loader from loading.io

The DISARM Framework Helps Bring Focus to the Disinformation Problem with Executive Director of the DISARM Foundation Jon Brewer

the CYBER5

Release Date: 07/26/2022

Insider Threats and Social Engineering Tactics by Counterintelligence Institute’s Peter Warmka show art Insider Threats and Social Engineering Tactics by Counterintelligence Institute’s Peter Warmka

the CYBER5

In Episode 90 of TheCyber5, we are joined by , founder of the Counterintelligence Institute. Warmka is a retired senior intelligence officer with the U.S. Central Intelligence Agency (CIA) where he specialized in clandestine HUMINT (human intelligence) collection. With 20+ years of breaching security overseas for a living, Warmka now teaches individuals and businesses about the strategy and tactics of “human hacking”.  Warmka highlights how insiders are targeted, the methods used by nationstates for committing crimes, and what organizations need to help focus their security training...

info_outline The Top Nisos Investigations Of the Last Seven Years with Nisos Research Principal Vincas Ciziunas show art The Top Nisos Investigations Of the Last Seven Years with Nisos Research Principal Vincas Ciziunas

the CYBER5

In Episode 89 of TheCyber5, we are joined by Nisos Research Principal,  It was 7 years ago, at a restaurant in Ashburn, Virginia, when Nisos’ co-founders Justin Zeefe and Landon Winkelvoss met Vincas. At the time, Vincas was working as a contractor for the US government but was considering a pivot into the private sector.  It was Vincas’ impressive intellect, strategic thinking, and technical capabilities that made him the ideal intelligence operator on whom to depend for the launch of Nisos. Over the course of several years, Vincas’ experience, as a developer, open threat...

info_outline The Vital Role of Customer Success in Intel Programs with Senior Director of Nisos Brandon Kappus show art The Vital Role of Customer Success in Intel Programs with Senior Director of Nisos Brandon Kappus

the CYBER5

In Episode 88 of TheCyber5, we are joined by Nisos Senior Director for Customer Success, .   Here are five topics we discuss in this episode:   Intelligence Playbooks Start with Education to the Customer  Playbooks should include three major steps. The first step is education on how intelligence is going to be consumed and not be nonstop noise. Discussions between customers and vendors should start around requirements that customers are trying to address with business stakeholders.    Understanding Commercially and Publicly Available Data to Avoid Noise The next...

info_outline Identifying When Attribution of Threat Actors Matters and How to Track the Outcomes with Senior Information Security Leader Charles Garzoni show art Identifying When Attribution of Threat Actors Matters and How to Track the Outcomes with Senior Information Security Leader Charles Garzoni

the CYBER5

In Episode 87 of TheCyber5, we are joined by senior information security leader . Here are five topics we discuss in this episode: Defining When Attribution is Relevant and Necessary  Many corporations are not overly concerned with attribution against cyber adversaries, they just want to get back to business operations. However, if someone robbed your house, you would want to know if it was a random drive-by, or if it was your neighbor because that will inform your defenses much more appropriately.  Defending Against Nation States Versus Crime Groups The ability to attribute...

info_outline Properly Defining a Threat Management Department within Enterprise with Senior Manager of Nvidia Chris Cottrell show art Properly Defining a Threat Management Department within Enterprise with Senior Manager of Nvidia Chris Cottrell

the CYBER5

In Episode 86 of TheCyber5, we are joined by Senior Manager of Threat Management for Nvidia .   Here are six topics we discuss in this episode:   What is a threat management department within enterprise security? Threat management departments are usually formed when security teams become mature and have table stakes functions within threat intelligence, red team, penetration testing, and threat hunting. These functions are usually formed after compliance, risk, governance, vulnerability management, and security operations center (SOC) are operational. Unfortunately, threat...

info_outline Operational Resiliency Framework Pertaining to Supply Chains by Foundation for Defense of Democracies George Shea show art Operational Resiliency Framework Pertaining to Supply Chains by Foundation for Defense of Democracies George Shea

the CYBER5

In Episode 85 of TheCyber5, we are joined by Chief Technologist of Transformative Cyber Innovation Lab for the Foundation for Defense of Democracies (FDD) Here are four topics we discuss in this episode: What is the Operational Resiliency Framework (ORF)?  The Operational Resiliency Framework (ORF) is a framework that is intended to be used by executives to ensure business continuity processes when their suppliers are knocked offline during natural disasters and cyber attacks.  Defining Minimum Viable Services Step one, and the most important step, is defining a minimum level of...

info_outline Integrating Attack Simulation with Intelligence to Provide Actionable Outcomes with CrossCountry Consulting show art Integrating Attack Simulation with Intelligence to Provide Actionable Outcomes with CrossCountry Consulting

the CYBER5

In Episode 84 of TheCyber5, we are joined by members of the CrossCountry Consulting team:  , Offensive R&D Lead, , Associate Director, and , Director, Cyber and Privacy.  Here are five topics we discuss in this episode: Adversary Emulation vs. Simulation and Use of Threat Intelligence Replaying attacks from adversaries is considered . The pros of emulation are you can react and defend against threat intelligence and the actual techniques during a penetration test. The cons are that many times these are yesterday’s threats. Simulation is the art of coming up with new attack...

