Month: February 2017

In 2015, I published a blog post about the completion of a 90-day proof-of-concept experiment, called Project Redstone. The experiment, conducted by the Cyber Threat Alliance (CTA), tested the theory that, if cybersecurity vendors collaborated in their efforts to combat cyberattacks, they’d be more effective as a group than as individual companies.

In that post, I listed four capability gaps that the CTA needed to address to be successful. They included:

1. How do we convert large volumes of indicators of compromise into prevention controls?
2. How do we measure alliance member contributions with more granularity?
3. What is the common set of success metrics for deployed security controls across Alliance membership?
4. What is the right sharing architecture that works at scale?

We knew that, if the CTA were to be successful, these four gaps had to be closed. Frankly, there are numerous threat intelligence sharing platforms, and other cybersecurity groups are actively promoting industry collaboration on cybersecurity issues. What makes the CTA different?

It’s a fair question. The tech landscape is littered with industry groups promoting one standard over another or advocating for industry collaboration, and many cybersecurity veterans are quick to dismiss yet another one as a marketing program that’s long on promises, short on results.

I believe those same veterans will be pleasantly surprised to learn about the fantastic progress the Cyber Threat Alliance has made. While that progress was detailed in a press release the CTA issued yesterday, and a blog post from our CEO Mark McLaughlin, I’d like to spend a moment focusing on three characteristics of the CTA that address the capability gaps mentioned above to demonstrate that the CTA’s approach to threat intelligence sharing works.

1. Everyone Contributes

The ability of a threat intel platform to successfully identify and stop new threats is directly related to the quality and quantity of its intel. This is problematic for many threat intel sharing agreements as the larger companies end up contributing the majority of the intel, because they have the resources to gather it, while the smaller members consume more intel than they provide. It’s a lopsided arrangement that can lead to resentment between members and a less robust intel sharing platform. The CTA requires all members to actively contribute to the threat intel pool on a daily basis and holds each member accountable. If a company doesn’t contribute, they can’t remain in the CTA. This ensures the CTA will collectively have access to the best intel available at the time.

2. Exchanges Adversary Playbooks, not one-off Indicators of Compromise

The problem with many threat intel exchanges today is context. While these exchanges can push hundreds of thousands of newly discovered cyberthreats out to members every week, if the threats aren’t put in the proper context (Who is attacking? What is their motivation? Are they targeting specific types of organizations? etc.), it’s difficult for security teams to determine which present the most risk to their network. Without that context, they have to assume all threats are a significant risk, and very few teams can scale to address the thousands of cyberthreats to which their threat intel platforms alert them every day.

This is why the CTA focuses on adversary playbooks. Adversary playbooks speed up analysis and enable defenders to focus more easily on the real goal: protecting against attackers and the various tools and tactics they use. Adversary playbooks integrate individual indicators of compromise (IoCs) in the cyberattack lifecycle into discrete, actionable threat intelligence that CTA members use to build detection and prevention controls for each of our own products. The end result: no matter which cyberattackers are trying to get onto the network or which CTA member’s technology is protecting the network, if they’re accessing the target network using methods already identified in the adversary playbooks, they can be stopped at any point in the attack lifecycle.

Let me use a sports analogy to explain. In football, when two teams prepare for a game, the coaches prepare both defensive and offensive playbooks. It is the same in cyberspace. Network defenders prepare the defensive playbook – how to respond to an ongoing incident for example – and the cyber adversaries prepare an offensive playbook – how to navigate through each phase of the cyberattack lifecycle. We know that cyber adversaries do not invent new attack sequences on the fly for every new victim. They reuse attack sequences that have been successful in the past in the attack lifecycle until the network defenders figure out how to defeat them. Those attack sequences are the cyber adversary’s playbook.

The idea behind sharing adversary playbooks with Alliance members then is that the act exponentially increases the odds that a network defender can actually stop an attack. Instead of sharing one-off IoCs with little or no context, as most sharing organizations do, we share the entire adversary playbook. If the cyber adversaries manage to find a way around one of the network defender’s prevention controls, they will immediately run into the next prevention control in-line in the attack lifecycle. The Alliance aims not to simply prevent a piece of the adversary’s attack sequence – it aims to defeat the entire playbook.

