NopSec.com uses cookies to make interactions with the Company’s Websites easy and meaningful. When you visit one of the Company’s Websites, NopSec.com’s servers send a cookie to your computer. Standing alone, cookies do not personally identify you; they merely recognize your Web browser. Unless you choose to identify yourself to NopSec.com, either by responding to a promotional offer, opening an account, or filling out a Web form (such as a “Contact Us” or a “Free Trial” Web form), you remain anonymous to the Company. Please go to our privacy statement for details.

Acknowledge

Threat Intelligence: one size does not fit all

Abstract Technology Blog Feat Img

Literally a flood of lines have already been written about Security Threat Intelligence and its uses, so I would not bother the readers with more rhetoric. Just wanted to inform our NopSec interpret and uses threat intelligence as part of the Unified VRM platform.

As part of my job I need to read a lot. And usually I don’t miss any article. As part of this reading task, lately I came across a lot of threat intelligence articles and commentaries. Most of them talk about malware and Bot Command & Control channels, Indication of Compromise signatures, URLs, IPs, other sources of Open Source Security Information. In my mind, it’s a huge amount of data. But is it information? Is it all useful? Does one size and definition of threat intelligence fit all?

In our definition, at NopSec, no one size and definition fit all.

Here at NopSec we use open source security information and threat intelligence feeds in order to prioritize vulnerabilities for remedial action for our customer. Our thinking process is as such: if you have an indication that those discovered vulnerabilities in your networks and applications could be used to successfully compromise you, you’d better fix ’em now and forever.

For the purpose of drawing this correlation we only malware feeds, indication of compromise repositories, intrusion detection and honey pots feeds, SCAP correlated databases, public repositories of exploits, patch management feeds for various vendors.

For the malware and the IoT feeds, we grab the malware hashes, convert them to malware names and then search the open internet to find out whether or not they are correlated with vulnerability CVEs found on our customers’ networks and with publicly available exploits. Once that correlation happens, we are able to prioritize vulnerability remedial actions for our customers.

NopSec uses a combination of commercial and publicly available threat intelligence feeds and information, including, but not limited:

  1. Public and private exploit database, including exploit-db.
  2. SCAP correlated searchable and updated database.
  3. Update vendor security patch feeds.
  4. Shodan, for compromised and vulnerable hosts
  5. Google Safe Browsing API.
  6. The following public threat intelligence feeds, including Alienvant OTX v2, CERT threat feed, SANS threat feed, FS-ISAC, malc0de, zeustracker, Malware Patrol, CleanMX.
  7. Other private threat intelligence malware feeds: we will be releasing public announcements about these soon.

As I said we use only malware hashes for correlation. We do not use IP addresses, URLs, C&C URLs, and other types of threat intelligence.

We aggregate all this information in a NoSQL searchable database for correlation and active search. This search facility directly plug into analytics and Unified VRM.

More details on our threat intelligence framework coming soon.

Schedule a Product Demo Today!

See how NopSec's security insights and cyber threat exposure management platform can organize your security chaos.