of the guests you know we've had have been hacking since childhood or they you know we're walked off their high school campus and handcuffs for hacking government mainframes but you know your background shows interest in mathematics law political science and more so well how do you find your way to security and threat analysis and what was the spark that first set you on the path sure so I started off I kind of grew up with computers right you know I sort of that same generation with a lot of folks that grew up with computers in the household and use computers for a long time and when I graduated college I was kind of looking around trying to figure out where I wanted to go and my interest is always really been in logical ways you know how do you know how do we get from A to B to C and so you're gonna see that the play off in my education you know mathematics is very much about logical progression of how you get from A to B same thing with law but that's more from a from a written sense you know how do we wait for argument eight argument B bring on political science I maintain is there's a lot of ways about logical interactions between different groups so there's a lot of sort of common theme there of an interest in logic logic problems logic games understanding how to how to get from A to B and and so I was looking at where I wanted to go for me some security made sense because it's sort of the the next step of taking logical problems and applying that to computers and having this background computing and background using computers and start seeing the relevance of computers you know in our everyday lives to me it made sense you can't look at such security as potential realm for for a career okay I like hearing that because as you know as I try to sort of repeat in these episodes over and over like you can come to cybersecurity with a whole host of different types of skill sets or interest it doesn't you don't just have to have been coding you know for decades you don't have to you know be able to do you know assembly language in your sleep and all this kind of stuff like you can you can do other you can have other interests and still you know contribute really strongly to the entire sort of enterprise so he was a police officer no cyber experience he was a policeman but that he said he want to go into threat intelligence and it was just really passionate about really excited about it so we I started working on the guy ended up being one of the best guy team after a while you can train anyone in from technical skills I mean that's where a technical training is widely available so you certainly don't have to have a tech heavy background and especially for younger generations who have grown up without you know a mobile device in hand for a long time growing up using computers or using mobile devices for a long period time just that life experience by itself in a lot of ways gives you a leg up in this field I think yeah you're you already know more than you think you know exactly exactly yeah so I want to start out today by clarifying the topic of our discussion specifically threat intelligence so just for baseline let's just sort of define what it is what is threat intelligence and what differentiates it from areas of related but different activity maybe you know threat monitoring or security analysis or incident response like what is the job entail as a career track and can I ask you a little bit about the ways that IBM does threat intelligence gathering and monitoring sure so the way I am commonly described her intelligence is when you think about we think about computer security a lot of times you're looking at the inside the perimeter so if I'm an organization come on company I'm looking at what do I see you know hitting my walls and what do I see within those walls and how do i best protect against what's going on there if our intelligence actually looks outside the walls so imagine your scouting party it's outside the walls like I'm looking around trying to see where are the bad guys you know what yeah the options are you're looking into the woods almost make sure exactly you can either build you can either build up all of your walls at the same time I just built did you hit the right spot or you can try and see where they're going to come from and build the walls up just right there character and that's a much more efficient way to do your security right because if I know that the bad guys are using sequel injection all the time then I know I need invest resources and ensuring that my sequel testing is effective but if they're not doing that then I can invest those resources somewhere else so it's a good way to get a sense of where do we see the bad guys coming from on the outside so it's a little bit different perspective you're not looking from the inside out so much you're looking at the outside and see what they're doing to see how they might try to get in mm-hmm that makes sense it does make sense yeah yeah can you can you tell me a little bit about how sort of IBM does does this you know where you are right now sure so IBM we actually a kind of interesting model we we are combined with our incident response component so it's Incident Response and intelligence services at IBM and what's kind of cool about that is it's a hand-in-hand process when we respond to instance we can use our threat intelligence to more effectively respond to incidents so if we see an incidents occurring on a client's site we can say okay we're gonna respond to what's happening there on-site at the time but we're also going to take that information and look at our threat intelligence data and trying to figure out as that other stuff we should be looking for that otherwise we might not be a lot of times it's very easy to get sort of a myopic in your view when something's happening you sort of say I just got to take care of this fire this is the biggest fire right the nice thing about incorporating threat intelligence is we say okay so here's the fire that