Partner Perspectives  Connecting marketers to our tech communities.
01:20 PM
Steve Hall
Steve Hall
Partner Perspectives
Connect Directly

How Much Threat Intelligence Is Too Much?

Turn your threat data into actionable intelligence by focusing on what is relevant to you and your organization.

 “The definition of insanity is to do the same thing over and over and expect different results.”
– Albert Einstein

I believe there is a misconception in the security industry that if you add more threat intelligence, you’ll better protect your organization. As an industry, we have more and more data each day to comb through. All of this data is not actionable or intelligent without the ability to put context to it. Therefore, one approach that most organizations deploy for better context is to subscribe to various threat intelligence feeds to provide an early warning system of potential indicators of compromise (IoCs) in their environment. However, with a limited amount of money to pay for threat feeds and a finite amount of time and resources to analyze the data, just how much intelligence is too much?

What exactly do we mean by threat intelligence?

“Evidence-based knowledge, including context, mechanisms, indicators, implications, and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.” – Gartner Research

In order for a threat to exist, there must be a combination of intent, capability, and opportunity. Without these three factors, the risk an organization faces isn’t critical at that time:

  • Intent is a malicious actor’s desire to target your organization
  • Capability is an actor’s means to do so (such as specific types of malware or exploit kits)
  • Opportunity is the opening the actor needs (such as vulnerabilities, whether they be in software, hardware, or personnel)


Threat intelligence is analyzed information about the intent, opportunity, and capability of malicious actors. As an example, if an actor has the intent and capability but the organization is not vulnerable or there is no opportunity present, then the actor is simply not a threat. This basic understanding is extremely important with regard to threat intelligence.

If the organization that is receiving threat intelligence does not know how to identify what information is applicable to them, the threat intelligence will be mostly useless. At some point, someone has to make the decision on whether the intelligence is applicable. The bottom line is if no one is tailoring threat intelligence in context of your business, it is just a mass of data.

Do we have too much threat intelligence?

At first blush, the answer is obviously no. Breaches and attacks have never been more pervasive, and more intelligence is available every day. But is it really helping? Verizon’s 2015 Data Breach Investigations Report reveals that cyberattacks are becoming increasingly sophisticated but that many criminals still rely on decades-old techniques such as phishing and hacking. Additionally, this year’s findings again pointed out what Verizon researchers call the “detection deficit” -- the time that elapses between a breach occurring and its being discovered. Sadly, in 60% of breaches, attackers are able to compromise an organization within minutes.

But on second thought, shouldn’t we be improving on all this? We have all this intelligence at our fingertips, yet the attackers continue to find ways to compromise our sensitive data and intellectual property. Perhaps we’ve hit a tipping point, and we actually have too much intelligence and not enough context.

Defense is actually difficult when there are countless threats out there. However, by focusing on understanding your assets, infrastructure, users, and business operations, you can only then begin to understand if the threat du jour presents an opportunity to malicious actors.

If you want to get ahead of the threats and turn your security intelligence hub into something meaningful for your organization, remember these four things:

  1. Tools do not provide intelligence. Data feeds do not give threat intelligence. There are no “intelligent” data feeds. Intelligence of any type requires analysis. Analysis is performed by humans. Automation, analytics, and various tools can drastically increase the effectiveness of analysts, but there must always be analysts involved in the process.
  2. Leverage defined standards such as STIX/TAXII and OpenIOC to receive and share threat data. Specific industries can often get help receiving and sharing threat data through Information Sharing and Analysis Centers (ISACs). Especially for larger organizations, ISACs are a great starting point for identifying threats to specific industries.
  3. Identify what is relevant. No matter how much access you have to intelligence, it will be nearly worthless without your ability to identify what is applicable to you or your organization. Knowing your organization -- from the business processes to the assets and services on the network -- is required.
  4. Start with the basics. The basics of security eliminate countless threats to organizations. When the basics are accomplished, more advanced processes such as threat intelligence give value and help organizations identify, mitigate, and respond to advanced adversaries. Securing your network in the first place can help reduce your exposure and offer a better path to identifying threat feeds that you really need.

You can’t expect to have total assurance across today’s threat landscape if you continue to play by yesterday’s rules. Threat is often an abused term, but so is intelligence. Too much threat data and not enough intelligence with business context is a recipe for failure. Turn your threat data into actionable intelligence by focusing on what is relevant to you and your organization. Most importantly, be sure to deploy a strong approach toward the security basics and a critical eye to discern hype from fact. Doing so can make threat-based intelligence extremely powerful for any organization. 

Steve Hall is responsible for setting the vision, developing the strategy and laying the foundation for Tenable product offerings, in partnership with our product teams. Prior to joining Tenable, Steve served as the Chief Marketing Officer at ScriptRock, a configuration ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Tenable Network Security provides continuous network monitoring to identify vulnerabilities, reduce risk and ensure compliance. Its family of products includes SecurityCenter Continuous View™, which provides the most comprehensive and integrated view of network health, and Nessus®, the global standard in detecting and assessing network data. Tenable identifies all types of risk on the network — including missing patches, malware and intruders, missing configurations and missing monitoring — so customers can make informed decisions about where they are exposed. Its products reach across cloud, virtual, mobile and traditional IT systems and measure attack vectors in each of these domains. Tenable’s continuous network monitoring solution measures organizations’ compliance in real-time. This ensures that gaps in security coverage and lapses in security programs get detected and prioritized immediately. Tenable is relied upon by many of the world’s largest corporations, not-for-profit organizations and public sector agencies, including the entire U.S. Department of Defense.
Featured Writers
White Papers
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 a...
PUBLISHED: 2018-08-18
A vulnerability in the lservnt.exe component of Sentinel License Manager version (fixed in causes UDP amplification.
PUBLISHED: 2018-08-18
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
PUBLISHED: 2018-08-18
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.