Threat Intelligence services

Question 1

Threat Intelligence Services

Answer 1

Threat intelligence services allow the exchange of threat information such as vulnerabilities, indicators of compromise (IOC), and mitigation techniques. This information is not only shared with personnel, but also with security systems. As threats emerge, threat intelligence services create and distribute firewall rules and IOCs to the devices that have subscribed to the service.

Question 2

Cisco Talos

Answer 2

Talos is one of the largest commercial threat intelligence teams in the world that help protect enterprise users, data, and infrastructure from active adversaries.
The Talos team collects information about active, existing, and emerging threats. Talos then provides comprehensive protection against these attacks and malware to its subscribers.

Question 3

FireEye

Answer 3

FireEye uses a three-pronged approach combining security intelligence, security expertise, and technology.
FireEye offers SIEM and SOAR with the Helix Security Platform, which uses behavioral analysis and advanced threat detection and is supported by the FireEye Mandiant worldwide threat intelligence network.

attacks across web and email threat vectors, and latent malware that resides on file shares. It can block advanced malware that easily bypasses traditional signature-based defenses and compromises the majority of enterprise networks. It addresses all stages of an attack lifecycle with a signature-less engine utilizing stateful attack analysis to detect zero-day threats.

Question 4

DHS

Answer 4

Department of Homeland Security

Question 5

AIS

Answer 5

Automated Indicator Sharing
AIS creates an ecosystem where, as soon as a threat is recognized, it is immediately shared with the community to help them protect their networks from that particular threat.

Question 6

CVE

Answer 6

Common Vulnerabilities Exposures
The CVE serves as a dictionary of common names (i.e., CVE Identifiers) for publicly known cybersecurity vulnerabilities.

Question 7

CTI

Answer 7

Cyber Threat Intelligence

Question 8

STIX

Answer 8

Structured Threat Information Expression (STIX) - This is a set of specifications for exchanging cyber threat information between organizations. The Cyber Observable Expression (CybOX) standard has been incorporated into STIX.

Question 9

TAXII

Answer 9

Trusted Automated Exchange of Indicator Information (TAXII) – This is the specification for an application layer protocol that allows the communication of CTI over HTTPS. TAXII is designed to support STIX.

Question 10

CybOx

Answer 10

This is a set of standardized schema for specifying, capturing, characterizing, and communicating events and properties of network operations that supports many cybersecurity functions.