we see right now but where else might there be fires that are hidden behind the smoke of this big fire over here and so that's what's kind of cool about what I really like about IBM's model is by combining those two elements we're able to more effectively respond to incidents and also those incidents can help inform our threat intelligence so we're able to research more effectively as well it's a very good symbiotic relationship is this sort of hand-in-hand relationship between you know the Incident Response Team and the threat intelligence team is that is that a common thing or is that a fairly unique sort of symbiotic relationship with with with your organization in my experience I think I think it's becoming more common I think a lot of threat intelligence organizations want to get into that sort of area because it's so that's a great great relationship to have there's a lot of challenges to just sort of combining these two elements but so I don't think it's not from one everywhere yet I think it's becoming now I think it's something a lot of organizations are looking into but I think IBM can the unique benefit that we have is we started off saying let's do it this way you know what mine are let's use our instant response intelligence services from the get-go and that gives it a little bit of a head start ok I got a I sent you the questions in advance but I got a one one extra question that is that someone on my team asked do you see small and medium businesses using threat intelligence I mean because it seems like at the moment like threaten tell is kind of the domain of huge enterprises due to the cost of the resources but you know it seems like there could be a use for SMBs to just say you know get some sort of like threat weather report showing maybe second hand dad of some of the threats happening to other industries that are like there is there anything like that out there is that I think something you think about yeah I think you make a fair point I think for lost mommy visits is the most effective strategy I've seen is to deleverage outside provider so generally the kind of model that I've observed and this is just my personal observation is that as you get to larger enterprise you might have an internal threat intelligence team that just focuses on threat intelligence for your organization which is great if you can you know if you can afford that and your large organization that has a large digital footprint it makes sense to do that but if you're a small and medium-sized business that can't possibly afford that sort of you know that sort of payroll then it might make more sense to outsource that to another organization that does all they do with threat intelligence right and then they just give you the reporting on that it's a great way for you to get that sense of what's going on so that you can help direct your teams one one thing that I found really helps for an organization is if you can't afford to have a threat intelligence team even having one person who sorted your threat intelligence person helps quite a bit because a lot of because sometimes what might happen is you know you get the reports and everybody kind of assumes that somebody else is taking care of the reports or as we read them even if you have one person whose job it is or at least part of their job is to work at those reports then you know at least one person is doing it and it could be you know a half time job or a quarter time job it doesn't have to be there full time but as long as you have that sort of designated POC that helps quite a bit for small and medium businesses to be higher intelligence cuz it's a two-way street it's not just receiving it you also have to actually act on it right so yeah not only do you need someone who's looking at this for some portion of their day but I imagine that's you know also the importance of having you know some degree of reporting within like you know the weekly briefings or whatever like some actual sort of you know cuz I'm sure it would be very easy to say well we got you know Bob looking at the you know they're the threats and I'm sure he'll let us know if something's wrong but you know if you're not like you know reporting on it each week and your stand-ups or whatever I'm sure you know that's also watch out for well nobody concerns well with them with rent colleges and this is something that I recommend where people are looking at threatens vendors to consider is you want to make sure it's actual threat intelligence because well sometimes the the profession gets a little bit of a bad rap because people say well threat intelligence that's just you know random war stories you know it's interesting but who cares you know what's what's the point we're on good valuable threat intelligence just tell you something that's happening out in the wild just leave it at that because that's not really helpful you know I could say well they're they're using sequel injection okay so what a good friend telogen s-- will not only tell you you know what's happening out there but also what it means for you and what you can do as sort of action or follow on after that otherwise it is just sort of campfire stories which I won't give a campfire story but that's not helpful for me as a business or an organization yes I mean it's kind of like you know the way like a boring teacher teaches history versus one that can make a narrative around it where you know like you know there's this thing that happened but you know if you don't tell the story so that people can understand well it could happen to you it's be happening right now whatever then what's the point exactly exactly so that's interesting because again if you're thinking about threat intelligence you know make sure you you know how to tell a good story context information because and also to a wide variety of audiences you might be talking to you know see so who wants a really high level thing or you might be talking to you know network defenders who want to know all the