hello everyone and thank you for joining
me today in the session about the cti
league i call this session watching the
watchmen because
first i really like comics and i really
really admire the watchmen comics but
second i think that
this is the question of the cti league
who watched the watchmen who saved the
people that protect in our lives
who
take care of the people that
taking care of our life this is really
really important and today we are going
to speak about the cti league about the
effort of us and how we are trying to
make a safer cyberspace for the medical
sector and a little bit about cyber
intelligence
we will start with an introduction for
the cti league about our mission and how
we are trying to achieve this mission
then we are going to speak about cyber
threat intelligence on the matter of the
threat actors the organization focused
in the
unknown world of the intelligence and a
little bit about
what is the future for the cti league
so let's start with an introduction as i
said my name is al zeidenberg i'm one of
the founder and
the executive director of the city i
live
moreover i'm a cti researcher cyber
threat intelligence researcher mainly
focus on threat hunting and intelligence
for the past 10 years i'm doing that and
focus on learning how to make
intelligence better
the cti live founded in the first wave
of covered in march 2020 by me alongside
with nate warfield mark rogers and chris
myers
we started as an organization that tried
to neutralize cyber threats looking to
exploit the coordinating pandemic and
today we are more focused on the
healthcare sector in general
we are non-profit organization
all volunteer land
it means that for the first time there
is an organization that based and
derived by its community that based on
the community and the members of the
community the volunteers have the right
to say hey i think we should do
something differently
our members are from all around the
world in the past
one year and six months of operating we
had more than
1500 members across industry cti
researchers form an intelligence company
from intelligence companies from the
infosec industry but not only from any
organization that can support our
mission from all around the world around
80 countries
including countries that i as an israeli
can't go to
including law enforcement organization
and agencies from all around the world
let's take a look on our volunteering
map you can see that
almost every continent is representing
in the league
and
more importantly we can achieve
greater result by breaking the silos and
barriers between countries this is what
we believe in
therefore we developed the open cell
model it's a community model for the
first time we want to build
not a national cells that protect
hospitals lifetime and organization and
medical sector in general we want to
build an organization a cert in the
derived by its community by the people
that share with us their time their
skills their capabilities anything
we believe that if they share it with us
and share it with the league basically
we need to give back and give back is
the right to speak and to say hey
i think
that we need to do something differently
and we are part of a trend walter and
and i really really like it of course
for good like other organizations as the
biological village as trace labs we are
trying to do
better thing with austin
currently we are not connected to any
hospital in the world but we can make
large impact for them today i'm going to
share with you how we are trying to make
this impact
in order to understand that we need to
speak about the mission so the city
league mission as i said before was to
neutralize cyber threats looking to
exploit the copy 19 pandemic
today our mission is
larger within uptick of the attacks
against the medical sector hospitals in
particular during this year
we saw how vulnerable they are
and therefore we want to be there for
them not only during coverage of course
in kovid it's an emergency it's a world
crisis and someone need to protect them
but a ransomware that attacks hospital
it's not something that we can say okay
this is fine in regular days which is
which are not days of pandemic
we have to be there for them we spoke
with so many citizens from all around
the globe and some of them told us
unbelievable equations that they needed
to make one of them for example from
israel told me that the boat of the
hospital told him that if he wants to
build
stock department
in the hospital
he need to choose between
purchasing
beds for er department or to building
the soft
no cso no manager need to make this
decision their mission is to protect
people to save lives to give therapy
our mission is to create safer
cyberspace for the medical sector and
any life-saving organization of course
we focus on the segment of the
stakeholders the organizations that
can't really protect themselves they
don't have the budget they don't have
the skills they don't have the knowledge
of the
they are not capable to do it and we
believe that this is
the greatest mission
that we chose to protect the people that
watch us to watch the watchmen
in order to achieve this mission we
develop the three layer of protection
methods
the first layer is prevention
prevention is like wearing a mask
trying to reduce the level of threat for
any organization
and i would we do that by supplying for
example reliable information regarding
cyber attacks not only we're going to
