From time to time when researching product ideas and hypotheses, our team develops prototypes. We have an opinion that some of them could be useful to the cybersecurity community. Today we want to share a model for ranking indicators of compromise that we implemented based on the study “Scoring model for IoCs by combining open intelligence feeds to reduce false positives” by the University of Amsterdam. This model solves one of the key tasks of threat intelligence: ranking indicators of compromise according to a number of parameters in order to distinguish among them the most dangerous and narrow the focus of the search for threats.
The model operates with sufficiently clear parameters (coefficients), which are used in the calculation:
In addition to these parameters, there is an additional coefficient to take into account the inclusion of IoCs in lists of known non-malicious resources, a decay coefficient to adjust the rate of rating obsolescence and coefficient weights, with which you can adapt the model to your needs.
Defensys is proud to announce that current version of the SGRC now supports Shariah Governance Framework for Local Banks Operating in Saudi Arabia.
This framework is ready to be used in compliance procedures by all the organisations operating under the requirements regulated by SAMA along with the SAMA frameworks themselves.
“We rapidly responded on such a demand from mostly banks in the KSA where we currently doing projects with our partners. Now any institution that operates in the Kingdom can do all the audits using out-of-the box frameworks available right after the installation of our SGRC solution which is a part of the whole cyber security ecosystem by Defensys. Also there is an option to add local and internal frameworks, standards and check-lists fetching all the requirements into the one list to save time of our customers when assessing similar requirements from different standards”
The Defensys SGRC solution helps enterprise companies of different scales to control the state of cybersecurity and effectively evolve cybersecurity based not only on compliance procedures but also on automatic risk assessments and the ability of the system to merge all the needed inventory data from different sources to create a master assets source for the whole organisation.
This is CERT, which main task is to collect information about incidents from its subordinates , as well as inform them about the main threats, attacks, vulnerabilities etc.
Before taking a look at the SOAR class systems almost all the procedures of interacting with different representatives of the regulated companies were manual. CERT communicated
with everyone via mailbox. For manual enrichment of IoCs delivered from subordinates, CERT analysts used various services, for example, WHOIS.
Also there was a demand from the regulated companies to have an electronic service to operate with this CERT with the possibility to automatically register incidents and IoCs.
The customer wanted to estimate comprehensively different types of building automation for their needs covered above:
As a result a part of Defensys’s ecosystem: SOAR + TIP was chosen among other respectful vendors for building this selfservice cybersecurity portal.
The following number of important issues was resolved after the implementation of Defensys SOAR+TIP: