Treadstone 71 Selected to Deliver at the RSA Conference 2018 San Francisco

Foundations for a Strong Intelligence Program
April 18, 9AM-11AM RSA Conference
This Lab will explore key aspects of building a strong and long-lasting cyberthreat intelligence program. We’ll review methods of threat intelligence platform selection and bake-off techniques as well as cover stakeholder analysis and priority intelligence requirements. Additionally, we’ll practice collection planning and mission management as well as how to establish effective reporting and dissemination capabilities.

Cyber CounterIntelligence – Deception, Distortion, Dishonesty
April 18, 1:45PM-2:30PM RSA Conference
Deception, distortion, dishonesty are core to social media postings. Our adversaries use these methods concocting stories that create illusions that are meant to leave us divided. The talk will cover methods of countering their messaging while applying these tactics to protect your own organization and brand. Moving from intelligence to counterintelligence is the natural next step in our evolution.

18/02/2018 0

Zapad Exercises – 2nd/3rd Order Effects

The recent Russian Zapad wargaming exercises included a plethora of electronic capabilities demonstration and potentially more. Russia is known to recently been involved in illegal immigration efforts in Sweden, Finland, and Norway along with hostile intent along its northern borders (Estonia, Latvia, Lithuania) including cell/communication tower tampering. Could the recent Zapad exercises be more than just wargaming?

Some What If thoughts on these non-linear actions:

– Testing capabilities, distance, strength, impacts

– Testing responses like a stone in pond

– 2nd and 3rd order effects were measured to determine the impact on targets, targets responses, etc.

– Russians had people in each target country assisting with target impacts

– Russians monitored target government communications from within each country

– Determine length of time for target government to respond and what methods were used and where to get communications back online (if at all) – the locations of the response represent capabilities unknown to Russia until such an exercise is performed

– Other possibles:

– A cover for illegal activities that occurred during the exercise – a feint, a ruse

– Testing a precursor to actual execution – that is why military exercises are performed

– What capabilities are being left in the exercise areas; what is not being removed after the exercise using the exercise as a ruse to place assets close to Western borders that were not there before

What do you think?

https://www.reuters.com/article/us-russia-nato/russia-may-have-tested-cyber-warfare-on-latvia-western-officials-say-idUSKBN1CA142

https://uawire.org/news/media-belarusian-and-russian-militaries-are-jamming-mobile-communications-along-border-with-poland

http://www.independent.co.uk/news/world/europe/norway-border-fence-russia-refugees-refugee-crisis-schengen-syria-war-a7208806.html

https://www.usnews.com/news/world/articles/2016-11-02/russias-ramping-up-for-war-where-nobodys-looking

http://www.aljazeera.com/programmes/peopleandpower/2017/09/estonia-bear-hunt-170914055839448.html

http://www.businessinsider.com/estonia-intelligence-report-intensifying-russia-spy-activity-in-europe-2017-4

09/10/2017 2

Drone Wars! Threats, Vulnerabilities and Hostile Use

References

Adamy, D. (2001) EW 101 A First Course in Electronic Warfare, Boston: Artech House.

Adamy, D. (2004) EW 102 A Second Course in Electronic Warfare, Boston: Artech House.

Adamy, D. (2009) EW 103 Tactical Battlefield Communications Electronic Warfare, Boston: Artech House.

Adamy, D. (2015) EW 104 EW against a New Generation of Threats, Boston: Artech House.

Anonymous, (2017) GPS/SBAS Signal Generator, GSS4100, Spirent Communications Data Sheet. Satellite AIS, Exact Earth, Ltd.

Anonymous, (9/8/2017) Innovation: Simulating GPS Signals, GPS World, http://gpsworld.com/simulating-gps-signals/

Anonymous, (8/22/2017) Nationwide Automatic Identification System, www.navgen.uscg.gov

Anonymous, (8/22/2017) Long Range Identification and Tracking (LRIT) Overview, www.navgen.uscg.gov

Anonymous, (8/22/2017) How AIS Works, www.navgen.uscg.gov

Anonymous, (2015) Satellite AIS, Exact Earth, Ltd.