discuss about this mainly today
in the future we hope to train medical
organizations from all around the world
how to protect themselves from cyber
attacks how to overcome cyber attack
and of course the supporting phase what
do you do if your organization was
already targeted or attacked or there is
a data leak from the organization we
want to support cyber capabilities with
guidance and technical advisors we want
to mitigate attack and help them to
mitigate the attacks and in special
cases
like the coordinated october attack
against u.s hospitals
we will build operations or intervention
team to help them to exceed the maximum
impact we can make on these
organizations
but
as i said we wish to be assert
so if we want to be a servant we need to
make something more radical and in order
to do that we developed the third layer
of the protection which is
neutralization it's not only reducing
the level of threat with masks or going
to the doc to the doctor for therapy
it's
vaccine
how to cut from the root the threats
how to disrupt the ability to conduct
the criminal activities
we escalate information for law
enforcement organizations that have
mentioned before from all around the
world hopefully
they will make the further step and we
know they already did we had
amazing collaboration with them and in
some cases we found the personnel that
executed the attack
with that we can make the biggest impact
for the organization without even
talking with them
but today i want to focus mainly on the
prevention aspect
we are going to do that we are speaking
about cyber threat intelligence so let's
start with
some intelligence point of view
for
me as an israeli former soldier in the
israeli army
everything is divided to three so
if i try to summarize the points of view
of intelligence we can take a look on
the matter of cyber of course we can
take a look of three main aspects or
points of view
the first one is the three attractor
searching information about the threat
act of specifically
the second one
is
on the matter of the organization the
victim the sector it doesn't matter but
we are not trying to find information
about a specific threat actor we are
trying to find information that enable
us protect specific organizations or
specific sectors or to learn more about
an attack that happened in the sector so
we can say okay if something happened to
this organization it's going to be
reflected to other organizations
the term for the few which is the
unknown it's like likely in the style
you know that is there but no one knows
a lot about it this is really
challenging and in the following minutes
we're going to discuss about each part
of this point of view and we're going to
see how the cti really trying to make
the impact to find the information that
enable us
to share it with the organization and
enable the organization
prevent cyber attacks
if they would prevent the cyber attack
they would be
more protected
and then they can give
more good therapies from any people that
go into the hospital
the question that we need to ask when we
are working on cyber intelligence or any
other type of intelligence is fishing or
hunting
by fishing
we spread nets in a lake in the ocean in
something that we are familiar with and
we believe that there are fishes though
but
we don't
focus on specific fish we can say okay
the probability of this fish in the same
spot is really high so we are going to
spread the net and we are going to try
to find
anything that we are trying to but we
can focus on a specific threat
because it's hard it's really really
hard you can you know trying to find and
hunt like in hunting the specific threat
every type of intelligence have the pros
and cons
and in the city i live we are doing the
both
aspects
we are spreading the nets and also and
for the information
so let's start with the threat atos the
main aspects of cyber threat
intelligence
who targets the healthcare sector
is it the aptly the
nation-state-sponsored
attackers
is it the e-crime the financial
attackers that want to make profits from
cyber attack is the activist
sadly
it's everyone
from north korea and iran the apt is to
the e crime as we saw in the coordinate
attack on hospitals in the u.s or as we
see
almost weekly about hospitals from all
around the world that were infected by
ransomware
we saw some activists trying to leak
data and so this information operations
so if we ask is only the shouts the
largest fish in the ocean
not except the whales of course but the
largest fish in the ocean
no
it's everyone
so another question that we need to ask
is
why they target the healthcare sector
because
at first
it wouldn't make sense for me at all
i thought every country in the world
has its own hospitals
so they know that hospitals are in
charge of people life of therapy
in days of pandemic for example like
countries
like iran
know how challenging
this time is so why to attack hospitals
this makes it so tricky
my
feel when we
developed the cti league when we first
established the league that the staining
that happened in one high in the uk
hospitals for example the slow motion of
the therapies is going to happen again
and we saw that it happened
someone died
in september not directly because of the
ransomware but the delay of in a
hospital
make it really really challenging
so we don't have a case now that someone
died directly because a
cyber attack but it affects people if it
slows down the therapies if it
