Hi! My name is Chris Doman and I‘ve just joined AlienVault to work on the Open Threat Exchange (OTX) platform. As a way to say hello, I’ve put down some thoughts on why I was so keen to come work on OTX.
A lot has changed since I jumped into cyber security just 5 years ago. First there was the Target breach. Then Sony. OPM. Yahoo. The elections. Between those infamous landmark case studies IT administrators have been battling constant attacks against their own networks. Ransomware trashing network shares. Users clicking “Enable Macros”. Finance teams approving fraudulent wire transactions.
The security industry has had to continuously evolve to respond to ever-changing threats.
The Evolution of Threat Intelligence
Back in 2011 an employee of an incident response company was frustrated at the lack of threat intelligence sharing across the industry. So, they leaked the domain names used by the biggest group of attackers to Pastebin. It was a desperate attempt to prevent the mass of attacks the group was committing against both companies and governments. Two years, and hundreds of compromised organisations later, Mandiant released their landmark APT1 report. It was on the very same attackers, still using many of the same domain names.
We’ve come a long way since then. Now security vendors race each other to share new waves of attacks first and government institutions are mandated to do the same. But this has led to other problems. Keeping up with all the reports is in itself a full-time job. And some reports contain false positives that set off security devices like Christmas tree lights.
OTX
From my viewpoint, Alienvault OTX solves these problems by:
- Reducing the manpower and effort organisations require to pull IoC’s out of every report.
- The indicators are peer reviewed for problems and fixes are applied almost instantly.
- The information is easy in, easy out with a growing API and list of integrations.
- The power of the massive community that can perform vetted information sharing in a structured format at no-cost.
The key for any network like OTX is the community, and so far it’s going strong. Interested in vetted sharing of ransomware indicators? An OTX user has made a group for that. How about importing the indicators into your MISP instance? There's a group for that too.
AlienVault has a long history of building community solutions that are available to organisations of all sizes, not just those with the largest security budgets. Some of you may know me from a community project I’ve worked on in my spare-time called ThreatCrowd - another open threat intelligence platform. ThreatCrowd has become used by more people than I could have hoped. It’s been a fun experiment to keep a prototype running for thousands of simultaneous users from a single Linux box! But there are serious limitations to how much I can tack onto a prototype, in my spare time and limited by my own knowledge.
I’m looking forward to working with the top-notch team of AlienVault engineers to help enhance OTX and the overall community experience. I’ve only been at AlienVault a few days but I’ve seen there are some awesome enhancements planned to the interface, data-set and integrations. I won’t ruin the surprise!
If you’re a user of ThreatCrowd but haven’t seen OTX’s analysis functionality yet – do dive in and check it out. You’ll find me on the (unimaginatively named) account “chrisdoman” and I’ll still be around on the ThreatCrowd twitter handle.
If you’ve got any ideas on what we should be working on click “Feedback” on the left of OTX and let us know!
And if this sounds like something you'd like to work on too - Alienvault is hiring.