Anonymous, (6/21/2015) Cyber Threats against the Aviation Industry, in SCADA on April8, 2014, INFOSEC Institute.

Anonymous, (2012) A Guide for Testers of GPS Devices and Systems, spectracom, Test & Measurement technical Note, TN15-101A – What You Want to know about GPS.

Anonymous, (5/14/2012) what is a GPS Simulator? Spectracom, Test & Measurement White Paper, WP08-101A.

Anonymous, (1/10/2014) GPS Signal Plan, Navipedia, http://www.navipedia.net/index.php/GPS_Signal_Plan

Anonymous, (4/2017) Counter-Unmanned Aircraft System Techniques, HQ, Department of the Army, ATP-3-01.81, https://fas.org/irp/doddir/army/atp3-01-81.pdf

Atayero, A.A, Luka, .K. & Alatishe, A.A (8/2011) Satellite Link Design: A Tutorial, International Journal of Electrical & Computer Sciences, IJECS-IJEND Vol: 11 No: 04.

Balduzzi, M., Wilhoit, K., & Pasta, A. (2014) A Security Evaluation of AIS, Trend Micro Forward-Looking Threat Research

Barker, B.C Capt., et.al. (2006) Overview of the GPS M-Code Signal, MITRE Report.

Bay-Yen, J. (2000) Chapter 5: GPS C/A Code Signal Structure, Fundamentals of Global Positioning System Receivers: A Software Approach, New York: John Wiley, http://read.pudn.com/downloads85/ebook/326017/Fundamentals%20of%20Global%20Positioning%20System%20Receivers/booktext05.pdf

Bhatti, J. & Humphreys, T. E. (2016) Hostile Control of Ships via False GPS Signals Demonstration and Detection, Navigation: Journal of the Institute of Navigation, Vol. 64, No.1, Spring 2017.

Buesne, G & DeSanto, D. (2017) GNSS Receivers and the Cyber-Threat: Lessons from the Information Security Community, Spirent Communications, Baltimore, MD

Buesne, G & Holbrow, M. (6/29/2017) GNSS Threats, Attacks and Simulations, Spirent: PNT Advisory Board, Baltimore, MD

Bussert, J.C. (10/2013) China Expands Influence through Electronics, Signal Magazine, https://www.afcea.org/content/china-expands-influence-through-electronics

Chachak, E. (retrieved 9/1/2017) U.S. Naval Mishaps – Human Error or Cyber Malfeasance? CyberDB.https://www.cyberdb.co/u-s-naval-mishaps-human-error-or-cyber-malfeasance/

Crosby, J. (12/16/2017) here’s What USNS Bowditch Does, Inverse Innovation, https://www.inverse.com/article/25346-usns-bowditch-underwater-drone-stolen-china

Demchak, C., Patton, K, T. & Tangredi, S.J. (8/25/2017) why are our Ships Crashing? Competence, Overload, and Cyber Considerations, Center for International Maritime Security. https://www.realcleardefense.com/articles/2017/08/25/why_are_our_ships_crashing_competence_overload_and_cyber_considerations_112152.html

Dupont, G. (2017) SIEM Fundamentals for your Threat Intelligence Program, Recorded Future, https://www.recordedfuture.com/security-operations-center-fundamentals/

Easton, R.D. & Frazier, E.F. (2013) GPS Declassified: From Smart Bombs to Smartphones, University of Nebraska Press.

FCC Wireless Telecommunications Bureau, Marine VHF Radio Channels, per 47 CFR 80.371© and 80.373(f)

Fessenden, F. & Watkins, D. (6/18/2017) the Path of the Container Ship that Struck a U.S. Destroyer, NYT. https://www.nytimes.com/interactive/2017/06/18/world/asia/path-ship-hit-uss-fitzgerald.html?mcubz=3

Gaertner, U (2013) UAV Swarm Tactics: An Agent-Based Simulation and Markov Process Analysis, Naval Postgraduate School Thesis.