disables some therapies like
mris or some
other therapies it can affect people it
can cause death
so
what can we do about it and
let's share some insights
today i want to focus on two main threat
actors not apts
i'm going to speak about the ransomware
and the initial access workers
these
two actors are really really relevant
for the medical sector for the public
health sector and any other life-saving
organization
let's start with ransomware
in the darkness report that we've shown
february the early darknet report we
explained why the cti league prioritized
ransomware
we said that we see the uptick the
increasing
of the attacks from ransomware against
hospitals
some ransomware group like maize
declared in the beginning of the
pandemic that
they are not going to attack hospitals
that was false claiming
they did
a lot of groups did
and for example we learned that a cancer
center that was a victim of a ransomware
was so impacted by this attack so the
staff and the patients
needed to try to make the therapies the
treatment rebuilding it
from memory this is something that we
can't accept as the infosec community we
can't accept that some criminals will
make this impact on people's lives it's
not a fair game between countries it's
not a fair game between people it's not
about
spying or espionaging on
something that's related to the country
this is against stable people
it's not okay
so here some insights that we learn from
the efforts of the darknet team
before that some words about the darknet
team the city league dark is an amazing
collaboration between people from all
around the world professional and expert
in the darkness domain that also focus
on ransomware
led by
really good people that also
helped me to build this presentation and
i will acknowledge them uh afterwards
and these are some of the insights that
we found you can also find
this insights and more in our website
cti-league.com
in the dartmouth report
so we found that the main variants the
main ransomware groups in 2020 that
targeted hospitals were conti
males networker ryouk and evil
they are not alone a lot of ransomware
groups attacks targeted hospitals during
this one year and six months since we
invented the league
but these are the main variants
in some cases it doesn't matter if they
are sophisticated they are really clever
they know how to execute the most
brilliant attack in the world because we
saw ransomware group like dark side make
a huge impact on the us
and here some data about with what we
found in the last quarter of 2020 and
it's really important
18 publicly reported ransomware
on hospitals
were shared
in the last quarter of 2020
but
23 victims
their data was leaked online
so
there are more attacks that not reported
publicly and it's important no one wants
his personal data or
medical data to be shared online
it can affect the people that the data
was left but also it
destroyed the
resilience of the hospital to overcome
this turmoil
you know when someone is shell private
data from hospital people can take a
look at this hospital and say
this hospital is not secure enough this
hospital not protect my data
i'm not going to believe this hospital
i'm not going to go to this hospital
again
and this can cause undermining of the
authorities
with and this is a cycle that we can't
enter now the disinformation of covetous
we learn from our disinformation team in
the city i live
it's so large that we can't accept
someone that
harming the resilience of the
organization
and 24
we may they're made up over 35
of all attacks against the article
system and since then guess what it only
increased
it means that more and more threat atos
focusing on the healthcare system
they want to attack them no matter if
they are in charge of our life no matter
if they
also have some therapies in hospitals
they attack not only hospitals the
healthcare system
in general the public health healthcare
of course as i said the cti league focus
on the hospitals that can protect
themselves but we want to learn
about any attack because then
the implication of it can be shared with
another hospital and maybe prevent the
next attack
and
last but not least rdp
as the ransomware attack vector
significantly rose compared to 2019
this lead me to the next threat actor
the initial access brokers
so for those of you that never heard
about the iab the initial accessbook
let's define them
visual access broker is someone that
gains access into a victim network and
then selling that access to the highest
bidder it can be one actor or it can be
more so if we saw before that rdp as a
ransomware vector significantly rose
these people
are the people that in charge of selling
out fees
this is the map from the dartmouth
report that shared the presence of
attacks
of the initial access brokerage shared
in 2020 as you can see the majority
attacked north america but it's a world
epidemic
a lot of threat actors now use the data
of the initial access broker
it's a ripple effect
they hack
they compromise for example rdp
as the main vector of the initial access
broker
and then they sell it online here is an
example for that
they sell it online for the highest
bidder the ist builder can be a
ransomware group that
doesn't necessarily need to have skill
of exploitation
they do it for them and then
they can sell it for the ice to be there
the ransomware can use it they can lift
the data
all the cycle all these ripple effects
effect on our life someone need to
