How NOT to be Your Adversary's Best Friend - Doing What Matters...

How NOT to be Your Adversary's Best Friend - Doing What Matters...

Speakers: Brian Hein; James Shank (Expel)

Conference: FIRST CTI Conference

YouTube: https://www.youtube.com/watch?v=_Pj151D9cN8

Overview

In their compelling FIRST CTI Conference talk, "How NOT to be Your Adversary's Best Friend - Doing What Matters...", Brian Hein and James Shank of Expel delivered a sharp critique of the current state of Cyber Threat Intelligence (CTI) and advocated for a radical shift in focus. The core message revolves around the industry's pervasive "action trap," where organizations confuse being busy with having a genuine impact. Rather than merely producing Indicators of Compromise (IOCs) or reports, the speakers argue that CTI programs must actively disrupt adversary operations and demonstrate measurable value in business terms.

Hein and Shank challenge the notion of "actionable intelligence" as a crutch, asserting that it often leads to performative security without tangible results. They contend that the true measure of CTI success lies in its ability to influence business decisions, change security outcomes, and impose significant costs on threat actors. This involves reframing CTI's purpose from internal activity tracking to external economic disruption, leveraging the collective strength of the security community through rapid, uninhibited information sharing.

The talk serves as a vital call to action for the CTI community, urging a departure from outdated metrics and restrictive sharing practices that inadvertently benefit adversaries. By focusing on the financial and operational impact on cybercriminals, and by fostering a culture of proactive, community-driven defense, organizations can move beyond "intelligence theater" and truly become an adversary's worst nightmare, rather than their best friend. This perspective is crucial for any organization grappling with the efficacy and measurable value of its CTI investments in an ever-evolving threat landscape.

Background

▶ Watch: Introduction and the 'Action Trap' (0:00)

The premise of Hein and Shank's talk stems from a fundamental problem plaguing the CTI industry: a focus on activity over outcome, leading to what they term the "action trap." For years, the industry has championed "actionable intelligence," often equating the production of high volumes of IOCs, threat reports, and closed tickets with success. However, the speakers argue this approach is akin to measuring the speed of a conveyor belt without verifying if anything of real value is being produced. This sentiment is encapsulated in the uncomfortable question posed to the audience: "If your company laid off your entire CTI staff and shut down the CTI program, would anybody notice?" The implication is that for many organizations, the answer might be a resounding 'no,' indicating a systemic failure to demonstrate tangible value.

This "intelligence theater" allows adversaries to continue their operations largely unimpeded, profiting from ongoing victimizations. The speakers highlight that current CTI metrics, such as the sheer number of IOCs processed or reports generated, are essentially vanity metrics. They fail to reflect actual impact on either the business's security posture or the adversary's operational capabilities. As a result, CTI programs often struggle to justify their investment to C-level executives, who speak the language of business risk and financial impact, not technical security jargon.

A significant barrier to effective CTI, according to Hein and Shank, is the industry's approach to information sharing. They critically examine the Traffic Light Protocol (TLP), suggesting it is frequently misused as a proxy for "coolness" or exclusivity, rather than a genuine mechanism for controlled dissemination. This often leads to over-classification and restricted sharing, where crucial defensive information is confined to small groups, or worse, held back due to overly complex legal processes or attribution debates. The speakers argue that such practices inadvertently empower adversaries by allowing them to operate with impunity, as defenders are slow to react collectively.

Furthermore, the structure of many information-sharing communities, such as ISACs, often creates artificial barriers to entry and sharing. Hein and Shank recount the struggle of being asked to withhold threat intelligence from non-members, despite the potential for widespread victimization. This fragmented and often competitive approach to threat intelligence sharing directly contradicts the collective strength defenders possess. The current environment, characterized by GRC bottlenecks, legal hesitancy, and a preoccupation with attribution over immediate defense, creates an operational advantage for adversaries who are unburdened by such constraints and can move at unprecedented speeds.

