Analytics
8/13/2014
12:00 AM
Dark Reading
Dark Reading
Infographics
50%
50%

Get Smart About Threat Intelligence

Is threat intel the best way to improve defenses and stay ahead of new and complex attacks? Nearly 400 respondents to Dark Reading's new Threat Intelligence Survey seem to think so.

Get Smart About Threat Intelligence

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JasonSachowski
50%
50%
JasonSachowski,
User Rank: Author
9/10/2014 | 6:42:21 PM
Re: Disconnect?
I wouldn't go as far to say this is attributed directly to the process aspect. Sure we could enhance our processes to make improvements on the flow of data between the doers and the decision makers; but there's also the challenge of data getting lost in translation. Not so much because of process, but because the doers speaking in a technical language (0&1) and the decision makers speak in a business language ($$$). By improving the way we communicate information, the process disconnect to improve data flow would somewhat fix itself.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 7:44:46 AM
Re: Disconnect?
@JasonSachowski, So you are saying that there needs to be a better process communicating tactical information from to the analysts who are developing defensive strategies and action plans.... 
JasonSachowski
50%
50%
JasonSachowski,
User Rank: Author
9/9/2014 | 8:22:55 PM
Re: Disconnect?
Sure @MarilynCohodas... As I mentioned before, threat intelligence is a collection of (somewhat) similar information to tactically mitigate individual an threat. And for the most part, those security analysts who are directly involved in taking action from this intelligence aren't necessarily those senior professionals who are involved in decision making. However, the tactical intelligence collected and disseminated by the security analysts can be correlated and become a large contributor to strategic road maps developed by senior professionals.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/8/2014 | 9:26:42 AM
Re: Disconnect?
@JasonSachowski, you wrote that security practitioners need "to take what we learn from threat intelligence and feed that into a larger form of security intelligence.." to move from the tactical to the strategic.  Care to give an example of what that would look like?
JasonSachowski
50%
50%
JasonSachowski,
User Rank: Author
9/6/2014 | 12:38:59 PM
Re: Disconnect?
The way threat intelligence is delivered to us is that it is mostly information about individuals threats. It provide us with the information we need to safeguard against each threat and is mostly tactical. If we really want to get ahead of the game, we need to take what we learn from threat intelligence and feed that into a larger form of security intelligence. This way, we can get away from the tactical/linear approaches and develop more strategic/cyclical methodologies.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/31/2014 | 8:44:17 AM
Re: Disconnect?
This is disheartening. One of the main principles of information security is that analysis/scans without action/adaptation is a useless practice. Threats evolve so the security in turn and strategies needs to evolve. A waterfall approach cannot be taken with an agile vector.
Bprince
50%
50%
Bprince,
User Rank: Ninja
8/15/2014 | 8:47:51 PM
Re: Disconnect?
Yeah I find that an interesting stat too. I guess that means the threat intel is confirming what they know already and have already been preparing for. Or it could be that they are not digesting that intelligence well.

BP
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/15/2014 | 9:12:34 AM
Re: Threat Intel
Yes, it's overall an encouraging report. I find it interesting (not totally surprising) that socal media is getting scant attention from respondents. jJust 13% of respondents said they are looking at FB, Twitter and blogs. I wonder if that will change over the next year?
RiskIQBlogger
50%
50%
RiskIQBlogger,
User Rank: Author
8/14/2014 | 12:48:41 PM
Threat Intel
Interesting information, it seems like threat intelligence is becoming a more prevelant strategic initiative.  Things are hopefully headed in the right direction!
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/13/2014 | 1:56:13 PM
Disconnect?
85 percent of respondents says threat intellegience plays some role in their security activities but 90% says that threat intel analysis has't changed their defense strategy. What's up with that?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3216
Published: 2015-07-07
Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, allows remote attackers to cause a denial of service (application crash) by establi...

CVE-2014-3653
Published: 2015-07-06
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.

CVE-2014-5406
Published: 2015-07-06
The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, ...

CVE-2014-9737
Published: 2015-07-06
Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block.

CVE-2014-9738
Published: 2015-07-06
Multiple cross-site scripting (XSS) vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) account username, a (2) node title, or a (3) team entity title.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report