To be able to stop a threat you have to know the threat exists.
And as an IT professional, you will be doing a lot of research
around these threats.
The threats are changing all the time, the scope of the threats
is different every time.
And although you may understand how an attacker gets
into one network, it'll be a completely different method
they use for a different network.
You also find yourself collecting research information
from many different resources.
Every resource has a different emphasis and a different amount
of information they can provide and you're
going to have to bring all of that information together
to really understand these threats.
If you're interested in knowing the threats associated
with an operating system or an application,
you should start with the companies
that wrote the operating system or the application.
Those vendors know their products
better than anyone else.
And they're also often the first one
to know about vulnerabilities.
There's usually a page on a vendor's website
where they keep track of all of the known vulnerabilities.
And usually there's some type of notification process
so they can inform you immediately
when a new vulnerability is discovered.
The National Institute of Standards and Technology
maintains a comprehensive database of vulnerabilities.
This is the National Vulnerability Database
and it keeps within that database
a list of CVEs or Common Vulnerabilities and Exposures.
It's common to supplement this database with third party
feeds from other organizations.
You might roll up all of those vulnerability
feeds into one central vulnerability management
system.
This allows you to keep track of all the latest vulnerabilities,
identify vulnerabilities that may
be specific to your environment and have some method
to be able to be informed immediately when
a vulnerability is disclosed.
Another good source of information
comes from conferences.
This is a place you can go to learn
the latest of vulnerabilities and threats
that could be affecting you.
There are usually researchers that will present information
at these conferences that can help explain things
that they found that are new, trends
that may be occurring in the industry or information
about the latest hacks.
This is also a good place where you
can learn from people who've gone through these attacks.
Very often there's some lessons that can be taken away
and their stories can help give you
ideas of how to protect your network even better.
And since this is a grouping of people who have similar goals,
it's a great opportunity to forge
some professional relationships and have
people you can talk to after the conference is over.
If you want to get detailed information about attack types
and how people have had to deal with them,
then you want to reference some academic journals.
These are usually periodicals or online resources
that are written by industry experts.
They usually provide information about existing security
technologies and evaluate which types of security technologies
may be better than others.
These are also great resources to learn detailed information
about the technology.
It's common to find a deep dive into a type of malware
where it has been broken apart, decompiled,
and you really understand exactly the way
the malware operates.
These journals are also great places
to learn more about very specific aspects
of the technologies you may be using today.
If you want to learn more about the details behind the scenes,
these academic journals will provide it.
If you've done any type of work in information technology,
then you've probably heard the term
RFC referred to a standard or a method of doing
a particular task.
RFCs are a way to track and formalize
a set of standards that anyone on the internet can use.
And although many of these RFCs are standards documents,
you'll also find other types of documents such as Experimental,
Best Current Practice, Standard Track, and Historic Documents.
Some of these RFCs also provide a detailed analysis
of certain types of threats.
For example, RCF 3833 is the threat analysis
of the domain name system.
By reading through these RFCs, you
can not only understand how these standards
are supposed to operate.
But you can understand some of the vulnerabilities that
may exist within the standards themselves.
On my monthly study group meetings,
you'll often hear me encourage people
to visit their local user group meetings.
That's because there is a wealth of information
that you can gather not only from the people
presenting at the user group but from the members of the user
group as well.
These are often local chapters where
you can visit monthly or quarterly meetings to stay up
to date on the latest news.
You may also find valuable information at user groups
that are not specific to IT security
but still very much a technology organization
such as a Cisco user group, Microsoft user group or others.
Not only are you learning valuable technical information
at these user groups, you're meeting the local people
in your area that you can use whenever you might
need some type of resource.
There is a wealth of security information on social media.
For example, the large hacker groups
will often put information on Twitter
that will describe recent vulnerabilities they've
discovered or recent attacks that they've completed.
There's also a number of resources on Twitter
that can give you details about new vulnerabilities that
are discovered or new attacks that may be occurring.
For example, there's some honeypot accounts on Twitter
that will tell you when new exploits are being attempted
against those honeypots.
The search feature on Twitter can also
be a valuable information gathering tool.
You can search for a particular CVE
or look for the terms bugbounty or 0-day
to see what other people may be announcing
or what they may be seeing on their network.
This is also a good place to see other professionals
having conversations about these threats
and understanding more about ways
to block these threats should it occur on your network.
And it's not too unusual to see social media used
as a method of command and control.
You may be able to monitor how certain malware is operating
based on the posts that are being made to Twitter.
And although it's useful to do these ad hoc social media
searches, it's also important to be informed immediately
when a threat is emerging.
That's why you should have some type of automated threat
feed that's going to give you information
about the most important threats you need to know about.
There are many different resources
for these threat feeds, for example,
the US Department of Homeland Security, the FBI, the SANS
Internet Storm Center, VirusTotal Intelligence,
and other feeds as well.
The information you're often looking for is a TTP.
This is a tactic, technique, and procedure.
This is understanding the methods
that the attackers are using to get
into your network and the process
they're going through once they get access.
The more you understand the attacker's TTP,
the better you're going to be at recognizing these tactics
if they happen to appear on your network.
And of course, one of the challenges with this
is that the TTP will change depending on the situation.
For example, an attacker might use a different tactic
if it was a finance company versus a manufacturing company.
It's also good to know where an attacker likes
to spend their time.
If you know they spend a lot of effort trying
to find vulnerabilities in DNS or an IP address vulnerability,
then you can focus your defense in those areas.
Or you may find that a particular type of malware
has become very popular and you're
able to put the proper mitigations in place
to prevent that malware from operating on your network.