Key Findings

▶ Watch: Shift to Business Language and Impact (3:20)

The talk presents several pivotal findings that challenge conventional CTI wisdom and propose a new paradigm for effective cyber defense:

1. Impact Over Action: The central finding is that the CTI industry must abandon its focus on "actionable intelligence" and the mere production of outputs (IOCs, reports). Instead, the true measure of success should be measurable impact on organizational security outcomes and, crucially, on adversary operations. This means moving beyond being "busy" to genuinely changing the risk landscape.

1. CTI as a Business Enabler: For CTI to be effective, it must transcend technical jargon and speak the language of business. Key findings include the necessity for CTI to inform critical business decisions, such as M&A deals by assessing risk across sectors, or justifying expenses for ransomware recovery. Metrics should shift to quantifiable business impacts, such as the dollar amount of fraud loss stopped or the cost imposed on adversaries.

1. Adversaries Are Businesses: A fundamental insight is that threat actors operate as businesses, complete with profit and loss (P&L) statements, "customers," and even "CSAT/NPS scores" (customer satisfaction/net promoter scores). This reframing suggests that successful defense involves directly disrupting their economics and making their operations unprofitable or unsustainable.

1. Introducing "Revenue Per Attack" (RPA): Hein and Shank propose a new metric, Revenue Per Attack (RPA), as a critical way to evaluate the financial success of adversaries and, by extension, the effectiveness of defensive actions. The goal for defenders should be to drive this RPA down and simultaneously increase adversaries' operational costs.

1. The Community as a Weapon: The speakers emphasize that the collective community of defenders is the single greatest strength, surpassing adversaries in funding and numbers. However, this strength is severely underutilized due to over-classification (e.g., misusing TLP:RED/AMBER) and restrictive sharing practices. The finding is that open, rapid, and widespread information dissemination is paramount to burning down adversary techniques and infrastructure at scale.

1. De-prioritizing Attribution for Immediate Defense: While acknowledging the importance of attribution for law enforcement and legal processes (e.g., Brian Hein's work with Cyber Crime Atlas), the talk highlights that attribution debates often hinder rapid defensive action. For immediate protection and disruption, knowing who is behind an attack is less critical than knowing how to stop it and sharing that knowledge broadly.

1. Proactive Disruption and Speed: Effective CTI requires moving at or faster than the speed of adversaries. This means embracing proactive disruptions that force threat actors to retool, cycle through infrastructure, and incur greater costs, rather than merely reacting to their successful attacks. This includes challenging GRC and legal bottlenecks that impede rapid response.

Technical Deep Dive

▶ Watch: Unleashing Community Power, Critiquing TLP (10:20)

While "How NOT to be Your Adversary's Best Friend" is more conceptual and strategic than a traditional technical deep dive into code or specific exploits, it offers profound technical implications for how Cyber Threat Intelligence (CTI) programs should be designed, operated, and measured. The core technical shift advocated by Hein and Shank is a move from indicator-centric defense to an economic disruption model.

The traditional CTI approach often focuses on the rapid ingestion and dissemination of Indicators of Compromise (IOCs) such as IP addresses, domains, and file hashes. While these are useful for detection, the speakers argue that relying solely on such vanity metrics (e.g., number of IOCs processed, reports produced) fails to address the adversary's underlying business model. The technical deep dive here is not about a new tool, but a new architecture for CTI itself, one that is truly impact-driven.

At the heart of this new architecture is understanding the adversary's operations as a business. This implies that threat actors employ technical infrastructure, develop Tactics, Techniques, and Procedures (TTPs), and manage resources with a clear profit motive. Therefore, effective CTI must technically identify and disrupt these operational components to impose maximum cost. This includes:

• Infrastructure Cycling: Forcing adversaries to constantly acquire new command-and-control (C2) servers, domains, and hosting providers. This is a direct technical cost, both in terms of financial outlay and the human effort required to set up and maintain new infrastructure.
• Tooling Retooling: When defensive measures effectively block specific malware variants or exploit kits, adversaries must invest time and resources in developing new malware obfuscation techniques, evasion tactics, or entirely new toolsets. This technical debt is a significant operational burden.
• Supply Chain Disruption: Targeting the upstream components of an adversary's operation, such as initial access brokers, exploit developers, or cryptocurrency laundering services, can have a cascading technical impact on their entire enterprise.
• Exploiting Operational Inefficiencies: The speakers allude to the Emotet takedown, where "disorganized" community efforts created unpredictability, making it harder for the highly organized Emotet operators to manage their botnet infrastructure and delivery mechanisms. This suggests a technical strategy of creating chaos and uncertainty in the adversary's operational environment, forcing them into reactive technical changes.

