Publicação
Assessment of cyber threats discovered by OSINT
| datacite.subject.fos | Departamento de Informática | pt_PT |
| dc.contributor.advisor | Respício, Ana Luísa do Carmo Correia, 1965- | |
| dc.contributor.advisor | Ferreira, Pedro Miguel Frazão Fernandes | |
| dc.contributor.author | Gomes, Francisco Contreras Leão | |
| dc.date.accessioned | 2022-07-11T10:19:48Z | |
| dc.date.available | 2022-07-11T10:19:48Z | |
| dc.date.issued | 2022 | |
| dc.date.submitted | 2021 | |
| dc.description | Tese de mestrado, Segurança Informática, Universidade de Lisboa, Faculdade de Ciências, 2022 | pt_PT |
| dc.description.abstract | Despite the high maturity levels of CTI (Cyber Threat Intelligence) tools, techniques, procedures and frameworks, there are still gaps that must be considered and addressed. More than 50% of the world’s population is now online and growing, as the COVID-19 pandemic is pushing the large-scale adoption of technology in the most diverse areas. This context, aligned to the emerging technologies (e.g.: Cloud-computing, IoT, 5G) is enabling, allowing, and amplifying more complex and faster cyber-attacks. “Security-by design” is not yet the main principle, as products need to be quickly deployed into the market, delivering vulnerable targets into the Internet ecosystem. It is estimated that cy bercrime inflict damages of 6 billion USD in 2021, growing 15% per year, positioning it as the world’ third-largest economy, reaching 10.5 billion USD in 2025 [1]. Cyberattacks on critical infrastructures was considered the fifth top risk in 2020, as structural industries and sectors are juicy targets. On the other hand, the likelihood of detection and prosecu tion is estimated to be 0.05% in the USA [2]. To fight this threat and reduce the risk, it is essential that CTI parties join forces to improve coordination and cooperation, to reduce the time between the generation of CTI and its dissemination and achieve the balance between CTI in-time-dissemination and high-quality CTI. The quality of CTI is a huge barrier: most of the platforms ingest data from paid feeds and OSINT sources, gathering, filtering, analyzing, and aggregating, usually with little or no data-quality assessment. This increases the pressure on cyber-security analysts, who deal with plenty of generated alerts. IoCs (Indicator of Compromise) must go through an assessment process and be scored, so CTI consumers can decide and suit the measures accordingly. According to ENISA 2020 CTI survey [3], only 4% of CTI users can implement processes to measure CTI efficiency. This dissertation presents an overview of the existing CTI methodologies and technologies, proposing one solution to be adopted and integrated in CTI tools to assess, qualify, score and advise cyber-security analysts. | pt_PT |
| dc.identifier.tid | 203205197 | pt_PT |
| dc.identifier.uri | http://hdl.handle.net/10451/53746 | |
| dc.language.iso | eng | pt_PT |
| dc.subject | cibersegurança | pt_PT |
| dc.subject | informações de ciberameaças | pt_PT |
| dc.subject | informações de fonte aberta (OSINT) | pt_PT |
| dc.subject | indicadores de comprometimento (IoC) | pt_PT |
| dc.subject | qualidade dos dados | pt_PT |
| dc.subject | Teses de mestrado - 2022 | pt_PT |
| dc.title | Assessment of cyber threats discovered by OSINT | pt_PT |
| dc.type | master thesis | |
| dspace.entity.type | Publication | |
| rcaap.rights | openAccess | pt_PT |
| rcaap.type | masterThesis | pt_PT |
| thesis.degree.name | Tese de mestrado em Segurança Informática | pt_PT |