tactical details of what's going on you have to be able to speak both languages pretty effectively there you know so yeah let's let's talk about that so let's start with where you are right now can you let's walk sort of walk through your current job title you are a strategic cyber threat expert so what is what is this job entail it are some of your primary responsibilities and you know how much is of it is is job management of threat intelligence team and how much is the actual sort of threat intelligence information gathering in an average day 50/50 split between more tactical level threat intelligence research and 50% leading projects leading initiatives and no intelligence pace so you still get to do the hands-on stuff exactly and I kind of like it that way person I like having that having hand in the tactical level stuff because to me that makes it so that you keep a good sense of what's happening in the world and you have a good good understanding of what time what you're seeing but dumb so I guess I'll bring the time down so strategic part and that just means that I tend to work it up into the higher level when I'm doing my presence my threat intelligence products that distinction is in my mind there's sort of tactical level where you're working at you know you're looking at what are the indicators of compromise that are associated with right actor activity or what going out and you're really diving deep into a few actors that to me is a much more tactical Ally what's happening right now right here right now from a threat intelligence perspective right a strategic threat expert like myself what I tend to do is more broad-based what trends are we see you know what have we seen over the last six months a year how is you know 20 20 different from 20 19 so a good example here is if you look at the IBM threat intelligence index we released those once a year and we just really stood out 2091 index for 2019 not too long ago okay and we said that ransomware was way out which was kind of interesting because the previous year ransomware had been a bit down and so it's kind of when you see these trends there's you know the immediate strategic statement of ransomware it's higher or lower but then there's the again the important part is you know why does this matter and why do we think this is happening and so that's what I do is sort of a strategic level is I look at cross you know a wider time stream and say what are we seeing threat actors trending and how can we use that information to most effectively implement offenses no thanks it does and and it sort of brings up a follow-up question so like what what sort of like resources research materials like what is your sort of analytical thought process I mean let's let's take that specifically recent you know ransomware and we've seen some reports you that ransomware was going down in 2019 but it's back up again in 2020 so like you see something that doesn't quite make sense like that to your mind like what are some of the first steps that you take to sort of break down what what the what the numbers actually mean sure so the first thing you always got to do is make sure you know you got good numbers right and you see something that doesn't make sense it's always good to double check your data and so you know I look at open source and make sure that matches up look at our internal data here at IBM and say ok what is our data showing us and then once the data is you know clarified sure looks like there's a trend there yeah my sort of process is like I start I started first off by just thinking about logic you know what are the possible rationales as to why this could be the case and so we could say ransomware is more effective because we're seeing a higher payout you know they were seeing people paying a ton of money for ransomware it could be that ransomware has gotten better you know that just the technology the malware itself is increasing in overall quality works become easier to use you know that's another very strong possibility as to why we see ransomware increasing and then I kind of have a couple ideas what I think it might be you know just sort of logically gaming it out and a lot of that comes from that sort of strategic knowledge that most threat actors are financially motivated and and are lazy and I mean this is you know a nice way but easiest way possible yeah exactly yeah you want to make your money as easy as possible right now and so there knowing that sort of background understanding and kind of gaming out the possibilities then what I'll do is I'll go to open source I'll go to my dark web sources it all starts trying to find out you know are there indications of any of these assumptions being the case you know do we see people posting on forums for dark web marketplaces hey my ransomware as a service is on sale now you know am I seeing a lot more offerings on marketplaces or am I seeing a lot of people saying man this is so easy anyone should do it or you have YouTube tutorials about how did it use these sorts of products you know that's very often the case as well or do I see when I look at the data is there a are there like collections of activity so you know a bunch of stuff happens and you know March a bunch of stuff happens in May that might indicate to me that it's a matter of cat of copycat attacks and so that's sort of the way I would approach it is look at what did first off trying kind of guess what the possible options might be and then go out and see what the data supports from the sources you have available usually open source dark web internal are kind of key three ones I work at right it's I mean that's straight up scientific method right there you make your your hypothesis and then you test it against the facts and see what happens is sort of science and art I think I mean there's always so much the data can tell you because that you know we don't have perfect data collection yeah you're not going to find like the fortune cookie that says this is how we did it