Security Innovation & Startup ALIENVAULT OTX OPEN THREAT EXCHANGE (OTX): THE HISTORY AND FUTURE OF OPEN THREAT INTELLIGENCE COMMUNITY PRESENTATION OVERVIEW  A very quick overview of AlienVault  Our Open approach to crowd sourced threat intelligence  The OTX Platform and Data ABOUT ALIENVAULT AlienVault is the leading provider of Unified Security Management (USM) and crowd-sourced threat intelligence technology required to detect and act on today’s advanced cyber threats USM PLATFORM 5 CRITICAL CAPABILITIES SECURITY INTELLIGENCE/SIEM • SIEM Event Correlation • Incident Response BEHAVIORAL MONITORING • Log Collection • Netflow Analysis • Service Availability Monitoring ASSET DISCOVERY • Active Network Scanning • Passive Network Scanning • Asset Inventory • Host-based Software Inventory powered by AV Labs Threat Intelligence THREAT DETECTION • Network IDS • Host IDS • File Integrity Monitoring VULNERABILITY ASSESSMENT • Continuous Vulnerability Monitoring • Authenticated / Unauthenticated Active Scanning THE ATTACKER’S ADVANTAGE  They only need to be successful once  Determined, skilled and often funded adversaries  Custom malware, 0days, multiple attack vectors, social engineering  Persistent IMPORTANCE OF SHARING “In the case of threat-intelligence sharing, the adversary has only to mess up once – being detected – and all the defenders will know about it. It’s in our best interest, as an industry, to keep the odds ever in our favor.” -- Wendy Nather, 451 Group, 2014 Threat Intelligence Report  Helps you to achieve a preventative response to changes in the threat landscape by learning how attackers are targeting others  Armed with real-time, detailed security event information, you can update your defenses to avoid becoming a victim  The right solution will allow you to automatically share anonymized threat information OPEN THREAT EXCHANGE OTX • Launched in 2012 - The world’s largest open threat sharing and analysis network • Supports more than 26,000 participants in over 140 countries contributing more than 1 million threat indicators daily • Provides access to realtime, detailed information about threats and incidents around the world COLLABORATION POWERING OTX Collaborate Openly research and collaborate on emerging threats. Defend Integrate with AlienVault USM or Export IoCs to any security product Learn Extract, validate and investigate threat data from logs, blogs, articles and reports ) THE DEFENDER’S DILEMMA First Street Credit Union Alpha Insurance Group John Elway Auto Nation Zero Cool Telecom Soylent Green Foods THREAT INTELLIGENCE APPLIED Intelligence improves the defender’s odds First Street Credit Union Alpha Insurance Group John Elway Auto Nation Detect Open Threat Exchange Zero Cool Telecom Soylent Green Foods THREAT INTELLIGENCE APPLIED Discovery improves odds for other defenders First Street Credit Union Alpha Insurance Group John Elway Auto Nation Detect Open Threat Exchange Zero Cool Telecom Soylent Green Foods OTX 1.0 IP REPUTATION DATA  Updates provided every 30 minutes  200,000-350,000 validated malicious IP’s at any point Malware Domain Distributing malware or hosting exploit code Malware IP Instrumental in malware, including malicious redirection Command and Control Sending command and control instructions to malware or a botnet Scanning Host Observed repeatedly scanning or probing remote systems APT Observed to be actively involved in an APT campaign Spamming Host Actively propagating or instrumental in the distribution of spam Malicious Host Engaged in malicious but uncharacterized activity OTX 2.0: “PULSES” CROWD SOURCED THREAT RESEARCH  THE FACE OF OTX – SOCIAL INTERFACE TO COLLABORATIVELY DEVELOP & SHARE THREAT INTELLIGENCE IN REALTIME  CREATE, ENHANCE OR CONSUME “PULSES” – SHORT MULTIVARIATE ANALYSIS OF THREAT INDICATORS  EXPORT INDICATORS OF COMPROMISE INTO SECURITY TOOLS (OPENIOC, STIX) AND AUTOMATICALLY CONSUME IN ALIENVAULT PRODUCTS  INTEGRATE & EXPLORE THROUGH AN OPEN API  STRENGTHEN DEFENSES AND HELP OTHERS DO THE SAME INVESTIGATING THREATS  Pulse: ONE data construct for ALL types of threats (Data breach, Botnet, APT Campaign, etc.)  Defined by Indicators of Compromise or IoCs : (md5, IPv4s, URLs, hostnames, etc.)  Explore attack vectors and threat geolocation information  Share and comment on Pulses and IoCs OTX HOME PAGE DETAILED INTELLIGENCE ADDITIONAL DETAIL CREATING A PULSE FRO