Information-sharing tools, taxonomies, and trust: Babel or better?
No ratings
Presented at SourceBoston 2014 by
There has been a fury of activity over the past year around defining information-sharing protocols. In true Darwinian fashion, as with most standards processes, there is a confusing array of rapidly-evolving, partially-overlapping formats. STIX, CybOX, TAXII, MAEC, OpenIOC, IODEF, VERIS, CIF - the alphabet soup just goes on and on. The purpose of this panel will be to shed light on the current format and tooling landscape, discuss real-world applications, and try to forecast where this space is headed in the coming 18-24 months. Trey Darley is a Senior Security Strategist with Splunk's Security Practice. A jack-of-all-trades, he has been leading Splunk's efforts to facilitate and utilize information-sharing methodologies. In his copious spare time he serves on the BruCON organizing committee and haunts EU policy-making circles around Brussels. Douglas Wilson is the manager of the Mandiant Threat Indicators team, a part of the Threat Intelligence business unit. Doug's team primarily works on developing and refining techniques for improving threat indicator quality and coverage, as well as working on innovative threat intelligence automation efforts. Doug is based out of Washington DC. He has over 14 years of experience in a variety of Information Security and Technology positions, including having previously focused in Incident Response and Multi-tiered Application Architecture. Doug is also the unofficial spokesperson for the open threat information sharing standard, OpenIOC (http://openioc.org). Doug has spoken on various Infosec topics at events including FIRST, GFIRST, DoD Cybercrime, NIST IT-SAC, Suits and Spooks, Shmoocon, and many other local events in the Washington DC Metropolitan area. John Wunder is a Lead Information Security Engineer at the MITRE Corporation, a research lab that acts as a technical advisor for the U.S. federal government. He is a lead member of the STIX project, an effort to develop a common language to enhance sharing and analysis of cybersecurity threat information in both industry and government. He has been in the software and security field for ten years and has a Master’s of Information Assurance from Northeastern University. Stephen K. Brannon is a Principal in the Verizon Cyber Intelligence Center (VCIC). He is a contributing author of the Verizon Data Breach Investigations Report that uses the VERIS framework to study security incidents and drive evidence-based risk management. In the new VCIC, Mr. Brannon focuses on threat intelligence gathering, analysis, and sharing using a variety of formats that are the subject of this panel. Before working at Verizon, he was a Cybercrime Analyst in the Cybercrime Lab of the Computer Crime and Intellectual Property Section (CCIPS), U.S. Department of Justice, in Washington, DC. He practiced digital forensics, online investigations, and conducted research in the field. Before working at the Department of Justice, Mr. Brannon worked at the FBI leading a team responsible for computer security incident response and vulnerability assessment. He has received degrees from Georgetown University and the University of Virginia as well as professional certifications.