yeah well that's more about your personal motivations right but down they never happened and so lacking that you cut the other key element to threat intelligence that sort of subtle is using analytic confidence language so you know there's that there's different and you can look you look up on Google there's a lot of different ways that you can couch statements to make it as accurate as possible you can say you know I'm medium confidence that this probably occurred right that suggests that you know that tells you how confident I am in the next statement and it tells you that crawl means it's more likely than not but not almost certain to be the case and that's sort of back that sort of fine detail language it's kind of technical skill but once you get really good at it it's a great way to be able to make statements based on data well without sacrificing your analyte integrity when you mix it okay so um this is great cuz it you know you say the sort of opens up into my next question here but you know we were talking about your background a little bit that you have the you know math background political science law background and you know and all these things obviously contribute strongly and you know it's hard not to see but like what are some specific sort of skills or educational tracks or learning experiences or projects you did in these other fields that you think sort of directly translate to you know doing good work as a threat intelligence person like you know if if you have some you know these kind of backgrounds and this sounds interesting to you like what are you sort of highlighting for someone saying I want to get into threat intelligence and here's how I show I can I can do it absolutely very very easy question for me whenever anybody ever asked about education my number one first answer and if this should be like the number one takeaway from anyone listening to this is to check out the National Science Foundation scholarship for service program or the NSF SF s what was easy to say yeah it's a it's this old program so what I did is I was a graduate student at Iowa State through this program and what they time what they did is they paid for the tuition room and board stipend for you to get a degree in cyber security it was a two-year master's degree in exchange you have to work for the federal government for two years mm-hmm now I remember when I was you know this was I guess a decade ago now for me but ten years ago two years sounded like a really long time to work for the federal government but what ended up happening was I got a free master's degree out of the deal and I got great experience the government for five years in exchange for them paying me to do all this if you have any interest in cybersecurity whether it's threat intelligence specifically or a variety of other fields this is a great way to get the educational background you need plus potentially get a foot in the door at the government to be able to get the the actual hands-on and experience that you need right so really be able to jump into a cybersecurity career it's it's really fantastic I really can't recommend it enough so that would be my number one recommendation for um if you're looking to kind of get the right education for cybersecurity just jump in the background it's pretty sweet deal well so what we through year ever today is as a cyber threat expert like what time do you start work you know where does your work take you in the course of the day can you structure a day or are you just constantly putting out fires are you able to turn off in the evenings are you always on call yeah so one nice thing about threat intelligence I find is that it's so it's not really an on fire source situation of course there can be situations where it is again since where we work with instant response sometimes you might have an incident come up in that case yeah all hands on deck you have to take care of things rightly I mean occasionally there are major fires likes and you're like want to cry right which has such a broad impact such a major event that that's all hands on deck and you pretty much are working until other things take care of you have people working through the weekend back when that as I recall sure so you have that occasionally but that's pretty rare usually it's a pretty pretty good 95 job I'm a morning person myself so I start first thing in the morning I like you know 7:30 rate and get down around 4:00 or 4:30 but it's it's not a it's not a crazy long schedules kind of standard 40-hour workweek and a lot of ways so there's a lot to like there I think from a work-life perspective and and in terms of the work-life balance I find that it's nice because you know when it's done there's not a lot keeping me up over the weekends because usually if I'm working on a research project especially a broader strategic product like I've been doing my my current role it's not really something where I'm too worried about it because this is a six month to one year trend you know we're talking about pretty long time frame so I don't even go weekends gonna really change that too much right but hopefully not go big right yeah so yeah yeah lift up but usually felt a bit oh you guys not to make a deal yes so that's gonna have this for me yeah so what are some of the sort of common tasks you're doing everyday like you know are you talking about clients or you you know sort of reporting to your you know your board your c-suite whatever like what what what what do you what do you do a lot what do you have to be ready to do a lot if you want to go into this trap right writing is that is the number one things and and personally I wasn't somebody who grew up saying man I love write papers right some people love that I I didn't love writing papers on more people person but though I do like is writing logical papers you know I like writing out logical arguments and so if do logical writing and precise writing if that's something you would come into then that's something that