Haider, Z. & Khalid, S. (8/2016) Survey on Effective GPS Spoofing Countermeasures, 6^th International Conference on Innovative Computing Technology (INTECH 2016), https://www.researchgate.net/publication/313543601_Survey_on_effective_GPS_spoofing_countermeasures

Heath, T. (5/7/2015) How to Hack a Military Drone Parts I & II, Technology-Hackers, www.cybersecurityintelligence.com/blog/

Hodge, H. (8/23/2017) why are Navy Ships colliding in the Pacific? Experts Weigh In, Military.com

Homeland Security (2017) Improving the Operation and Development of Global Positioning System (GPS) Equipment Used by Critical Infrastructure, NCIC/NCC Unclassified report.

Hurley, M. (9/2017) Beyond the Iron Triad: The Future of Airborne C2ISR, Arlington, VA: Mitchell Institute for Aerospace Studies.

Humphreys, T.E, e. al. (1/1/2009) assessing the Spoofing Threat: Development of a Portable Civilian GPS Spoofer, https://gps.mae.cornell.edu/humphreys_etal_iongnss2008.pdf, Cornell University

Humphreys, T.E, (7/18/2012) Statement on the Vulnerability of Civil Unmanned Aerial Vehicles and Other Systems to Civil GPS Spoofing, Submitted to the Subcommittee on Oversight., Investigations, and Management of the House Committee on Homeland Security.

Kao, Lee, Chang, and Ko. (2007) A Fuzzy Logic Method for Collision Avoidance in Vessel Traffic Service, Journal of Navigation, 60, 17-31.

John, E.N & Schrage, D.P (2017) System Integration and Operation of a Research Unmanned Aerial Vehicle, Atlanta GA: School of Aerospace Engineering, Georgia Institute of Technology.

LaGrone, S. (8/21/2017) Chain of Events Involving U.S Navy Warships in the Western Pacific Raise Readiness, Training Questions, USNI News

LaGrone, S. (1/31/2017) Cruiser USS Antietam Runs Aground in Tokyo Bay, Spills Oil, USNI News.

Mccaslin, I.B. (2017) Red Drones Over Disputed Seas: A Field Guide to Chinese UAVs/UCAVs Operating in the disputed East and South China Seas. Project 2049 Institute. http://project2049.net/documents/Red%20Drones%20Over%20Disputed%20Seas_PLA_Project2049.pdf

News Correspondent, (8/22/2017) USS McCain crash is 4^th Navy Accident in Pacific this Year, The Washington Post, AP.

News Correspondent, (8/31/2017) DDG 51 Arleigh Burke Class Destroyer, Military.com

News Correspondent, (8/21/2017) CNO Orders Operational Pause, Review After Latest Ship Collision, Military.com

News Correspondent, (8/21/2017) 10 Sailors Missing, 5 injured after Destroyer Collides with Tanker, Military.com

News Correspondent, (8/22/2017) Remains of Navy Sailors found on USS John S McCain, Military.com

News Correspondent, (8/17/2017) Navy Fires Commander, XO from USS Fitzgerald for Fatal Collision, Military.com

News Correspondent, (7/21/2017) Investigation Faults Navy in Fitzgerald Collision Report, Military.com

News Correspondent, (6/20/2017) Stories of Fitzgerald Sailors Killed in Destroyer – Container Ship Crash, Military.com

News Correspondent, (6/16/2017) US Navy Destroyer Collides with Japanese Merchant Ship, Military.com

News Correspondent, (5/09/2017) US Navy Ship Collides with South Korean Fishing Boat, Military.com

News Correspondent, (1/31/2017) Oil Spill in Tokyo Bay After Navy Cruiser Runs Aground, Military.com

Nichols, R.K (8/31/2017) Stand By for a whole slew of military short articles on the Navy Collisions (my students only), Private memo to COT799 & CMST 455.

