A carregar...
Publicação
Assessment of cyber threats discovered by OSINT
| Nome: | Descrição: | Tamanho: | Formato: | |
|---|---|---|---|---|
| 5.39 MB | Adobe PDF |
Autores
Resumo(s)
Despite the high maturity levels of CTI (Cyber Threat Intelligence) tools, techniques,
procedures and frameworks, there are still gaps that must be considered and addressed.
More than 50% of the world’s population is now online and growing, as the COVID-19
pandemic is pushing the large-scale adoption of technology in the most diverse areas.
This context, aligned to the emerging technologies (e.g.: Cloud-computing, IoT, 5G) is
enabling, allowing, and amplifying more complex and faster cyber-attacks. “Security-by design” is not yet the main principle, as products need to be quickly deployed into the
market, delivering vulnerable targets into the Internet ecosystem. It is estimated that cy bercrime inflict damages of 6 billion USD in 2021, growing 15% per year, positioning it
as the world’ third-largest economy, reaching 10.5 billion USD in 2025 [1]. Cyberattacks
on critical infrastructures was considered the fifth top risk in 2020, as structural industries
and sectors are juicy targets. On the other hand, the likelihood of detection and prosecu tion is estimated to be 0.05% in the USA [2]. To fight this threat and reduce the risk, it is
essential that CTI parties join forces to improve coordination and cooperation, to reduce
the time between the generation of CTI and its dissemination and achieve the balance
between CTI in-time-dissemination and high-quality CTI. The quality of CTI is a huge
barrier: most of the platforms ingest data from paid feeds and OSINT sources, gathering,
filtering, analyzing, and aggregating, usually with little or no data-quality assessment.
This increases the pressure on cyber-security analysts, who deal with plenty of generated
alerts. IoCs (Indicator of Compromise) must go through an assessment process and be
scored, so CTI consumers can decide and suit the measures accordingly. According to
ENISA 2020 CTI survey [3], only 4% of CTI users can implement processes to measure
CTI efficiency. This dissertation presents an overview of the existing CTI methodologies
and technologies, proposing one solution to be adopted and integrated in CTI tools to
assess, qualify, score and advise cyber-security analysts.
Descrição
Tese de mestrado, Segurança Informática, Universidade de Lisboa, Faculdade de Ciências, 2022
Palavras-chave
cibersegurança informações de ciberameaças informações de fonte aberta (OSINT) indicadores de comprometimento (IoC) qualidade dos dados Teses de mestrado - 2022