could be a good demo a good fit because that's what a lot of my day is when I'm writing up threat intelligence reports a lot of it is connecting dots also as we talked about a little bit before storytelling is a lot of my day we're on where I may be writing up stories to people's core of explaining you know here's the background here's where we are now and here's what it means your future might hold that's sort of progression and a lot of storytelling in a written form is a lot of what I do now I also like I also brief clients on occasion and I do enjoy doing that quite a bit because it's nice to be able to just orally brief someone so they can get the questions back in real time that's generally less common but that's something I do do as well but most of my most of my work is where nature and otherwise just researching researching and reading the news and seeing what's going on keep track of things okay so where does where does threat intelligence generally stand on the average company hierarchy chart do you who do you report to you know where does where does it slide into an org chart especially people who have like a full set of different security staffs like where do where do you stand so usually for intelligence reports up to up to the C so for most organizations that I've seen anyways it could be another level between here and there initial threat intelligence analyst positions those are become entry-level positions that can be that can be pretty low level but that said I'd say generally getting into threat intelligence in the private industry and my experience requires a little more experience read where as with government it could be a bit more of an entry level position just because with private industry they're they're kind of requesting the kind of want people have already done this before and threat intelligence isn't necessarily I feel a lot of people jump into as their first field and the nice about government is there's some agencies that all they do is intelligence and so it can be an entry-level position for them because once you get up to sort of the senior level analyst position these kind of two tracks you can take you can go either you know going in-depth and be just a really deep dive research analyst who justice you know out on the you know the deep and dark web open stores all day every day researching specific threats that you specialize in or you can kind of go to the leadership route where you're saying okay I want to look at sort of how do how are we doing our threat intelligence how more effectively I think those are kind of two branching things but generally alter intelligence and my experiments serve reports off to the Cecil office for a private industry or and from government it gets kind of it's kind of why a little different so is threat intelligence a position that's mostly done as sort of part of a company or their freelance freelance opportunities in this area are there you know can you sort of like offer your service Peschel II if you've run it for a while can you sort of offer your services to an organization or to people mostly just have like an in-house threat intelligence unit oh yes so there's kind of kind of both I'd say my experience there's there's a lot of freelance opportunities available um the way I would capture it is rather than sort of thinking of it as freelance versus for the company I would think of it as there's companies of all shapes and sizes and trend telchines you've got large organizations that do sort of consulting threat intelligence where they applied threat intelligence to other organizations you've got smaller companies that provide threat intelligence to small medium-sized businesses or might have a unique unique niche in the threat intelligence field like they might it might be a threat intelligence company that just does dark web right that's something that it's out there as well there's also threat intelligence organizations within within companies so that's the way I think of it as sort of that I have the legal background so to me it's sort of like the difference between in-house counsel oversee for a law firm okay for a law firm you work for a lot of other companies but you don't work for yourself specifically they're you in-house counsel works just specifically for the one company and there's a man just about right working in-house the nice thing is you know if you're doing in-house threat intelligence you can really focus on this one organization make sure that you're doing best possible threat intelligence just for that company but the downside arguably is that it's not quite as diverse so if you're having kind of a slow week you might just be having a slow week when you're doing for intelligence for a for an organization that works with many other organizations you're kind of constantly bouncing around between different industries which means you have to understand a lot more industries it's a little more challenging in some ways but the bright side is there's always something you know which I really like I really enjoy being busy so that's and that's why I like enjoy enjoy working for IBM because we always have things going on there's always different industries to be aware of and being a global company there's a lot of home there's a lot of global components there as well now you know if you have a full sort of threat intelligence staff and you were saying that they're sort of like three or four sort of primary places you know the dark web or what have you like do people have sort of a specialty in terms of like you know you know Jill here is the the dark web person and and Bob talks you know looks at you know ransomware situations do you can you sort of sub specialize within it where you are mostly sort of looking at one thing is everyone kind of looking at everything and synthesizing data and so forth really depends on the organization there's a lot of different theories out the best approach I'm not sure that I necessarily know the best one the ones I've