Operationalizing Threat Intelligence by Kyle Wilhoit & Joseph Opacki

Author:Kyle Wilhoit & Joseph Opacki
Language: eng
Format: epub
Publisher: Packt
Published: 2022-01-15T00:00:00+00:00

Hybrid collection

Hybrid collection utilizes a combination of the passive data collection capabilities of an organization and active collection disciplines in the sense that it requires human interaction from the collection team to perform the collection operation. Additionally, just like with passive collection, hybrid collection also involves collecting data from two different sourcing silos: internal to an organization and externally internet-facing locations as well.

Hybrid collection operations have some form of action that must be completed by the collection team, such as establishing a persona to actively engage in a dark market or forum, but usually does not mean actively engaging with actors in these locations. This level of effort distinguishes the collection type as hybrid as it will usually utilize the capabilities of passive collection but introduces actions that a collection team must specifically perform for the collection operation to be successful.

Hybrid collection operations do not usually involve any active or direct interaction with a threat actor or adversary, but rather intelligence gathering is performed through indirect contact, such as identifying that an adversary is actively compromising a honeypot or utilizing a scanning service such as Shodan (https://www.shodan.io/) looking for targeting opportunities on your organization's attack surface as examples. This requires more than just data collection; it also is necessary for the collection team to have the capability to identify this activity. The additional level of effort to collect with direct involvement by a collection team member is what differentiates passive from hybrid collection activities. Let's move on to discuss active collection.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.