3. Automates the Last Mile for Threat Intel

Realizing that the volume of threats inundating organizations can be hard to keep up with, the CTA is the only sharing organization that can automate the delivery and configuration of prevention controls to its members’ products and platforms. It’s a tremendous help to the CTA members’ customers as it relieves them of the burden of analyzing every new threat and installing the appropriate fix on the network or endpoint. The CTA threat intel platform does this automatically, freeing security teams from the tedium of doing it themselves and letting them focus on their real purpose: identifying and preventing more advanced threats that are likely to go undetected.

Even in well-run sharing organizations, like many of the ISACs, members still have to receive the intelligence, decide that it applies to their network, decide what to do about it, and then do it. For many organizations, this takes days to weeks to accomplish, if it happens at all. I call that crossing the last mile with intelligence.

Because Alliance members are security vendors and already have automated mechanisms to install new prevention and detection controls to their products deployed in the field, the Alliance is perhaps the only organization that has the ability to automatically cross the last mile for its collective customer base without the network defender having to do anything. Already, we’ve seen the CTA Platform succeed in this. In one example, a single shared sample allowed a member to build protections before its customers were targeted, preventing successful attacks against 29 organizations. In another example, shared data allowed a member to identify a targeted attack against its customer and release additional indicators to defend that organization. Further, many of the members find that 40-50 percent of shared data is brand-new to them, and most of that is directly actionable. These are early successes, but it’s clear that things will only get better as the CTA grows.

Like Mark said in his own post, I also believe that, as we continue to expand the CTA, we are stronger together, and I look forward to updating you in the future on the Alliance’s continued progress and successes in helping to protect customers.

Rick Howard

[Palo Alto Networks Research Center]

Yesterday, I stepped on a stage in San Francisco with CEOs and leaders from five other cybersecurity companies – Check Point, Cisco, Fortinet, Intel Security and Symantec – to announce the revamped, bigger and now-independent Cyber Threat Alliance.

Normally, we are competitors. However, the Cyber Threat Alliance brings us all together in good faith to share threat information for the purpose of improving defenses against advanced cyber adversaries across member organizations and our respective customers.

Our company mission is to maintain trust in today’s digital world, and the collective intelligence from the Cyber Threat Alliance ecosystem – the output of which will be delivered through our Next-Generation Security Platform – furthers our ability to enable our customers to successfully prevent cyber breaches. We six founding members now also agree that this expanded and independent Cyber Threat Alliance is key to advancing that mission.

To make the Cyber Threat Alliance a more effective and powerful force, we announced the:

• Establishment of the Cyber Threat Alliance as its own, truly independent organization with a president, board of directors, and governance structure.
• Appointment of Michael Daniel as the first president of the Cyber Threat Alliance. Michael was formerly special assistant to the president and cybersecurity coordinator for the White House and brings unique and valuable expertise to this position.
• Addition of Check Point and Cisco to this powerful group of founding members, and additional affiliate and contributing members (e.g., InSights, RSA and Rapid7).
• Unveiling of the Cyber Threat Alliance Platform for Threat Intelligence Sharing, which is now fully operational and actively sharing tens of thousands of samples and pieces of active threat intelligence each week.

Ultimately, the vision of the Cyber Threat Alliance and its members is threefold:

1. To share threat information in order to improve defenses against advanced cyber adversaries across member organizations and their customers.
2. To advance the cybersecurity of critical information technology infrastructures.
3. To increase the security, availability, integrity and efficiency of information systems.

With yesterday’s announcement, we made a bold step forward on our first vision item. As a founding Cyber Threat Alliance member and consistent driver of automated threat intelligence sharing, Palo Alto Networks is pleased with the continued forward momentum toward collectively improving the industry’s defenses against advanced cyber adversaries.

Next comes our work on the second and third vision items while we continue to improve the Cyber Threat Alliance Platform and add new members. We believe that by expanding the Cyber Threat Alliance, we are stronger together and can overcome some of the inherent challenges in isolated approaches to cybersecurity.

For us here at Palo Alto Networks, the Cyber Threat Alliance is another way that we show our longstanding and fundamental commitment to the importance of threat information sharing. We have said for years that the industry and the public sector must operationalize threat information sharing; that’s the best way to shift the balance of power against cyber adversaries. The Cyber Threat Alliance and its new operational platform is a realization of that belief. As a founding member, we have been involved in the Cyber Threat Alliance since it started in 2014, and yesterday’s announcements are a realization of the goals and vision we had when this all began.

We are committed to strong, continued support and participation in the Cyber Threat Alliance. I look forward to updating you in the future on the Cyber Threat Alliance’s progress in our shared vision.

Mark McLaughlin

[Palo Alto Networks Research Center]