A Single Partner for Everything You Need Optiv works with more than 450 world-class security technology partners. By putting you at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can.
We Are Optiv Greatness is every team working toward a common goal. Winning in spite of cyber threats and overcoming challenges in spite of them. It’s building for a future that only you can create or simply coming home in time for dinner. However you define greatness, Optiv is in your corner. We manage cyber risk so you can secure your full potential.
Leveraging Open-Source Intelligence (OSINT) Against the Cyber Kill Chain Breadcrumb Home Insights Blog Leveraging Open-Source Intelligence (OSINT) Against the Cyber Kill Chain July 07, 2023 When it comes to cybersecurity threat exposure, preparedness is vital in limiting damage to your systems. Thinking like your attacker and how they might follow through with an attack reveals a great deal of insight into your preparedness. Given the incredible growth of the threat landscape, it bodes well for your organization to draw out a complete portrait of its cybersecurity posture. Organizations today pay attention to their internal environment and employ numerous tools and assessments to fortify their cybersecurity posture. While the tools reveal security vulnerabilities and the assessments measure the effectiveness of existing security measures, organizations assuming these alone are sufficient ultimately fail to consider the bigger picture. They are blindsided by the critical business information that is already publicly accessible. Therefore, mimicking the actions of a threat actor helps your organization to enhance its cybersecurity posture to tackle the latest threats. It provides your security professionals an external outlook of the organization’s vulnerabilities. This is where incorporating OSINT analysis becomes pivotal. Open-source intelligence or OSINT is a powerful tool that enables organizations to take a comprehensive look at their online footprint. It is an intelligence-gathering exercise that collects online and publicly available information to infer valuable insights about an organization, such as the organization’s capabilities and information about its infrastructure (such as open ports, vulnerable software, leaked confidential data, etc.). Armed with this information, organizations can devise effective countermeasures for potential cyber incidents. With the scale and the pace of growth of the global threat landscape, it is prudent for organizations to incorporate OSINT in their defensive capabilities. By utilizing OSINT, the publicly accessible information itself becomes a vital ally in securing your organization. Mapping OSINT against the cyber kill chain helps organizations trace the steps of a malicious actor and identify opportunities to enhance their arsenal against these cyber threats. The cyber kill chain is a framework developed by Lockheed Martin to describe the modus operandi of a cyberattack. In seven steps, the cyber kill chain expounds the phases involved in identifying, targeting and engaging a victim system. Mapping OSINT techniques with the kill chain presents organizations with a means to anticipate cyberattacks and be prepared. OSINT provides insights into potential attack surfaces through each step of the kill chain and enables security professionals to deploy relevant security controls to mitigate them. Here is a snapshot of how OSINT connects with the cyber kill chain: PHASES OF THE CYBER KILL CHAIN OSINT TECHNIQUE WEAPONIZATION • Identify publicly known system information and vulnerabilities through search engines and threat intelligence platforms• Leverage vulnerability databases to identify internal vulnerabilities DELIVERY EXPLOITATION • Leverage OSINT tools to perform malware analysis, identify malicious behavior and determine the extent of the infection• Stay updated on exploit kits to proactively identify and understand the latest vulnerabilities and attack vectors INSTALLATION COMMAND AND CONTROL • Perform domain analysis to identify command and control (C2) servers utilized by cybercriminals, monitor and analyze network traffic to uncover patterns and indicators of malicious activity• Conduct traffic analysis to decode SSL/TLS certificates to examine the cryptographic protocols and algorithms used for secure communication• Leverage threat intelligence platforms to gather, aggregate and analyze relevant data and information about emerging threats, malicious actors and potential vulnerabilities ACTION ON OBJECTIVES • Monitor social media for references to the organization to stay informed about public sentiment and identify potential brand reputation risks• Analyze metadata of leaked documents to extract valuable information such as authorship, creation dates, revision history, geolocation data and other embedded details• Monitor paste sites for sensitive data to proactively detect any instances of unauthorized data disclosure• Monitor dark web platforms to proactively identify and monitor illegal activities Just as attackers rely on OSINT to strategize and carry out their cyberattacks, OSINT can be a potent countermeasure for cybersecurity professionals against the same cyber threats. Our article – Disrupting the Cyber Kill Chain Using Open-Source Intelligence (OSINT) – showcases how security professionals can leverage OSINT to protect their organizations across the various phases of the cyber kill chain. The unprecedented scale and growth of the threat landscape make it mission-critical for organizations to deploy mechanisms that prevent potential mishaps. If you have questions about how you can employ OSINT to your advantage or if you seek to craft a resilient cyber strategy, click here to learn more about what we do at Optiv, or drop us a line. By: Rohitha Chowdary MANAGER, STRATEGY & RISK MANAGEMENT | OPTIV Rohitha is an experienced cybersecurity leader who excels in leading and delivering diverse cybersecurity projects. Specializing in establishing enterprise-wide capabilities in security management, governance, and compliance, she has earned a reputation for excellence in the field. Her expertise and guidance enable clients to build robust and adaptable cybersecurity programs, ensuring the highest level of protection for their organizations. Share: Optiv OSINT cyber kill chain Optiv Security: Secure greatness.® Optiv is the cyber advisory and solutions leader, delivering strategic and technical expertise to nearly 6,000 companies across every major industry. We partner with organizations to advise, deploy and operate complete cybersecurity programs from strategy and managed security services to risk, integration and technology solutions. With clients at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can. At Optiv, we manage cyber risk so you can secure your full potential. For more information, visit www.optiv.com.
Optiv Security: Secure greatness.® Optiv is the cyber advisory and solutions leader, delivering strategic and technical expertise to nearly 6,000 companies across every major industry. We partner with organizations to advise, deploy and operate complete cybersecurity programs from strategy and managed security services to risk, integration and technology solutions. With clients at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can. At Optiv, we manage cyber risk so you can secure your full potential. For more information, visit www.optiv.com.