Tracking Information Leakers
Information leakage often involves multiple actors and sources, typically requiring only simple "hacking" techniques (if any) rather than advanced technical abilities. This makes other aspects, such as the process of corroborating information, a critical component of the analysis.
In this presentation, we will explore the unique nature of information leakage and the challenges associated with tracking the actors behind it. Information leakage often involves multiple actors and sources, typically requiring only simple "hacking" techniques (if any) rather than advanced technical abilities. This makes other aspects, such as the process of corroborating information, a critical component of the analysis.
The session will introduce a specialized, extensible framework designed specifically to better analyze, describe, categorize, and track the Tactics, Techniques, and Procedures (TTPs) of these actors, filling a gap where standard threat intelligence frameworks like MITRE ATT&CK may be too focused on traditional cyber attacks.
Additionally, the talk will present a visualization method designed for higher-level audiences, such as managers and executives. This dashboard-style overview allows leadership to quickly gather essential intelligence and understand the current leakage landscape without needing to delve into granular technical data.
Csaba is an IT security practitioner with experience in penetration testing, malware analysis, computer forensics and incident response as well as CTI.
Csaba currently works at an international electronic entertainment provider as staff CTI analyst tracking threat actors. Previously worked in the automobile manufacturing industry in multiple roles (e.g.: SOC technical lead, IR, detection engineering and CTI) for multiple years and as IT security consultant before that.