info_outline Data Governance and Threat Intelligence Converge with Egnyte’s Chief Governance Officer Jeff Sizemore show art Data Governance and Threat Intelligence Converge with Egnyte’s Chief Governance Officer Jeff Sizemore

the CYBER5

Topic: Title: Data Governance and Threat Intelligence Converge In Episode 83 of TheCyber5, we are joined by our guest, Egnyte’s Chief Governance Officer, Jeff Sizemore. We discuss the Cybersecurity Maturity Model Certification (CMMC) and the impact on Department of Defense (DOD) contractors to mature their cybersecurity hygiene in order to compete for US government contracts. CMMC was based on NIST Standards 800-71.  Here are 4 topics we discuss in this episode: Why Does CMMC Matter? In the near future, contracts are going to be rated L1-3 and if contractors are not certified up to a...

info_outline Driving Diversity in Cyber Security and Intelligence with BGH Security CEO Tennisha Martin show art Driving Diversity in Cyber Security and Intelligence with BGH Security CEO Tennisha Martin

the CYBER5

In episode 82 of The Cyber5, we are joined by guest moderator and senior intelligence analyst for Nisos, Valerie G., and CEO of BGH Security, Tennisha Martin.   In this episode, we discuss the challenges and opportunities of promoting and enabling diversity and inclusion in cyber security.   Key Takeaways:   Showing Impact for Diversity and Inclusion (D&I) within Security   Beyond filling cyber security skills gaps, some metrics that show success in D&I include: Jobs Feeling more confident in interviews Recommending minorities for employment opportunities...

info_outline Leveraging Open Source Intelligence in Insider Threat Programs with Vaillance Group CEO, Shawnee Delaney show art Leveraging Open Source Intelligence in Insider Threat Programs with Vaillance Group CEO, Shawnee Delaney

the CYBER5

In episode 81 of The Cyber5, we are joined by the Head of Insider Threat at Uber and CEO of Vaillance Group, Shawnee Delaney.  In this episode, we provide an overview of different functions within an insider threat program. We also discuss the support open source intelligence provides to such programs and how to change company culture to care about insider threats. We also discuss the ROI metrics that are important to different stakeholders when implementing an insider threat program.  Three Takeaways: Departments and Functions within Insider Threat  Insider threat programs...

info_outline
 
More Episodes

In episode 80 of The Cyber5, we are joined by Executive Director of the DISARM Foundation, Jon Brewer. 

 

We discuss the mission of the DISARM Framework, which is a common framework for combating disinformation. Much like how the MITRE ATT&CK framework is used for combating cyber attacks, the DISARM framework is used to identify what Jon calls “cognitive security.” What that means is all the tactics, techniques, and procedures used in crafting disinformation attacks and influencing someone's mind. This includes the narratives, accounts, outlets, and technical signatures used to influence a large population. We chat about what success looks like for the foundation and specific audiences used to help the population in understanding how disinformation actors work. 

 

Three Takeaways:

1. What is the DISARM Framework? 

DISARM is the open-source, master framework for fighting disinformation through the coordination of effective action.  It was created by cognitive security expert SJ Terp. It is used to help communicators, from whichever discipline or sector, to gain a clear, shared understanding of disinformation incidents and to immediately identify the countermeasure options that are available to them. It is similar to the MITRE ATT&CK framework which provides a list of TTPs that malicious actors conduct cyber attacks. 

2. Similarities Between DISARM and MITRE ATT&CK Frameworks: Cognitive Security vs Cyber Security

Cognitive security and the DISARM framework is analogous to cyber security and the MITRE ATT&CK framework. Cognitive security are the TTPs that actors influence minds and cyber security are actors’ ability to steal data from networks. MITRE ATT&CK’s list covers the different TTPs of the cyber kill chain: 

  1. Reconnaissance
  2. Resource Development
  3. Initial Access 
  4. Execution
  5. Persistence 
  6. Privilege Escalation 
  7. Defense Evasion 
  8. Credential Access 
  9. Discovery 
  10. Lateral Movement 
  11. Collection 
  12. Command and Control 
  13. Exfiltration

DISARM’s list covers different TTPs of the disinformation chain: 

  1. Plan Strategy 
  2. Plan Objectives 
  3. Target Audience Analysis 
  4. Develop Narratives 
  5. Develop Content 
  6. Establish Social Assets 
  7. Establish Legitimacy 
  8. Microtarget 
  9. Select Channels and Affordances 
  10. Conduct Pump Priming 
  11. Deliver Content 
  12. Maximize Exposure 
  13. Drive Online Harms 
  14. Drive Offline Activity
  15. Persist in Information Environment 
  16. Assess Effectiveness

3. Disinformation: A Whole of Society Problem

While MITRE ATT&CK is mostly a business to business framework for enterprises to defend against cyber attacks. The DISARM framework is both a B2B framework for companies like technology and journalism, but also more broadly to consumers. This will take much more support from non-profits and public sector organizations like police and education systems.