seen most commonly tend to be you can have people who are focused on threat threat types or threat specific threat actors I usually those are sort of geographically aligned alternatively you might have I've seen places that you might have somebody who it's like they just do dark web they're just really really good at dark web and that one's wealthy because that person is really your key go-to person it really kind of depends on the organization how they want structure it if you're kind of getting into this field trying to think of how you want to best market yourself I think those are kind of the two main marketing elements either say like I you know I speak a language especially if you speak a language okay from one of the big from one of the big countries we could say you know I speak that language i I'm gonna learn everything there is to know about threat actors from that area mmm I'm gonna say I'm a market myself as somebody who is a specialist in this region that's a great way to market yourself in this area or alternative well you can say I am just really really good at open source and I'm the open source guy and everyone's gonna come to me for their open source feed and in that case you want to build out those open source skills I'm actually both they're both definitely needed skills in different organizations so they're both very good approaches okay so tell me what give any certifications like and and do you feel like there's any particular certifications that are important for people looking into getting that their intelligence you know I have two CISSP D which I think is valuable certification just from kind of writing that executive understanding it's sort of learning more about what executives are I'm thinking I think if you're just starting out in this field I'm not sure it's as critical but as you get sort of further into the field the nice thing about cissp is it does provide insights into what your audience might be worried about and that sort of insight really helps you make your product more effective for them but otherwise for other certification I don't have a lot of recommendations I know the Security+ is a good one heard good things about that but I personally don't have it I did some studying for it and st. beyond it seemed very good and also if you if you feel like you need more technical acumen Network+ is also a good one as well okay there are there are many good certifications out there I can't I can't speak to all from trade of course yeah no yeah make sense yeah it's SPS I mean you're basically studying how perimeters work so it's perfect I think is that but I understand sort of what the executive level c-suite is thinking about when they're looking at things it helps you tailor your threat intelligence product yeah to speak their language because ultimately you know if you're not speaking their language they're not gonna read it or they won't understand it both of which were bad yeah so we you know you gave us some really good good tips for sort of like getting your foot in the door with you know especially the you know the organization that you worked with but so what are some of the steps along the way to go from a low level threat intelligence you know technician to cyber threat expert like which you know what you know what I remember when you're talking to a security analyst and he was saying like you wanna go up to security manager you know automate yourself out of your job you know he was saying like you know if you create enough sort of automated processes then you sort of like you know the stuff that you're doing wrote Lee you know is already handled and then you can sort of handle the next level thing up so like what is how do you sort of automate yourself quote-unquote out of out of you know a low level threat intelligence job into into what you do it's kind of tough question but my best answer that one I think I think the primary way you do it and it's it it doesn't sound like a good answer but as best when I can really give is you have to just learn a lot about what's going on in the threat all Cantrell you have to I think the main way you kind of take that getting that next level is when you re report that says you know they're using sequel injection to drop ransomware when you start off you say oh that's interesting they're using sequel injection to drop ransomware but when you sort of start after you've done this you know a number of times and you see rants were being dropped in number different ways then you can start asking questions like why are they using you know sequel injection and drop ransomware that's kind of weird or why are they dropping ransomware you know this month they're usually been doing crypto miners hmm and so as you develop those as you develop experience and start learning the different ways of which things have been done historically then you can start sort of seeing the broader picture and picking out the trends that are interesting and why they're interesting a lot faster and I think that's really what leads to a more on more effective intelligence expert okay so what advice would you have for people who are looking to make a curse switch into cybersecurity from other careers like you say you've you've you know you had other areas of interest and stuff so like from it you know whether you're just picking it up from this episode or you've been laying out anyway from an interview perspective what are some things that you can sort of put on your resume or in your cover letter or talk about your interview that would make you your prospective employer know that you'd be great for this job even if you don't have you know the correct time posts and yours might indicate that relation question I mean obviously that's the best thing again say you know if you're looking to go inside security check out this program it's great get a manager in security but but beyond that I think to me there's two things that really stand out about someone the easiest one easiest one for someone to