Parallels with the Paradise Papers Investigation

I recently watched the Vice News Tonight hour long show on the Paradise Papers. If you have HBO I highly recommend you give your time to this episode. If you don't have HBO, maybe try one of those free trials and still give it a try and then binge watch Game of Thrones while you are at it.


You can also go read more about it on their website, but you won't get the insight into what it took for 400 journalist to hunt through the leaked documents.
The episode deep dives into the 9 month investigation of the journalists, the different angles they all decided to take on looking at the data, and effort it took to validate their findings.

Granted I think about threat hunting close to 12 hours a day, but I couldn't help but see the parallels between the ICIJ journalists methods/concerns and threat hunting methods/concerns.

Varying Investigations

I was fascinated as the show moved from The Guardian's investigation, to The New York Times' investigation and then to the Russian journalists investigation, who were putting their lives on the line. Each group had a different angle, a mission no more or less than important to the other journalist's and they were all happening simultaneously. Together the story became something else entirely different than what it would have been had the small German company that received the leak investigated solo.

I have been experimenting with this idea of "pack hunting" with my team. I detailed it a few blog posts ago, Pack Hunting. What I am hoping to achieve is exactly what the ICIJ achieved with the release of this story. The ability to hunt on a target from multiple angles resulting in a stronger, more comprehensive and persuasive story. One that just might actually bring about change in my organization. Seeing this only made me more resolute that this is a direction my team needs to go.

Findings Validation

They also show the journalists wrestle with leads, these tiny breadcrumbs that are important and impactful, but don't add up to a full picture. They discuss whether to share those findings and what else they need to make them concrete. Any hunter or incident responser is familiar with the struggle with the suspicious evidence that they can't quite validate, maybe the logs have rolled or there isn't any corroborating evidence to back up the suspicious finding.  I don't have a way to fix this, but I do know that it feels better when I can at least share in my post hunt brief findings what the team needed to have to get the evidence that would have answered the question of the suspicious finding.

Beyond this there was the use of similar tools like Linkurious that I am sure spawned this similarity in my mind. I couldn't help but wonder what threat hunting might have to offer other fields of studies.

Happy Hunting,
K



Comments

  1. DavidJuly 11, 2019 at 9:20 AM


    read this above post its very greatful for me thanks sharing this post ,great post.
    Types of Fishing

    ReplyDelete
  2. Janilite Pty LtdSeptember 1, 2020 at 7:21 AM

    We were sick of constantly being ripped off by the house, playing games that were impossible to win, so we created Dice Pool.

    bitcoin gambling
    crypto casino
    bitcoin casino no deposit bonus

    ReplyDelete
  3. HaryApril 3, 2021 at 1:55 AM

    Erotic Services in Vernon
    As always, getting to know one of the many beautiful Stratforward girl is really easy thanks to 5escorts. But we are always willing to help the women who decide to post their ads on our website, and that includes reminding a series of steps you should take, for both your safety and the safety of the escort VERNON you want to meet.

    ReplyDelete

Post a Comment

Popular posts from this blog

Threat Hunting Team Maturity Model

Image
After talking about scaling a hunt team with the concept of " Pack Hunting " in my last post, now I want to approach a topic that has been weighing on my mind as the year comes to a close. How do I build a kickass hunt program? And how would I know if I did? Admittedly, this is on my mind because next year my program will have been around long enough to be audited, which means I need to be able to measure my program in an audit-able way. I am not talking about the outcome of the program here, the hunting itself, but rather the processes and procedures that lead to the outcomes. The outcomes are currently measured using KPIs, but I haven't stress tested those enough to share yet. Developing a Threat Hunting & Research  Team Maturity Model Why a maturity model? As I looked into how to approach this question I came across the idea of using a maturity model. According to the Institute of Internal Auditors ( IIA ), a maturity model describes process components th...
Read more

Building Operational Threat Hunting Models

Image
A successful threat hunting program can't be a black box to the organization. The expense of such elite programs demand executives easily comprehend the value to the organization. Of course, as the program develops, executive comprehension alone will not suffice and metrics will be necessary as well, but that's a post for another day. 5 Threat Hunting Models  I've begun to develop 5 Threat Hunting Models that I hope can be used to frame discussions about a threat hunting program and its objectives. This isn't the first iteration and I highly doubt its the last iteration of the models. ADVERSARY MODEL The Adversary Model is for creating hunts that target a specific adversary, for example APT 28 .  Hunters will review an adversary profile, hopefully created by your cyber threat intelligence team, to learn of the attackers behaviors. Using this knowledge, hunters will create a hypothesis on finding those behaviors in our environments. Don't have your own CTI, do...
Read more

Applying Detection to the Attacker Lifecycle

Image
Thanks everyone for the encouraging comments on my first post and for taking the time to let me know it helped you out!  😁  Now for the next edition. Hunting is a form of detection. It's not monitoring, but it is detection. So let's take a quick look at creating a detection strategy and how it can include your hunt program. Use a Lifecycle for your Story Your detection strategy needs to create a story that your senior leadership can easily understand. The Mandiant Attacker Lifecycle always made more sense to me than the Lockheed Martin Cyber Kill Chain , so I am going to use that as the story for my strategy. Pick whichever lifecycle works for you. There is also the MITRE Attack Lifecycle . Mandiant Attacker Lifecycle For the sake of this post , I am going to say the lifecycle stage, Complete Mission, should be handled by DLP, backups (if mission objective is destructive), and encryption. Alerting You want to alert early in the lifecycle so you catch attacker...
Read more