Nichols, R.K. & Lekkas, P.L. (2002) Wireless Security: Threats, Models, Solutions, New York, McGraw Hill.

O’Donnell, W. (2017) Interview with Navy Captain. http://inmilitary.com/real-reason-us-navy-keeps-hitting-merchant-vessels/

Ranganathan, A, et.al, SPREE A Spoofing Resistant GPS Receiver, Department of Computer Science, ETH Zurich, Switzerland, Zurich Information Security and Privacy Center.

Richardson, J. Adm., (8/31/2017) No Evidence of Hacking in McCain and Fitzgerald Collisions, Military.com

Rudow, l. (2014) Where to Mount a Radome for best Performance, Boat US, http://www.boatus.com/magazine/2014/june/mounting-a-radome.asp

Schallhorn, K., (9/1/2017) US Military crashes, collisions in the Pacific, FoxNews. http://www.foxnews.com/us/2017/08/28/us-military-crashes-collisions-in-pacific.html

Schmidt, D.et.al., (5/2016) A Survey and Analysis of the GNSS Spoofing Threat and Countermeasures, ACM Computing Surveys, Vol 48, No 4, Article 64

Sickle, J.V. (8/25/2017) GEOG 862 GPS and GNSS for Geospatial Professionals, Lessons 1-10 complete, Penn State University, College of Earth and Mineral Sciences https://www.e-education.psu.edu/geog862/node/1407 [ Superb Course on the subject]

Sterling, J. 8/21/2017) A Spate of US Navy warship accidents in Asia since January, CNNNEWS. http://www.cnn.com/2017/08/21/politics/navy-ships-accidents/index.html

Tucker, P., e. al. (9/2017) Beyond GPS: Upgrading the Military’s Navigation-and-timing Backbone, Defense One, e-Book.

Volpe, J.A, (8/29/2001) Vulnerability Assessment of the Transportation Infrastructure Relying on the Global Positioning System, Final Report, Office of Assistant Secretary for Transportation Policy, U.S. Department of Transportation, John A Volpe Transportation Systems Center.

Warner, J.S. % Johnson, R.G. (2013) A Simple Demonstration That the Global Positioning System (GPS) is Vulnerable to Spoofing, Journal of Security Administration, https://pdfs.semanticscholar.org/8ddb/89f56dd3e2ae265047822bc47cfb06815d9a.pdf, LAUR-03-6163.

Warner, J.S. % Johnson, R.G. (2003) GPS Spoofing Countermeasures, Journal of Security Administration, LAUR-03-2384, Los Alamos, NM: Los Alamos National Laboratory

Weise, E. (8/23/2017) Could Hackers Be Behind The U.S. Navy Collisions? USATODAY.

Patents

Berry, R. & Cook, C. (2016) Detection of wireless data jamming and spoofing, US 9466881 B1

Blogs

Banggood Blog (9/14/2017) Whats the difference between RHCP and LHCP antennae? https://blog.banggood.com/rhcp-and-lhcp-whats-the-difference-29046.html

King Blog (9/14/2017) what is the difference between Azimuth and Elevation? https://kingconnect.com/what-is-the-difference-between-azimuth-and-elevation/

Mike Willis Blog (9/13/2017) Propagation. http://www.mike-willis.com/Tutorial/propagation.html

Law and Cyber Warfare Blog. Groll, E. (2017) Investigating if Destroyer Crash was Caused by a Cyber Attack, http://www.jlcw.org/u-s-navy-investigating-if-destroyer-crash-was-caused-by-cyberattack/

Wikipedia

Editor (8/31/2017) GPS Block IIIA, Wikipedia, https://en.wikipedia.org/wiki/GPS_Block_IIIA

Editor (9/14/2017) Circular polarization, Wikipedia, https://en.wikipedia.org/wiki/Circular_polarization