gather information about it
and say first of all here's the you see
as simple as that block the iocs we had
a conversation back in april 2020 with
some sales from europe and one of them
told me that they don't know how to
digest information for missed so we
created the github of the cta league
with block list and a loud list think
that as that anything that we can share
the information deliver it
we develop sticks and miss of course
take tax and missed to share it and in
the future i really hope to have
complete intelligence cycle for them
so if we know the blc's the behavioral
ifcs and the iocs and we know the main
vectors that the initial access box
operates we can share the data about
these threat actors these specific
threat actors with
law enforcement organizations
or with the hospitals the medical sector
and other life-saving organizations and
what happened reduce the level of stress
the awareness of any type of attack is
the first step of every prevention
if we want the mission of us is to
create safer cyberspace for these
organizations
we should start with giving them the
knowledge
first these are the threat actors that
we know that want to target you
block
block it make sure that you are covered
from tip to toe if the rdp station is
the main vector
focus on that monitor it
but not only
we can't look only on threat actors
because then we can spread the other
wolves the nets
of the transactors we can learn about
them
but if we are looking only on the threat
actors that we're familiar with
we are going to miss a lot of attacks so
we need to make sure that
unlike the
organizations we focus on the
organization make sure they are
protected enough regardless any type of
attack
so how can we protect an organization
without any access to it as i said
before we are part of the world trend of
austin for good and we are not connected
to any hospital and they share the data
with us well not a software server
this is the challenge
if we spoke about the main vector of
attack remote access
why don't we
monitor
some vulnerabilities or some open rdp
for example share it with the
stakeholders with the organizations that
need and want
our help and we can help them
and then reducing the level of threat
regardless of a specific threat actor
i'm going to present two type of
intelligence that we gather in the city
a living shelter
first of all the prevention aspect is
protecting the gates of the organization
if we spoke about remote access and we
spoke before about vulnerabilities the
importance of vulnerabilities we need to
find it
so i'll get to the data i want to
emphasize the importance of discovering
one days
in
your system
this is very very important because
there are threat tattoos
apts e-crime activism anyone that can
exploit it in days
maybe
from
the moment that someone shared the one
day
then for the exploitation it's going to
be
minutes hours days but the organization
response is going to be so low
and we need to alert them so we
prioritize critical vulnerabilities and
we prioritize some vectors that we learn
that are very very very risky and make
the organization very vulnerable
we created a monitoring system on that
and i want to start with say special
kudus to show them that enable the
system
alongside with good people we develop
the system that monitor on that
and
then we can
find a vulnerability validate it
share the notification to the
organization if we have connection with
the organization if not we can share it
with the law enforcement organization in
some cases in their language it means
that if we send a message for for
example for the thai cell that we really
really really
love the connection with them because we
really believe this is a prominent
connection between the city ali and nsl
really really really far away from the
critical mass of this league that which
is in the us
so we can send it in thai language and
then they can just forward it to the
organization to the hospital to the
vaccine company that need this alert
and they can make it
as fast as they can
because we translate it to the language
let's take a look on the data
before i make this presentation
i checked how many notifications we sent
only in july
in july we sent more than
550
notifications
now
consider that we are opening for one
year and five months almost six
how many vulnerabilities how many
critical
vulnerabilities whether they are cves or
human vulnerabilities like open rdp how
many we found how many we sent and how
many organizations can be protected more
the level of threat reduced
significantly
because
organizations patched
and if we can help them
this is
our main mission
so you can take a look of cve
2018.0708 for example
338 alerts only in july 2021
well law enforcement organization
receiver alerts daily basis
anytime that we found it and it passed
the validation process
to all around the globe and this is
really important to us we believe that
we can work together as one unit no
matter what your country no matter what
your place no matter what you believe
your political agenda
working together collaboration is the
key to make impact because one attack
that
the uk suffered
can be returned in
any other country in the world so if we
learn the insights
from this attack we can give
recommendation for any other
organization in the world
this is what we are trying to do with
the collaboration within the city i live
with promoting and encouraging the
collaboration