start doing is that read the news you have to be really well-versed in what's going on in the world especially in the threat intelligence world or in general just the cybersecurity world okay so you know beyond just your basic CNN comms right we're also go out and start reading things like leaving computer where you're gonna get really good security news guys in an interview when I'm talking to someone if they're referencing the latest and greatest activity that they've been seeing you know based on their the Reap reading of open source articles that indicates to me that somebody has interests in cybersecurity and as willing to you know take the extra step of actually reading stuff about it and can understand and digest it and effective fashion so I'd say that's money one good way to sort of signpost hey I'm interested in cybersecurity and I get um the other main thing that I've always looked for interviews it's just passion just somebody who's really passionate and excited about cybersecurity and it's sort of a tough quality to explain how to make that come across and everybody's going to show their passion differently but doing your best to show this is something that you're passionate about to me I will you know ten times out of ten take a passionate candidate because that's somebody I can try anyone you know you can teach anyone basic technical skills but you can't train passion that's something that's see how inherent in you and something that you're excited about it then that's something that I want you to be able to do mm-hmm now what you know didn't without you know going into super granular detail like what you know we keep saying well if you you know we can train you the tech and stuff you know if you have the passion or you have the background but like what is the sort of baseline tech that a beginning threat intelligence person needs to know that you're probably going to train them in let's say you know the two main things are gonna be basic Network basic network protocols or basic networking and a good way to understand thing about this is you know you should be able to understand if I go on my computer at cnn.com roughly what's happening from a network perspective yeah just because then network understanding of you know for you know DNS resolution basic network connects shame and protocols how the how information is sent back and forth that sort of technical understanding even if it's you know medium depth will help you when you read things to understand what's happening on the other key thing from a technical perspective that I I have found helpful and I know there's people on both sides of this issue is the the mitre attack chain no I think it's very helpful to understand from a threat intelligence perspective because there's when you're thinking about how attacks happen understanding you know the process here of starting off you know with reconnaissance that you're moving forward preparation actual attack and then what happens after that and a lot of movement understanding that sort of front to back process will help when you're learning what's going on by being able to slap that in so say okay so sequel injection is the initial infection there's the you know vulnerability it's being exploited but then the actual payload that's being dropped if ransomware okay so I see now how these fit in to the overall timeline so when I'm telling the story I can help understand and kind of categorize where things are going so I think that's a good framework IBM also has our own internal framework that we use or threat chain and sort of understanding the chain of events it's a little bit unique and I like it a lot as well that's a bit different from mitre but I reference miners because because that's one that a lot of people know oh yeah yeah we're interested check out IBM's attack chains well we have Korean okay yeah now we have lots of mitre tech articles on our on our on our blog so if you guys want to get a foot in the door come check out resources I didn't website Institute calm and also check out was it IBM's what was it called its our operation framework I can okay so how is the threat intelligence landscape changed in practice since you began a you know you've been doing for a while and where do you see it going in the years to come life as the sort of methodology changed has what are we doing differently these days that's a great question so I'd say the the way for intelligence is done has changed a little bit that there's a lot more people doing it and that essaouira as we were talking about before in terms of freelance you'll see this all if you go on Twitter there's a lot of folks on Twitter posting threat intelligence of varying quality there's some great people on there doing some really good stuff can also some people on there who are kind just taking their best guesses and then putting out there as fact so one of the big risks that you run into is as people go out there and say oh I saw this on Twitter is it true and I don't know yeah sorry okay the other thing that has changed quite a bit is we're seeing a lot more organized when I started CrowdStrike was new right no one heard of them they were brand new organization it was just getting started now and the crowds right that's one of that is it big big player in the market laughs and others I'm so we're seeing a lot more big players that just do threat intelligence or do threat intelligence is sort of one of their primary missions and I think that's great I think it's great there's a lot of folks out there doing threat intelligence because it makes all of our all of our organizations better right I think that by having more competition out there we're all sort of forced into doing doing hard work which i think is great but one thing that's kind of come out of that as well so we've found new ways to gather data new ways to understand what's happening we've also sort of expanded our strategic perspective because we now that we've been doing this for a few more years we