OSINT is used in many different areas such as:

• Cyber Threat Intelligence
• Human Intelligence
• Political Intelligence
• Journalist Intelligence
• And others.

OSINT allows to collect any type of data available online and analyze it. The OSINT cycle is:

• Data collection
• Data Analysis
• Report (Documentation and Recommendations)

The OSINT Report depends on which area you are using OSINT. For example in Cyber Threat Intelligence (Why do we need a Cyber Threat Intelligence? – osintafrica), OSINT report can be writing following one of the models CYBER KILL CHAIN or The Diamond Model of Intrusion Analysis, more details about the models can be found here Three attacks frameworks that Cyber Security members should know osintafrica. 

OSINT framework tools are available and easy to find online.

Some of them are:

OSINT Framework

Tools – Start.me

My OSINT Training’s Tools

Advantages of using OSINT:

OSINT has many advantages such as many applications are free and accessible online, data available anywhere but the most important for us, are the following:

• Detect Threats
• Vulnerabilities
• Information lookup
• Data breached identification

Anything that has advantages, has inconveniences as well.

OSINT does have some.

OSINT Inconveniences:

Data can be query by anyone online

PII data accessible online

Vulnerability and threats are identifiable online

Data breached data are accessible on different platform (Dark Web, Hacking forum , OSINT tools and others ..).

OSINT tools can be vectors of attack.

The privacy concerning OSINT , the privacy concerns is quite similar to GDPR regulation requirements, such as collecting only information related to your investigation, having authorization to collect the data (PII or IP) and others.

OSINT is very useful, like said before, the tools are available for anyone to use. You can start using it by looking up some information related to your self. Do not forget about Privacy related to OSINT.

Bangaly Koita

Bangaly Koita is a SOC Analyst and  Cyber Security researcher . As a passionate in cyber security,  he spends most of the time  writing articles and making videos online to share his knowledge and experience to the vast community of IT but in general Cyber Security. Feel free to contact me in case.

osintafrica.net

The post What is OSINT ? first appeared on osintafrica.

Almost every day, you may hear from the news that a company was hacked and the data was leaked.

Most of the attacks happened in passive mode, which means that the companies are not aware of the attack. One of the most efficient ways to detect and respond to any Cyber Threats is to implement some detection and responsive measures.

The three frameworks that are going to be described below, will help you to detect and respond to any threat against your organization.

1. Cyber Kill Chain

The following framework helps the organization to identify the steps used by the attackers to perform an attack.

The framework was developed by Lockheed Martin, the framework is part of the Intelligence Driven Defense model for identification and prevention of cyber intrusions activity.

Cyber Kill Chain® | Lockheed Martin

The framework is divided in 7 steps:

• Reconnaissance: Finding any weakness that can be used to target the organization (Vulnerabilities, looking for details about the target over the network or gathering information about the target)
• Weaponization: After gathering information about the target and finding a weakness, the threat actor tries to leverage it by create a malicious file or programs that will be sent to the target.
• Delivery: Sending the malicious file or program to the target (phishing, drive by download)
• Exploitation: At this stage the threat actor, exploits the vulnerability.
• Installation: The threat actor tris to install a malicious software in order to gain high level privilege.
• Command & Control: Establishing a communication with the target’s system
• Actions on objectives: The threat actor meets his objective (data exfiltration) by exfiltrating

2. MITRE ATT&CK

MITRE ATT&CK is the knowledge base that help different actors to find out the tactics and techniques used by the adversaries to compromise a system.  The framework can be used by anyone without any charge. The framework contains information about mitigation steps to detect any anomaly and protect the infrastructure and any system that might be infected (Enterprise, Mobile, ICT).

MITRE ATT&CK

MITRE ATT&CK is divided in 14 phases to find the tactics and techniques used by the threat actor.

• Reconnaissance
• Resource Development
• Initial Access
• Execution
• Persistence
• Privilege Escalation
• Defense Evasion
• Credential Access
• Discovery
• Lateral Movement
• Collection
• Command and Control
• Exfiltration
• Impact

3. The Diamond Model of Intrusion Analysis

The model consists of 4 models that help you to identify how the intrusion can occur in the infrastructure.

The model helps to find the “who,” “what,” “when,” “where,” “why,” and “how.” Of the attacks in order to detect and mitigate the threat before.

The models:

• Adversary: The attacker or threat actor behind the attack.
• Capabilities: Are the set of skills and tools in the possession of the threat actor
• Victim: The infrastructure, system, individuals targeted by the threat actor
• Infrastructure: Are the software and hardware used by the threat actor to target the victim.
• Social-political – The reason of the attack (financial, espionage, hacktivism)
• Technology – How the threat actor can operate and what technologies the adversary used to operate and communicate.

 In conclusion, the three frameworks described here are very useful to detect and respond to different threat. Without referring to one of the frameworks, it will be very difficult almost not possible to mitigate the threat within your environment. Using them will be a step forward to being resilient against any attack.

Bangaly Koita

Bangaly Koita is a SOC Analyst and  Cyber Security researcher . As a passionate in cyber security,  he spends most of the time  writing articles and making videos online to share his knowledge and experience to the vast community of IT but in general Cyber Security. Feel free to contact me in case.

osintafrica.net

The post Three attacks frameworks that Cyber Security members should know first appeared on osintafrica.