of course we make friends and of course
we make a lot of impact for the people
that volunteering but mainly we can make
a huge impact for the organization as
salt and this is only on the prevention
level
so if we spoke about collaboration
let's talk about another organization
that helped us in the monitoring system
0bs and we want to talk ma to thank
marcus for this details
the obs monitoring system they call it
infrastructure team slash notification
connected to 16 cells worldwide 21 2
socks worldwide they prioritize 95
critical vulnerabilities
and they send
on behalf of the cti league more than 2
000 notification since we created league
61 millions more than 61 million ips
reported
by zlbs to the league and from the
league to anyone this collaboration and
more collaborations like this
are very important
if you want to make impact
this is the key
the obs and other companies that
exist in the league has the data
in most cases because no one pays for
that and i understand it on the mba in
the university i know the importance of
have the business plan you can share the
data
really and this is what we are trying to
do
we are trying to
encourage the collaboration and make
safe and trustful platform for people to
share their data
and then we can use this data together
to make the impact of the hospitals so i
want to say again thank you for xerobias
both for the data and for the amazing
collaboration in one year and six months
remediation
is the key
so if we take all the data
both on the threat actors and the
organization
now let's speak about
some actual medals that any organization
can take
if we speak about intelligence we need
to understand the lack
of the information that we have we don't
know everything and then therefore we
don't know for
a lot of zero days that exist we don't
know for any type of attack any ttp
even if we look at the mitral attack we
can see that every time more and more
reports came out and
we have
new methods to attack so if we have the
sense that no one is 100
protect and we know that
we know that we need to make some errors
so the first matter is to connect to
yourself and your local authorities
make the low rich barriers it means that
if you got attacked by a ransomware and
you need someone to call
you don't you don't start to search and
do all this process from the beginning
you have already someone to reach and
say hey
call it by name i got attacked no dear
cell this is the first time i'm calling
you
and
my name is
from hospital x and now i need your help
make these connections collaboration and
working with people is the key for
succeeding
prepare for the attack make strong
password to a phase protecting the other
piece restrict access gear or
dislocation for example
we've talked about some of the measures
before and we are trying in the
supporting layer
to guide and advise
any organization that we work with how
to protect better so the organization
have to be protected as you can it's not
going to be 100 protected of course but
make it highest as you can
but
know your weakness
know
when you can't protect and what do you
do about it for example if you have some
antique
work
workflow or you have some machines from
i don't know from the 90s if you're
using
some
windows xp for example
there are so many critical
vulnerabilities about it there are so
many critical vulnerabilities exposed
yearly and every time it's like double
the number or more
so know
what are you your weaknesses and know
how to take care of it no one is 100
protect even if you building the tallest
wall
that cover your city
but if someone will dig
in your soil and get into the city like
that or if you know the story about you
know the
i guess the green the greek force
this is something that you need to
consider so
connect yourself prepare for the attack
of what you know that you can protect
know your weaknesses
take care of the human factor
your users
your employees need to know
better not only use strong password and
use to say explain them directionally
remember that they are not people
experts in the cyber domain you need to
explain the end point behind any steps
the importance and not the policy alone
if you said to them do not connect your
phone to the computer
it's not some policy that you need to
take care of it
there is a rationale behind it explain
how it can effect on the system on the
network how they can enter malwares into
the network
by explaining them by communicate with
them by working together as one you need
to protect the organization you make
them the first soldiers that protect the
organization you reduce the immune
factor you never going to believe if you
check the numbers how important the
human factor and how critical human
factor in any cyber attack
they can protect you from any decoy
document for example
if they know not download
they have documents that send to them in
emailing still patient campaign and not
to press
immediately the enable contact
you made a lot of change you reduce the
level of threat to your organization
and
without the last parties have a plan
any cyber attack is a thermal whether
it's small cyber attack
like a defacement attack
or largest the largest attack that you
can ever imagine like the leave the
kerem's evil attack or swallowing
every plane
every organization that get into the
cyber attack with a plan
can succeed to overcome the turmoil we
learnt it for example in the october
coordinated attack against u.s hospitals
