The past is prologue: Intel needs to evolve to survive
Analysts investigate attack surfaces and defenses concerning The past is prologue: Intel needs to evolve to survive.
Summary
Overview: Vizzy, founder of the Vertex Project and co-author of the original APT1 report, presents at HITCON on intelligence analysis evolution and why the discipline must adapt to survive.
Key Topics: The APT1 report's origins at Mandiant in 2013; Chinese espionage targeting aerospace, pharmaceutical, and technology sectors; existential threats from stolen R&D; and the future of cyber threat intelligence analysis.
Technical Details: Vizzy recounts identifying Unit 61398's multi-year campaign exfiltrating terabytes weekly from English-speaking businesses, from aerospace engine schematics to pharmaceutical research. The report established attribution methodology now standard in CTI.
Takeaways: CTI must evolve beyond indicator sharing to strategic analysis of adversary intent and impact. The APT1 model of public attribution changed the industry, but analysts must continue adapting methodologies.
Related talks
Black Hat·6 min
Engineers explore architecture and security mechanisms for Past as Prologue: What Users Can Except with 2022 Cyber Threats.
Videos·46 min
Presenters detail vulnerability discovery and exploitation in Sneaking Past Device Guard by Philip Tsukerman (@philiptsukerman), Cybereason.
Black Hat·41 min
Alexander Tereshkin · Alexander Matrosov · Adam Zabrocki
Presenters detail vulnerability discovery and exploitation in Sleight of ARM: Demystifying Intel Houdini.