Editor (9/19/2017) Electromagnetic Spectrum, Wikipedia, https://en.wikipedia.org/wiki/Electromagnetic_spectrum

Editor (9/19/2017) Continuous-wave Radar, https://en.wikipedia.org/wiki/Continuous-wave_radar

07/10/2017 0

Dru’a al-Waaqiah lil-Bedoon – Syrian Sanctions Busting with Russian Help

Past report on Syrian Government collusion with Russia to bypass sanctions against Syria. This instance involves acquiring materials and machines to manufacture their own body armor in Latakia by way of the UAE where a Syrian soldier working with a female FSB agent centralize the acquisitions.

Visas, passports, military IDs, fake names, bills of lading and more for your reading and review.

The Treadstone 71 Report (pdf) – Treadstone 71 – drua-alwaaqiah-lilboodoon

Treadstone 71 acquired supporting files and documents (30MB zip) – drua-rawfiles-treadstone71

https://treadstone71llc.files.wordpress.com/2014/10/hatem-deeb-_-vk.pdf

https://treadstone71llc.files.wordpress.com/2014/10/zain-deeb-_-vk.pdf

https://cybershafarat.com/?p=524

http://www.treadstone71.com

16/09/2017 1

Treadstone 71 Announces Cyber Intelligence Capability Maturity Model

Treadstone 71 developed a maturity model to help organizations determine the maturity of their cyber intelligence initiatives against the cyber intelligence common body of knowledge (CICBOK). The model provides strategic and operational aspects of your cyber intelligence maturity, where it needs to go, and where you should concentrate your attention to create more value for your business. Nearly 8 years in the making, the Treadstone 71 Cyber Intelligence Maturity Model uses traditional tradecraft as delivered by Sherman Kent and Richards Heuer, intelligence community standards, analytic standards, and experiential knowledge derived from years of training, assessing, and building cyber intelligence programs.

The Treadstone 71 Cyber Intelligence Capability Maturity Model (T71-CICMM) is a methodology used to develop and refine an organization’s cyber intelligence program. Not only is the model educational and practical skills for learning and developing expertise, but also a roadmap for building a cyber intelligence program. More information is available here:

Treadstone 71 Cyber Intelligence Maturity Model

03/08/2017 0

Intelligence for the C-Suite and Stakeholders

This is a one-day course designed to educate corporate leadership and stakeholders in cyber and threat intelligence. There is a general awareness of the need to establish intelligence functions. Many organizations do not have a fundamental understanding of what intelligence is, where the function should reside, how it is different from business and competitive intelligence while understanding the overlaps and natural points of integration. This one day course targets corporate leadership delivering a clear and coherent training that equips stakeholders with the understanding and tools they need to assist in building a successful intelligence program.

