Re: [cti-cybox] CybOX Objects/Relationships

Also i would note that CTI should benefit users of various maturity/capability levels unless envisioned otherwise

On Sunday, 10 April 2016, Patrick Maroney <Pmaroney@specere.org> wrote:

Re: "In most scenarios it wouldn't matter... I'll normally be looking for the malware, not the email it was sent in (which would be constantly morphing)"

This may indeed be a completely valid statement from a given vendor specific perspective.

Speaking from the perspective of the organizations actually dealing with 100s to 1,000s of targeted attacks/week: the root objective is to proactively detect and stop all variants of such attacks dead in their tracks at one's perimeter (not at the exploitation phase where the malware is in it's final delivery/execution state). Sharing all of the details of such attacks allows us to collectively develop the signatures necessary to meet this objective.

Understanding the characteristics of attack packages, containerization, targeting patterns, etc. and *how* they "morph" over time is much more valuable for predictive analytics, pro-active perimeter defense, and attacker attribution.. The same principles also apply to the malware payloads of course, but these can also be constantly morphing.

This type of intelligence sharing and analysis is how one develops highly effective methods of detecting and stopping new campaigns (and attack packages containing new 0Days).

Patrick Maroney
President
Integrated Networking Technologies, Inc.
Desk: (856)983-0001
Cell: (609)841-5104
Email: pmaroney@specere.org

_____________________________

cti-cybox message