The talk also critiques the technical implementation and usage of information sharing protocols, specifically Traffic Light Protocol (TLP). Hein and Shank argue that over-classification (e.g., TLP:RED or TLP:AMBER) often restricts the rapid, widespread dissemination of technically critical defensive information. They advocate for a default to TLP:CLEAR unless there is an "really, really, really good reason" for restriction. This has direct technical implications: faster sharing of attack signatures, detection rules (e.g., YARA rules), network indicators, and mitigation strategies means these can be implemented across a broader range of defensive systems (SIEMs, EDRs, firewalls) more quickly, thus reducing the window of opportunity for adversaries.

Finally, the concept of "weaponizing the community" has a strong technical underpinning. It implies a distributed, agile network of defenders who can rapidly develop and deploy countermeasures in response to emerging threats. This is not about a single hero, but a collective, almost mesh-networked defense where technical insights from one organization can quickly be adapted and deployed by many, leveraging tools like Signal or Threema for secure, informal, and rapid sharing of technical details that bypass traditional, slower sharing mechanisms. This collective technical action is designed to impose a systemic cost on adversaries that no single organization could achieve alone.

Demo / Proof of Concept

▶ Watch: Kill Vanity Metrics, Become Adversary Cost Center (17:00)

The talk "How NOT to be Your Adversary's Best Friend - Doing What Matters..." is a strategic and philosophical discussion about shifting the paradigm of Cyber Threat Intelligence. As such, it does not include a live technical demonstration or a traditional proof of concept (PoC) in the sense of showcasing a specific tool, exploit, or code. The speakers' objective is to inspire a change in mindset and operational approach within the CTI community, rather than to present a new technical solution.

However, the talk indirectly references successful "proofs of concept" through real-world examples of collective action. The most prominent example cited is the Emotet takedown. While not a direct "demo" by the speakers, they highlight lessons learned from this major disruption. They note that the "secret weapon" against Emotet was the "disorganized" yet collective efforts of various organizations, doing "what they could when they could." This unpredictability and widespread, albeit informal, collaboration had a "measurable impact" on the adversary's operations, even "screwing with the business." This serves as an anecdotal, yet powerful, proof of concept for their core argument: that a community-driven, rapid, and somewhat chaotic approach to defense can be highly effective in disrupting adversary economics, even without a single, coordinated, top-down effort.

The call to action to "build your network today" and "find five people that you have not talked to" to "exchange Signal, Threema, whatever you like" and "spread the word among them" functions as a proposed, ongoing, real-world proof of concept. The speakers are advocating for individuals and organizations to become the distributed, rapid-sharing network that serves as the ultimate "demo" of their philosophy. The effectiveness of this approach is measured not by a single technical demonstration, but by the collective reduction in adversary "Revenue Per Attack" and the increase in their operational costs.

Defensive Implications

▶ Watch: Critique of Restricted ISAC Information Sharing (24:40)

The implications for defenders arising from Hein and Shank's talk are profound and necessitate a significant re-evaluation of current CTI practices and priorities.

1. Shift CTI Metrics to Business Impact: Defenders must abandon vanity metrics like IOC counts and report volumes. Instead, CTI programs should measure their success in terms of business impact, such as the dollar amount of fraud prevented, the cost savings from averted incidents, or the influence on strategic business decisions (e.g., M&A risk assessments). This requires CTI teams to learn the language of business and articulate their value in financial and risk terms to C-level executives.

1. Prioritize Adversary Economic Disruption: The primary goal of CTI should be to make cybercrime unprofitable. Defenders should actively seek ways to increase the operational costs of adversaries (e.g., forcing them to retool, cycle infrastructure, develop new TTPs) and decrease their Revenue Per Attack (RPA). This proactive stance means CTI is not just about defending against attacks, but about actively disrupting the adversary's business model.

