Threat Intelligence

5/23/2018
10:30 AM
Chris McDaniels
Chris McDaniels
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Is Threat Intelligence Garbage?

Most security professionals in a recent survey said that threat intelligence doesn't work. So why all the hype?

Threat intelligence sounds like something security professionals should like — automation has a lot of potential. Artificial intelligence is increasingly making our lives more efficient, and technological solutions could help cybersecurity teams decrease the amount of mundane, repetitive tasks they need to perform on a daily basis.

In reality, however, most security professionals are not yet fans of threat intelligence. For example, the Ponemon Institute, an independent research group that studies information security and privacy, recently released a report about companies' attitudes toward threat intelligence. Seventy percent of the security industry professionals it surveyed said they believe threat intelligence is either too complex or cumbersome to provide usable insights.

Mahendra Ramsinghani, founder of cybersecurity seed fund Secure Octane, included threat intelligence among falsehoods professionals should ditch in a TechCrunch piece. Specifically, she mentions a Black Hat talk titled "Lies and Damn Lies," and provocatively writes that the presenters "spent five months digging into various endpoint offerings and concluded that threat intelligence simply does not work."

This may all come as a surprise to you, particularly if you follow the hype about threat intelligence. You may be wondering if giants like Google and Amazon are investing in threat intelligence-adjacent solutions, then why are so many cybersecurity professionals suspicious of these offerings?

Feeds vs. Platforms
Before we go further, let's understand the difference between a threat intelligence feed and a threat intelligence platform. Put simply, a threat intelligence feed is an ongoing, third-party stream of information, or "feed," about current or potential threats to a company in a particular category. As Recorded Future explains, a feed can solely focus on domains, hashes, or IPs known to be associated with malicious activity, for example. There are also six main sources of threat intelligence feeds, which are all valuable: open source, customer telemetry, honeypots and darknets, scanning and crawling, malware processing, and human intelligence.

There are several challenges to analyzing threat intelligence feeds. First, the reliability of each feed varies tremendously. Many feeds are open source and free, and, thus, not tailored to your company's needs. These need to be monitored heavily to ensure they are even worthwhile. Feeds coming from industries closer to yours will likely be more useful, but, not surprisingly, they are often expensive. Also, you are the only expert who knows exactly what information is applicable to your organization. So, as much as paid feeds may provide high-quality data, you will need to monitor their relevance closely. It might make sense to work closely with vendors in creating tailored feeds, though that is obviously an investment of time and money.

The other key obstacle with threat intelligence feeds is triaging so much information. For every threat intelligence feed you add, the more data you need to analyze, and the higher the chance you'll encounter false positives. Additionally, none of these feeds come with context, which is crucial in determining whether or not you should act upon their alerts.

Threat intelligence platforms are increasingly hailed as a solution to organize and make sense of various feeds. In a recent report, "Hype Cycle for Threat-Facing Technologies, 2017," Gartner's Greg Young writes that threat intelligence platforms "collect, correlate, categorize, share and integrate security threat data in real time to support the prioritization of actions and aid in attack prevention, detection and response. They also integrate with and complement existing security technologies and processes like SIEM, IPSs and firewalls." He asserts that current threat intelligence solutions are most useful for large, sophisticated cybersecurity outfits. However, he notes that threat intelligence is only moderately helpful compared with a string of approaches he deems to be highly beneficial. He prefers enterprise firewalls, operational technology software, and user and entity behavior analytics, among other solutions.

Although threat intelligence platforms would be a lovely silver bullet to the feed aggregation and insight problem, at this point most threat intelligence solutions — both feeds and platforms — fail to measure up. At some point, the higher-end products may be useful beyond large-scale companies. Until then, we recommend using feeds that are helpful and focusing on less sexy but beneficial ways to streamline your operations, such as hiring the right security professional to analyze your organization's unique needs.

Related Content:

Chris McDaniels is Chief Information Security Officer of Mosaic451, a cybersecurity service provider and consultancy with expertise in building, operating, and defending some of the most highly secure networks in North America. McDaniels is a US Air Force veteran with over 14 ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
richchetwynd
50%
50%
richchetwynd,
User Rank: Author
5/24/2018 | 4:35:08 PM
Bespoke threat intelligence has merit
I agree that it's difficult to find value in generic threat intelligence platforms. However there is value in combing both third party intelligence feeds and intelligence that is gathered from internal data sources to create a bespoke intelligence platform. Machine learning and database technologies are so easily accessible these days making custom solutions more viable for developers.
benmiller
100%
0%
benmiller,
User Rank: Apprentice
5/23/2018 | 11:38:33 AM
Threat intelligence Data vs. Threat Intelligence
Threat intelligence data is not finished threat intelligence. The mentions of "feeds" in this article would align more closely with the data that is needed to support a finished intelligence product. A long list of IPs, hashes, domain names, etc... provides very little value when it is not accompanied with a detailed analysis of the situation. This analysis is mentioned in the article and referred as "context". This analysis should result in information that is both actionable and timely and at the same time painting the picture of the threat.
6 Ways Greed Has a Negative Effect on Cybersecurity
Joshua Goldfarb, Co-founder & Chief Product Officer, IDRRA ,  6/11/2018
Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12026
PUBLISHED: 2018-06-17
During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in tur...
CVE-2018-12027
PUBLISHED: 2018-06-17
An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said ...
CVE-2018-12028
PUBLISHED: 2018-06-17
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an e...
CVE-2018-12029
PUBLISHED: 2018-06-17
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but befor...
CVE-2018-12071
PUBLISHED: 2018-06-17
A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.