SAINTCON 2023 - Chandler McClellan - Unleashing Pandora's Code

Ai

Uncover the secrets to effective cyber threat intelligence with Chandler McClellan, as he discusses the importance of human expertise, generative AI, and context in identifying and responding to cybersecurity threats.

Key takeaways
  • Cyber threat intelligence is crucial, but resource constraints and explainability challenges hinder its adoption.
  • Generative AI can help in threat detection and response, but its limitations need to be addressed.
  • The missing element in cyber threat intelligence is humans, who are essential for context and interpretation.
  • Cyber Threat Intelligence (CTI) work is important, but data poisoning and hallucinations need to be considered.
  • ChatGPT and other generative models can be used for cyber threat intelligence, but their limitations and biases need to be understood.
  • Cyber threat intelligence should focus on providing a threat-informed defense for customers, and humans are essential for this process.
  • TTP clustering and campaign prediction can help in threat intelligence, but need to be integrated with human expertise.
  • Cyber threat intelligence is not just about identifying threats, but also about understanding the motivations and goals of threat actors.
  • Humans are essential for bridging the gap between efficient models and actionable intelligence.
  • Cyber threat intelligence should prioritize clarity and simplicity, making it easier for customers to understand the threats they face.
  • CTI work should be focused on providing a threat-informed defense, and humans are essential for this process.