1. Embrace Rapid, Open Information Sharing: The prevailing culture of over-classification (e.g., misusing TLP) and restricted sharing must be challenged. Defenders should default to TLP:CLEAR for information that can aid widespread defense, unless there is a compelling, specific reason for restriction. This means pushing back against policies that limit sharing, such as those within some ISACs that restrict intelligence to members only, which inadvertently benefits adversaries.

1. Build and Leverage Informal Networks: Organizations and individuals should actively cultivate personal trust networks for rapid, informal sharing of threat intelligence. Using secure messaging platforms like Signal or Threema enables real-time exchange of critical defensive insights, bypassing slower, formal channels. This empowers a collective, agile response that can move at the speed of adversaries or faster.

1. Challenge GRC and Legal Bottlenecks: Defenders need to find ways to uphold legal and privacy requirements while simultaneously enabling rapid defensive action. Legal and GRC processes should not impede the swift dissemination of information necessary to protect potential victims. This might require advocating for streamlined internal processes or engaging legal teams to understand the urgency of cyber defense.

1. De-emphasize Attribution for Operational Defense: While attribution is vital for law enforcement and accountability, it should not be a prerequisite for immediate defensive action. Defenders should focus on sharing and implementing countermeasures without getting bogged down in lengthy debates about who is behind an attack, thereby maximizing the speed of response.

1. Empower All Staff for Community Engagement: Organizations should recognize the value of junior and mid-level staff building trust networks at conferences and through direct engagement. Travel restrictions or a lack of emphasis on in-person networking can hinder the formation of these crucial relationships, which are vital for collective defense.

By implementing these defensive implications, organizations can transform their CTI programs from reactive, cost-center activities into proactive, value-generating functions that significantly impede the success of cybercriminals.

Key Takeaways

• Focus on Impact, Not Just Action: CTI programs must shift from merely producing IOCs and reports to demonstrating measurable impact on business outcomes and adversary operations.
• Measure CTI Success in Business Terms: Translate CTI value into the language of business, focusing on metrics like dollar amounts of fraud prevented, costs imposed on adversaries, and influence on strategic decisions.
• Disrupt Adversary Economics: Treat adversaries as businesses and actively work to increase their operational costs (retooling, infrastructure cycling) and reduce their "Revenue Per Attack (RPA)."
• Embrace Open, Rapid Community Sharing: Challenge over-classification (e.g., TLP misuse) and restrictive sharing policies. Default to TLP:CLEAR to enable widespread, rapid dissemination of defensive intelligence.
• Build and Leverage Personal Networks: Cultivate informal, trusted communication channels (e.g., Signal, Threema) for real-time threat intelligence exchange to bypass slower, formal processes.
• Proactively Make Life Miserable for Adversaries: Move at or faster than adversary speed, aiming for proactive disruptions that force them to constantly adapt and incur costs, rather than just reacting to their successes.

About the Speaker(s)

Brian Hein and James Shank are seasoned professionals from Expel, bringing extensive experience to the cyber threat intelligence domain. Their combined tenure in the industry, as humorously noted by James ("We got old. Sorry. You have more white hair than I do, my friend."), underscores a deep understanding of the long-standing challenges and evolving landscape of cyber security.

Brian Hein is actively involved in efforts to combat cybercrime, contributing to initiatives like Cyber Crime Atlas, where his work focuses on attribution to support law enforcement in apprehending threat actors. This background provides him with a unique perspective on the balance between attribution for justice and rapid action for defense.

James Shank has a history of presenting at the FIRST Conference, with this talk being an evolution of previous discussions. His earlier work, including a talk in Montreal with Tom Millar, focused on the evolution of "trust groups" from their original concept to a focus on action. This current presentation builds upon that foundation, advocating for the next evolutionary step: a focus on impact. Together, their insights reflect a commitment to driving meaningful change in how the industry approaches threat intelligence and collective defense.