a lot a few hospitals were attacked in
at the same time in october 27 2020
and the organization that had a plan
that the best practice and the
compliance
knew how to overcome it so if you know
that your weakness is in a system
specifically
if you connect if you can disconnect it
from the old network it's better but
it's not
prepare for cyber attack
take caring in your consideration that
you can be attacked from a ransomware
someone will disrupt your ability to
help the patients
and what do you do next
so we spoke about
the three tactus we spoke about the
organization
and the cti league
holds the third
also the third aspect of cyber security
the unknown
the third aspect of intelligence it's
wide risky and required to think of out
of the box because
you need to search for something that
you don't know that is exist
then you need to ask yourself the
intelligence questions
what is the pir
what i'm trying to understand
what is the question that i'm asking
myself
and with that question in my mind i'm
going to search and trying to identify
the new information what is the end
point
for example if i'm going to search for
data leak
of in hospitals that i don't know what
is the hospital and i don't know which
threat actor can lick the data or
compromise the organization
what do i do
how do i find this information i need to
think about the pir and i think need to
think about the end point the end point
as we spoke before is to alert the
hospital to help them save their cyber
resilience to protect the patients that
their data was left online
and if we can to neutralize it then we
neutralize it
so let's take an example
some of the ctl missions
first identifying compromised remote
access platform in the wild it's both on
the dark net but not only
are trying to do that without thinking
of any organization
without a list of hospitals from all
around the world that we are searching
the name we do that on the matter of
organizations if we have the data we
will do it
but here we are trying to search the
remote access platform that
was leaked or sell online
and if we identified it then we can move
it forward for law enforcement
organization they can check they can
protect the hospitals because they have
the data collaboration is the key we are
not trying to make a profit here we are
trying to make impact so it doesn't
matter if we search the name of the
hospital or the law enforcement searcher
the name of the hospital
we're trying to make an impact
monitoring attempting to sell
compromised assets
mainly in the dark web
for that we develop scrapers the
scripters
will try to find
any setting of compromised assets
this is really important because then
we're searching the unknown we can't you
know follow specific users
in the dark web or searching for
specific queries or terms we need to
search and think out of the box
these two
can be
done with fishing with spreading nets as
i said scrapers
but it's not enough
we want to hunt
so
we hunt for the information the
numerator operation in the dark web
theme of the city i live which named
city i like dark we have professionals
that are really really good and can hunt
the information from the threat actors
and take for example rdp sessions
that
someone is trying to sell to steal the
information back and then we can share
it
in these operations you need
experts you need the talented the people
in the industry
and
for luck there are a lot of good people
that believe in the mission of creating
safer cyberspace for the medical sector
and other life-saving operations and
want to join us in order to fulfill our
mission
hunting for new vulnerabilities
we don't search for zero days we don't
check the uh vulnerabilities in the
systems of a specific hospital
but if we find something that can
indicate of a new vulnerability like the
4th of july operation that we understood
first that there is the f5 uh
vulnerability back in last year in july
last year we created a team work
for the entire weekend to search
vulnerabilities
that's related to the f5
so we have the two type of methods
fishing and hunting we have the three
point of views of intelligence
so before we speak about the future
let's summarize
we are the cti league
we
established in 2020 as a community of
people that wanted to do some good
during the pandemic to make a change for
hospitals and to prevent and neutralize
cyber threats looking to exploit the
current winning pandemic in this one
year and a half
we learned how vulnerable
these organizations are
we chose the segment of organizations
that
we don't want them to make the questions
that i made before or they can't protect
themselves from a lot of reasons
it can be
larger organization or small but
as long as they in our segment we want
to protect them we will do everything
that we can to protect them
we work with members from all around the
globe in the last one year and six
months we have more than 1 500 members
that join us in in the way
to fulfill our mission
we now have a mission of creating safer
cyberspace for the medical sector and
lifesaving organization and we do that
by
three levels of protection prevention
supporting
and neutralization
here in the stock we spoke about the
first layer the prevention layer
in order to prevent cyber attacks we
need intelligence
we had three types of inter intelligence
in general terms the first one is the
threat actor the second is working on
the organization and the third one is
the unknown we spoke about ransomware
