Careers & People
2/4/2016
10:30 AM
Bob G. Stasio
Bob G. Stasio
Commentary
100%
0%

New Kid On The Block: Cyber Threat Analyst

Drawing from the financial service industry, this new role uses the "art of the intelligence cycle" to drive efficiency in the security operations center.

With the rapid rise, frequency, severity and cost of cyber attacks, many companies today are looking to the government military intelligence industry for the skills, talent and experience to run their security operations center.

Leaders in the financial markets were the first to realize that an SOC driven by intelligence could be a force multiplier in achieving operational efficiency and effectiveness. Early adopters such as JPMorgan Chase & Co. used this expertise to restructure personnel into new tiers with new priorities and job functions. One of the newest roles to emerge from this shift is that of the cyber threat analyst. 

What is the exact role of the cyber threat analyst and how does the analyst’s work help prevent attackers from stealing critical data or causing other harm to a business? What the cyber threat analyst brings to the table is the “art of the intelligence cycle.” This is where information is directed, collected, processed, analyzed, produced, and disseminated.

For example, in an organization where I once worked as a cyber analyst, my team was tasked with finding a better way to identify insider threats within the company. First, I identified the relevant sources of data by which could identify insider threats, in this case, badge logs, web proxy traffic, and print logs. Then I began determining the patterns likely to be associated with malicious activity. These patterns allowed me to narrow down potential suspects to only .0001% of the employee pool.

After we disseminated our report, others on the security operations team became much more effective in monitoring insider threats. Intelligence truly began to drive operations – which was the optimal outcome.

Worth the effort
Building the capability of cyber threat analysis is a challenging endeavor that will yield tangible results – but it takes time and discipline. Here are three key principles for developing a successful cadre of analysts:

  1. The rule of three. Cyber threat analysis is composed of three distinct skillsets, and very rarely will one individual maintain all three. To properly learn cyber threat analysis, an analyst must learn information security (e.g. network defense, information assurance), intelligence analysis (e.g. the mastery of the intelligence cycle), and forensic science (e.g. investigations, evidence handling, discovery). It is essential to recruit individuals strong in one or two of these areas and also facilitate a training program to compliment skillsets. 
  2. Intelligence is a journey, not a destination. Building an intelligence program is an iterative process. The maturation of the program should be laid out in a phased approach, where simple “quick wins” can be achieved early on in the process. For example, a four-phased approach would include: ad hoc analysis, integration of non-traditional data into security analysis, increasing speed of searches in addition to higher tier threats, and finally, continuous feeds of real-time data and automated detection analytics.
  3. Knowledge is cumulative and must be nurtured over time. Cyber threat analysis is like many other professions where practice is necessary to continue learning the craft. Consider a surgeon: after eight full years of classroom education, can a newly minted physician walk into an operating room and conduct surgery? No, they must enter a five to eight year residency where they learn the craft under a seasoned, attending surgeon. Similarly, cyber threat analysts learn best under a “master operator;” a recent college graduate simply cannot operate close to the same level as a seasoned pro. During my experience in the intelligence community, it took over a decade to develop a cadre of cyber threat analysts with the requisite skillsets.

Companies implementing any of the three principles outlined above will see a reduction in the severity of cyber attacks impacting their organizations. But those implementing all three will see the best results. 

Bob Stasio is currently a Senior Product Manager at IBM i2 Safer Planet. Prior to this role, Bob worked in the private sector standing up threat intelligence programs at Bloomberg and global financial firms. He accomplished these efforts as the owner of his own consulting ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DeeM743
50%
50%
DeeM743,
User Rank: Apprentice
4/29/2016 | 11:27:33 AM
Cyber Threat Response
I enjoyed this article. Most analysts do not posses all 3 crafts in their trade. Most will be strong in IA and processes but lack creativity and imagination when it comes to hunting, understanding and trapping a skilled exploiter or hacker, whichever one is defined in your realm. I find that most organizations suffer from hiring white hat minded operators out of fear that if they were to hire grey hat minded they risk their own property but then can't understand why they can't profile their attackers. Skilled threat intelligence analysts see the digital world as a battlefield and clearly understand the environment and excites themselves In understanding their adversary. These analysts are the ones that need to be at the front of the line for hiring, not your Master degree graduates with a major in computer science that have no clue of what the real digital battlespace is.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.