can now we as a broader threat intelligence community can start drawing on conclusions that from a much broader but much broader set I mean when when I started off in this in 2011 the idea of a lot of these attacks were still relatively new I think I mean stuffs now is still fresh in your mind right but that was really the only destructive attack you'd see but now when you look you know here we are in 2020 we've seen a whole handful of destructive malware attacks right and now now I'm in was able put out a paper all about destructive malware because we've seen so many of these attacks whereas the 2011 when I started we just didn't have that much data there wasn't that much it's not that necessarily things we're happening we just didn't have that much access to it and really the only major try to tell groups tended to be government now we're seeing private industry really get into it more which I think it's great and now there's a lot of opportunities there for people looking to get into the field but also a lot of great opportunities for us to sort of build a collective framework for threat intelligence which is pretty cool now I'm guessing I know the answer this because it sounds like it's such a you know sort of personal and research-based thing but apart from the ways that all our work lives have changed right now has the practice of threat intelligence change at all with the the current pandemic the practice of it hasn't for me at least so realistically threat intelligence in a lot of ways that pretty decentralized yeah field so the need for people to be in offices so for me that haven't made a major change I think it's probably the case for a number of organizations I think there's been some some changes in terms of you know what we're seeing in turn and threat intelligence but in terms of we've actually practiced thankfully pandemics had relatively minimal effect in my experience anyways mm-hmm so what are some of the cyber threats you're currently that are currently looming largest on the horizon in your experience that you and IBM are engaging with the most frequently that's always risky questioning because the minute you say may say anything changes right or they see them I think security I think that organizations are moving in cloud environments more and more and and realistically for actors get that they see that organizations are moving huge amounts of data into cloud environments and that there's potential gaps or or risks when you're kind of looking that could be presents potentially and so they're trying to take advantage of those worldö became and find out find those gaps if they're if they're there and it's a good opportunity for threat actor because it means that I can I could potentially cause more harm that I could like just breaching an endpoint and I don't have to worry about as much lateral movement there's a lot of a lot of benefit there um and so to me where I see things kind of going is looking at how do we best secure cloud environments and what are the security considerations when we're looking at cloud environments and how can we make sure that were protecting them as I'm sure you know you know IBM's very heavily invested in cloud environments and cloud security right so this is something that we're uniquely interested in from a variety of perspectives and including threat intelligence understanding how threat actors are trying to kind of break into that okay this has been a great talk I just wanted to thank you for your time and insight here now if people want to know more about Charles de Becque or your doings at IBM where can they go online otherwise non security intelligence comm which is IBM's main site for for information has my profile on there and then you can look at some the other work I've done as well but I'd say those are problem nightmare equations okay if you have any final tips for potential threat intelligence people know it's a great I really enjoy it's a great combination of sort of the strategic understanding of how things work and that strategic understanding of you know geopolitics and computing and governance and networking and taking all of that information and then somehow crafting it into a story that somebody can understand that doesn't have all that knowledge so I think it's a great opportunity for folks to get into as sort of a niche field which is kind of fun but I highly recommend I think it's great Charles de Burgh yeah thank you very much Charles du Bac thanks for your insights this has been so much fun and I think a lot of people who are listening are probably doing some quick research right now to look into their new career so thank you thank you the time and thank you all for listening and watching today if you enjoyed today's video you can find many more on our YouTube page just go to youtube.com and type in cyber work with InfoSec to check out our collection of tutorials interviews and past webinars if you'd rather have us in your ears during your work day all of our videos are also available as audio podcasts just search cyber work with info second your podcast catcher of choice and if you wouldn't mind we'd love a five star rating and review and whatever you listen in it always does help us to get to new listeners so for a free month of the InfoSec skills platform just go to InfoSec institute comm slash skills sign up for an account and there is a coupon code there type in cyber work all one word all small letters no spaces and get your free month thank you once again to charles de Becque and thank you all for watching and listening we will speak to you next week you [Music]

Channel: Infosec

Views: 7,337

Keywords: cybersecurity, cyber work, charles debeck, infosec, information security, cyber threats, threat intelligence, careers, cybersecurity jobs, career advice, cybersecurity careers, free cybersecurity training, infosec skills, ibm, podcast, cyber security, cyber threat intelligence

Id: VNrFzPUxUyk

Length: 42min 17sec (2537 seconds)

Published: Mon Jun 29 2020