and initial axis broker as some insights
that we found during this walk in the
league mainly by the cti league dark
team that
is is just amazing team and i
want to uh thank every single member
that joined this team during this time
we talked about the initial smoker
we
focused on rdp sessions is a main vector
and prominent vector but not only any
remote access is important
alongside we've exchanged we found some
uptick in the last months in uh
exploiting exchange vulnerabilities
we spoke about the organizations how we
do that by our monitoring system or this
new obs monitoring system and every
other organization that helps us
in this mission in fulfilling the
mission this is what's great about the
city i live we are searched that derived
by community and within the community we
have the talented people in the universe
that want to do some good that believe
in the mission
they join us because they wanted to
neutralize cyborg that's looking to
exploit
the karen
19 pandemic and now they are here
because
they want to create safer cyberspace for
the medical sector and lifestyle
organization
and we spoke a little bit about
remediation
about some steps how to overcome the
thermal cyber attack
you spoke about starching in the unknown
both in the nets in the fishing method
or in the hunting method
and now it's time to speak about the
city
future i spoke about the collaboration
so much in this session
and the people that know me already know
that is
my first mission
this is the will
that i'm sure that i'm hearing with me
so collaboration is hard but rewards are
great and these are two rewards that cti
league members should be proud of
because this is not about
me or my partner smart this and nate
all the people that volunteered the
watchtower
you know you are
these are for all the cti league you
made it so
had two rewards in 2021 is the cti
league one the difference maker award
winner for 2020 by sans institute
really really really amazing ownership
and the second one is the highlighting
of the cti league in while 25
in
people who are making things better
the members of the cti league are the
people that making things better
the members for example of the dagner
team
making the way of monitoring and finding
information in the dark web
differently
and they make it in the best way
the information that they fund
can prevent cyber attack and reduce the
level of threat
can support any organization to
remediate attacks and to mitigate
attacks and also
they work so hard with law enforcement
organization
escalate information
hopefully we will disrupt
the criminal's abilities
to conduct the criminal activity
so this is the time to look of every
single member and say
thank you build prices are yours
and we are hope that we can expand our
services
increase the impact that we make for the
organization
and how we do it this is our way to do
it
open cert
we have the watchtower that develops the
independent services that we don't want
to rely
only on the community because we
understand that volunteering is hard a
lot of people don't have spare time to
volunteer or it's really hard to share
skills resources of organization so in
any point that we can make it by the
name of the cti league we can make it
automatic
but we have the global community of
professionals and this is the main
aspect of the city i like
this is what drives the city i live the
community of professionals
non-profit organization
we don't hear for the money we don't
hear for the profit we are here for the
impact
and we want to focus of course on the
medical sector of hospitals and other
life-saving organizations
last but not least i want to
say
if we are speaking about the community
model we need to say thank you this is a
community talk this is not my talk only
i shared it
here in the uh session a lot of the data
that's gathered by our amazing team
from
all around the aspects from the people
that searching for vulnerabilities the
people that support infrastructure the
dark web team the disinformation team
the people that gather is the people
that work with with us as collaborators
the law enforcement organizations that
join our mission and work together the
bioarcing village that led me this
platform to speak with you today and
share this insight with you
thank you thank you for all the members
that helped in this session building
thank that beautiful matthias and marcos
and sean and everyone that i must forget
their name you know you are you know i
will care about you how we care about
you
and your collaboration is what
make me wake up every morning with the
sense that we do something good here
this is for you thank you so much
my name is
as i said i'm one of the founders of the
cti league but the cta league is an
organization
of the community
for the first time the influencer
community want to do something
differently as a served
for the first time reunited over a
mission
specific mission that is so important
if we succeed
reformation
we will make impact we will save life
and we will give a lot of
ceremony and spare time for the
hospitals the medical sector
the healthcare sector and other
lifestyle organization
to save lives thank you so much here is
the website of the city league if you
want to follow us if you want to connect
with us please let us know in the
website you can find emails you can
reach out on twitter or on linkedin and
we'll do everything we can
connect with you
thank you so much