Registration Information – Dates and Times TBD

Course High-Level Outline

Using Strategic Intelligence
Organization and Focus of the Class
Background on Strategic Intelligence and Analysis
Approaches and Processes
Strategic Plan development, acceptance, and dissemination
- Mission
- Vision
- Guiding Principles
- Roles and Responsibilities
- Threat Intelligence Perspective
- Business Intelligence Perspective
- Competitive Intelligence Perspective
- Intelligence Strategic Challenges
- Goals and Initiatives
- Next Steps
- Roadmap
Stakeholder checklist and stakeholder management groups with strategic and tactical activities definition for intelligence, description of needs and products. This will include:
The Future Use of Strategic Intelligence
Intelligence: Role, Definitions, and Concepts
Basic Concepts Concerning Intelligence
The Strategic Intelligence Process – Operations to Tactics
The Role of Strategic Intelligence and Its Impact on Stakeholders
- Operational, Technical, Tactical
Why Stakeholders and Executives Need Strategic Analysis:
Strategic Analysis Leading to Strategic Decisions
Implementing Intelligence Programs
- The Treadstone 71 Method (Experience with several program builds globally)
Challenges for Stakeholders to Accept Intelligence
Stakeholder Views: Impact on Intelligence
Intelligence as Catalyst for Stakeholders
Integrating Analytical Support and the Stakeholder Thought Process
Stakeholders and Self-Directed Strategic Processes, Procedures, Methods
The Role of Intelligence Management
Issues, Tactics, Techniques, Methods, and Principles
Managing Intelligence Projects
Providing Focused Leadership
- Leading the Team
- Understanding Issues and the Process
- Analysis Overview
- Collection Management
- Production Management
  - Evaluation
  - Analysis
  - Integration
  - Interpretation
- Types of Analysis
  - 14 Types of Analysis
- Analytic Writing
  - ICD 203, 206, 208
  - Organization, Evidence, Argument, Sources, Pitfalls
  - Use the Title
  - Who/What, Why Now, So What, Impact so far, Outlook, Implications
  - BLUF and AIMS
  - Supervisory Actions
  - Summary Paragraphs
  - Alternative Analysis
  - Clarity and Brevity
  - Peer review
  - Reports and Reporting
    - Feedback
- Pre-Mortem
- Post-Mortem
- Know your professor, get an A – Communicating Up
  - Relevance, Timeliness, Completeness, Accuracy, Usability
- Briefing Rules
Intelligence Analysts and Self-Management
- High-Level Tasks
Analyst Activities
- Rules for developing analysts – Alignment and as collectors
- The Role, Responsibilities, and Functions of the Analyst
- The Analyst’s Roles and Responsibilities – RACI(s)
- What the Analyst will face
- Job Descriptions
Conclusion
- The Executive / Stakeholder’s Roadmap

Corporate stakeholders risk investing large amounts of time and money with little positive effect their security, corporate strategies, and business direction. The C-Suite and Stakeholders participating in this course ensures their understanding of the discipline required to build a successful program. The course helps align information security, incident response, security operations, threat and cyber intelligence with the business.

http://www.planetreg.com/IntelC-Suite

12/03/2017 0

Training Report – Treadstone 71 Cyber Intelligence Tradecraft Professional Certification

“This past week, I had the absolute pleasure of attending the 5-day Treadstone 71 Cyber Intelligence Tradecraft Professional Certification course along with three of my colleagues. Mr. Jeff Bardin was the instructor and his knowledge and depth in this area is exceptionally impressive!

The training allows students to gain a better understanding of the cyber intelligence life cycle, the role and value of cyber intelligence relative to online targeting and collection, in modern organizations, businesses, and governments at the completion of this course. In addition, students understand: the methods of online anonymity, the fundamentals behind cyber intelligence collection and analysis, and how these current methods can be employed in our organizations to assist in online operational security and in defense against adversaries. The course was a combination of lecture, hands-on and student deliverables seen by many as an apprenticeship. We completed 4 case studies throughout the week in varying subjects such as Iranian hackers, high financial networks, Russian SCADA equipment, etc.

I would highly recommend this course to anyone looking to further their knowledge in the cyber area. It will also allow you to become a better intelligence analyst, as a whole. Overall, it was a truly fantastic learning experience that is applicable in both our personal, as well as professional lives. I most certainly have a new appreciation for online security and safety.” – Recently certified student February 2017

27/02/2017 0

2017 Training Courses – Treadstone 71

2017 Training Dates

Main Page to Treadstone 71 Training – 2017

(or on demand including in-house or by location)

Treadstone 71 is working with FS-ISAC for training in London, Singapore, Malaysia, and Australia.

FS-ISAC Sponsored Courses:

07/02/2017 0

Wilderness of Shlemiels

Thurs 9:15 AM Moscone South 307. Treadstone 71 talk on adversary infiltration target centric DandD @RSAConference ‬https://www.rsaconference.com/events/us17/agenda/sessions/6113-wilderness-of-shlemiels

Register ahead of time for a seat

Be there!

www.treadstone71.com

06/02/2017 0

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this: