12

This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too.

Rich posted these follow-up tweets:

And by APT I mean real APT.... China specific stuff.
Netwitness/Mandiant/HBGary type stuff.
Really specialize in this. Most of what I've seen is very custom.

Improve this question
6
  • 1
    Original twitter post is: twitter.com/#!/rmogull/status/22019761063854082
    – Steve
    Commented Jan 3, 2011 at 22:06
  • 2
    Perhaps amending "dealing with APT" to "dealing with the possibility of APT" would qualify more answers--it's my understanding that most security professionals who are actually dealing with APT have some very strong NDEs about it.
    – user502
    Commented Jan 4, 2011 at 15:19
  • The APT I know is Automatic Programmed Tool - What does this acronym stand for?
    – Dave
    Commented Jan 4, 2011 at 17:08
  • I'm guessing, like user502 there, that people really doing this work can't talk about it, due to NDAs or something stronger. DAve, he's talking about the Advanced Persistent Threat (en.wikipedia.org/wiki/Advanced_Persistent_Threat).
    – Bill Weiss
    Commented Jan 4, 2011 at 23:04
  • 1
    I know the bits I have done in the past on this, but am interested in anything that can be disclosed, under an anonymous user ID if need be. Popped a wee bounty up to see if it will spur anyone on.
    – Rory Alsop ♦
    Commented Jan 6, 2011 at 0:13

3 Answers 3

Reset to default
7
+50

Due to the sensitive nature of APT and that it is closely aligned to espionage, the only real way to get a suitable feed will be through Government or National Law Enforcement agencies.

The difficulty will be in establishing a level of trust to enable the sharing of information.

For organisations within the USA, the advice is to contact your local FBI field office and arrange for a threat briefing on the subject.

For organisations within the UK, then making contact with CPNI (Centre for the Protection of National Infrastructure) would be the best option. CPNI hold a number of industry specific 'Information Exchange' forums that may be of help. However it is worth noting that CPNI has a focus on the critical national infrastructure for the UK and if your organisation falls outside of this may impact on access to that.

Improve this answer
1
  • France: check with ANSSI. Germany: check with BSI.
    – Phil L.
    Commented Jul 18, 2019 at 10:37
3

I don't know whether they have specific SIEM/IDS feeds, but a good intelligence source historically has been iDefense (now part of Verisign - http://labs.idefense.com/).

Historically (prior to the security research they're more well known for now) iDefense were a commercial intelligence organisation, and spent a lot of time tracking organised crime and malware groups on behalf of their clients.

Improve this answer
1

Post HBGary getting owned, it appears that endgames.us offers these services.

Personally, I would go with combining DShield with SHODAN data and start building your own.t

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .