Analytics
8/13/2014
00:00 AM
Dark Reading
Dark Reading
Infographics
Connect Directly
RSS
E-Mail
50%
50%

Get Smart About Threat Intelligence

Is threat intel the best way to improve defenses and stay ahead of new and complex attacks? Nearly 400 respondents to Dark Reading's new Threat Intelligence Survey seem to think so.

Get Smart About Threat Intelligence

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JasonSachowski
50%
50%
JasonSachowski,
User Rank: Author
9/10/2014 | 6:42:21 PM
Re: Disconnect?
I wouldn't go as far to say this is attributed directly to the process aspect. Sure we could enhance our processes to make improvements on the flow of data between the doers and the decision makers; but there's also the challenge of data getting lost in translation. Not so much because of process, but because the doers speaking in a technical language (0&1) and the decision makers speak in a business language ($$$). By improving the way we communicate information, the process disconnect to improve data flow would somewhat fix itself.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/10/2014 | 7:44:46 AM
Re: Disconnect?
@JasonSachowski, So you are saying that there needs to be a better process communicating tactical information from to the analysts who are developing defensive strategies and action plans.... 
JasonSachowski
50%
50%
JasonSachowski,
User Rank: Author
9/9/2014 | 8:22:55 PM
Re: Disconnect?
Sure @MarilynCohodas... As I mentioned before, threat intelligence is a collection of (somewhat) similar information to tactically mitigate individual an threat. And for the most part, those security analysts who are directly involved in taking action from this intelligence aren't necessarily those senior professionals who are involved in decision making. However, the tactical intelligence collected and disseminated by the security analysts can be correlated and become a large contributor to strategic road maps developed by senior professionals.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/8/2014 | 9:26:42 AM
Re: Disconnect?
@JasonSachowski, you wrote that security practitioners need "to take what we learn from threat intelligence and feed that into a larger form of security intelligence.." to move from the tactical to the strategic.  Care to give an example of what that would look like?
JasonSachowski
50%
50%
JasonSachowski,
User Rank: Author
9/6/2014 | 12:38:59 PM
Re: Disconnect?
The way threat intelligence is delivered to us is that it is mostly information about individuals threats. It provide us with the information we need to safeguard against each threat and is mostly tactical. If we really want to get ahead of the game, we need to take what we learn from threat intelligence and feed that into a larger form of security intelligence. This way, we can get away from the tactical/linear approaches and develop more strategic/cyclical methodologies.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/31/2014 | 8:44:17 AM
Re: Disconnect?
This is disheartening. One of the main principles of information security is that analysis/scans without action/adaptation is a useless practice. Threats evolve so the security in turn and strategies needs to evolve. A waterfall approach cannot be taken with an agile vector.
Bprince
50%
50%
Bprince,
User Rank: Ninja
8/15/2014 | 8:47:51 PM
Re: Disconnect?
Yeah I find that an interesting stat too. I guess that means the threat intel is confirming what they know already and have already been preparing for. Or it could be that they are not digesting that intelligence well.

BP
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/15/2014 | 9:12:34 AM
Re: Threat Intel
Yes, it's overall an encouraging report. I find it interesting (not totally surprising) that socal media is getting scant attention from respondents. jJust 13% of respondents said they are looking at FB, Twitter and blogs. I wonder if that will change over the next year?
RiskIQBlogger
50%
50%
RiskIQBlogger,
User Rank: Author
8/14/2014 | 12:48:41 PM
Threat Intel
Interesting information, it seems like threat intelligence is becoming a more prevelant strategic initiative.  Things are hopefully headed in the right direction!
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/13/2014 | 1:56:13 PM
Disconnect?
85 percent of respondents says threat intellegience plays some role in their security activities but 90% says that threat intel analysis has't changed their defense strategy. What's up with that?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.