Creating Threat Intelligence Signals in a “Zero Trust” Environment
summary
Argues that threat intel must shift from perimeter alerts to entity-focused, signal-based data→signals→actions that score user and device trust and apply lightweight mitigation. Uses Akamai access logs to show a 50% change in normalized density between Nov 26–27 and analyzes 200,000 phishing URLs to find 34% of URLs target enterprise credentials. Signals include device posture, connectivity, geolocation and browsing habits; actions demonstrated are MFA, scoped app access, download limits and deception challenges that reduce risk while preserving access.
AI-written summary · about
chapters (7)
- 0:00Intro
- 0:20Where were you on November 27, 2019?
- 4:26Target phishing attacks
- 8:5450 Shades of Trust
- 10:42Signal Based Approach for Trust Intelligence
- 13:25Example: Geographic Data as Trust Signal and Associated Actions
- 14:54Where I'll be November 27, 2020?
related talks
40mZero Trust and Privacy: Moving Security Closer to the Target
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
45mApplying Past Lessons for Intel-Driven Identity Threat Detection
40mZero Trust: Regaining Trust in a Remote Work World
34mKeynote: Multiplying Threat Intelligence
19mBeyond Perimeters: Implementing Zero Trust at Enterprise Scale
51mSecurity 101: A Beginner’s Guide to Cybersecurity and Zero Trust for Developers
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful