Careers & People

2/4/2016
10:30 AM
Bob G. Stasio
Bob G. Stasio
Commentary
100%
0%

New Kid On The Block: Cyber Threat Analyst

Drawing from the financial service industry, this new role uses the "art of the intelligence cycle" to drive efficiency in the security operations center.

With the rapid rise, frequency, severity and cost of cyber attacks, many companies today are looking to the government military intelligence industry for the skills, talent and experience to run their security operations center.

Leaders in the financial markets were the first to realize that an SOC driven by intelligence could be a force multiplier in achieving operational efficiency and effectiveness. Early adopters such as JPMorgan Chase & Co. used this expertise to restructure personnel into new tiers with new priorities and job functions. One of the newest roles to emerge from this shift is that of the cyber threat analyst. 

What is the exact role of the cyber threat analyst and how does the analyst’s work help prevent attackers from stealing critical data or causing other harm to a business? What the cyber threat analyst brings to the table is the “art of the intelligence cycle.” This is where information is directed, collected, processed, analyzed, produced, and disseminated.

For example, in an organization where I once worked as a cyber analyst, my team was tasked with finding a better way to identify insider threats within the company. First, I identified the relevant sources of data by which could identify insider threats, in this case, badge logs, web proxy traffic, and print logs. Then I began determining the patterns likely to be associated with malicious activity. These patterns allowed me to narrow down potential suspects to only .0001% of the employee pool.

After we disseminated our report, others on the security operations team became much more effective in monitoring insider threats. Intelligence truly began to drive operations – which was the optimal outcome.

Worth the effort
Building the capability of cyber threat analysis is a challenging endeavor that will yield tangible results – but it takes time and discipline. Here are three key principles for developing a successful cadre of analysts:

  1. The rule of three. Cyber threat analysis is composed of three distinct skillsets, and very rarely will one individual maintain all three. To properly learn cyber threat analysis, an analyst must learn information security (e.g. network defense, information assurance), intelligence analysis (e.g. the mastery of the intelligence cycle), and forensic science (e.g. investigations, evidence handling, discovery). It is essential to recruit individuals strong in one or two of these areas and also facilitate a training program to compliment skillsets. 
  2. Intelligence is a journey, not a destination. Building an intelligence program is an iterative process. The maturation of the program should be laid out in a phased approach, where simple “quick wins” can be achieved early on in the process. For example, a four-phased approach would include: ad hoc analysis, integration of non-traditional data into security analysis, increasing speed of searches in addition to higher tier threats, and finally, continuous feeds of real-time data and automated detection analytics.
  3. Knowledge is cumulative and must be nurtured over time. Cyber threat analysis is like many other professions where practice is necessary to continue learning the craft. Consider a surgeon: after eight full years of classroom education, can a newly minted physician walk into an operating room and conduct surgery? No, they must enter a five to eight year residency where they learn the craft under a seasoned, attending surgeon. Similarly, cyber threat analysts learn best under a “master operator;” a recent college graduate simply cannot operate close to the same level as a seasoned pro. During my experience in the intelligence community, it took over a decade to develop a cadre of cyber threat analysts with the requisite skillsets.

Companies implementing any of the three principles outlined above will see a reduction in the severity of cyber attacks impacting their organizations. But those implementing all three will see the best results. 

Bob Stasio is currently a Senior Product Manager at IBM i2 Safer Planet. Prior to this role, Bob worked in the private sector standing up threat intelligence programs at Bloomberg and global financial firms. He accomplished these efforts as the owner of his own consulting ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DeeM743
50%
50%
DeeM743,
User Rank: Apprentice
4/29/2016 | 11:27:33 AM
Cyber Threat Response
I enjoyed this article. Most analysts do not posses all 3 crafts in their trade. Most will be strong in IA and processes but lack creativity and imagination when it comes to hunting, understanding and trapping a skilled exploiter or hacker, whichever one is defined in your realm. I find that most organizations suffer from hiring white hat minded operators out of fear that if they were to hire grey hat minded they risk their own property but then can't understand why they can't profile their attackers. Skilled threat intelligence analysts see the digital world as a battlefield and clearly understand the environment and excites themselves In understanding their adversary. These analysts are the ones that need to be at the front of the line for hiring, not your Master degree graduates with a major in computer science that have no clue of what the real digital battlespace is.
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Lessons from My Strange Journey into InfoSec
Lysa Myers, Security Researcher, ESET,  7/12/2018
What's Cooking With Caleb Sima
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Surviving the IT Security Skills Shortage
Surviving the IT Security Skills Shortage
Cybersecurity professionals are in high demand -- and short supply. Find out what Dark Reading discovered during their 2017 Security Staffing Survey and get some strategies for getting through the drought. Download the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14339
PUBLISHED: 2018-07-19
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop. This was addressed in epan/proto.c by adding offset and length validation.
CVE-2018-14340
PUBLISHED: 2018-07-19
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed in epan/tvbuff_zlib.c by rejecting negative lengths to avoid a buffer over-read.
CVE-2018-14341
PUBLISHED: 2018-07-19
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the DICOM dissector could go into a large or infinite loop. This was addressed in epan/dissectors/packet-dcm.c by preventing an offset overflow.
CVE-2018-14342
PUBLISHED: 2018-07-19
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed in epan/dissectors/packet-bgp.c by validating Path Attribute lengths.
CVE-2018-14343
PUBLISHED: 2018-07-19
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash. This was addressed in epan/dissectors/packet-ber.c by ensuring that length values do not exceed the maximum signed integer.