Intel on a Shoestring: Building a Great Program, Even on a 3-figure Budget
summary
Shows how to run a usable threat‑intel program on a three‑figure budget by focusing on requirements, 12 starter PIRs and an end‑to‑end cycle tracked with Harvey Balls. Uses free or cheap tools: an RSS reader + inbox + feeder ($6/mo) for feeds, Have I Been Pwned and Pastebin alerts for credentials, zone files + AstroGrep for lookalike domains, CertStream/Censys for TLS sightings, and a dnstwist web UI for subdomain enumeration. Claims a workable stack under $300/mo or free if time is spent.
AI-written summary · about
chapters (18)
- 0:00RSAConference 2023
- 1:08Disclaimer
- 2:29(Almost) everything you know about CTI is wrong...
- 9:19Where to Start
- 12:18Compromised Credentials
- 14:35Curated Security News
- 16:39Lookalike Domains (Registration)
- 20:20PIR 3: Lookalike Domains (Live)
- 21:35Fraud Sites & Phishing
- 23:43Darkweb Brand & Keyword searches
- 25:47Vuln Intel
- 28:41EASM & Vuln Checks
- 31:09Social Media Impersonation & Fraud
- 33:26Actor Profiles & TTPS
- 35:59Cloud Storage Exposure & Misconfigs
- 37:36Subdomain Enumeration
- 39:04Machine Readable Atomic Indicators
- 41:17Apply It! (What to do next, in order)
related talks
33mSecurity on a Shoestring: A Low-Budget Security Revival Tour (Jared Casner)
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
50mCybersecurity for “Have Nots”
29mDoing More with Less: DevSecOps on a limited budget
30mEffective security on a tight budget
42mBuilding an AppSec Program with a Budget of $0: Beyond the OWASP Top 10
31mConquer the Enterprise from Inside
37mSecurityPI: IronClad your Raspberry PI