Threat Intelligence

5/23/2018
10:30 AM
Chris McDaniels
Chris McDaniels
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Is Threat Intelligence Garbage?

Most security professionals in a recent survey said that threat intelligence doesn't work. So why all the hype?

Threat intelligence sounds like something security professionals should like — automation has a lot of potential. Artificial intelligence is increasingly making our lives more efficient, and technological solutions could help cybersecurity teams decrease the amount of mundane, repetitive tasks they need to perform on a daily basis.

In reality, however, most security professionals are not yet fans of threat intelligence. For example, the Ponemon Institute, an independent research group that studies information security and privacy, recently released a report about companies' attitudes toward threat intelligence. Seventy percent of the security industry professionals it surveyed said they believe threat intelligence is either too complex or cumbersome to provide usable insights.

Mahendra Ramsinghani, founder of cybersecurity seed fund Secure Octane, included threat intelligence among falsehoods professionals should ditch in a TechCrunch piece. Specifically, she mentions a Black Hat talk titled "Lies and Damn Lies," and provocatively writes that the presenters "spent five months digging into various endpoint offerings and concluded that threat intelligence simply does not work."

This may all come as a surprise to you, particularly if you follow the hype about threat intelligence. You may be wondering if giants like Google and Amazon are investing in threat intelligence-adjacent solutions, then why are so many cybersecurity professionals suspicious of these offerings?

Feeds vs. Platforms
Before we go further, let's understand the difference between a threat intelligence feed and a threat intelligence platform. Put simply, a threat intelligence feed is an ongoing, third-party stream of information, or "feed," about current or potential threats to a company in a particular category. As Recorded Future explains, a feed can solely focus on domains, hashes, or IPs known to be associated with malicious activity, for example. There are also six main sources of threat intelligence feeds, which are all valuable: open source, customer telemetry, honeypots and darknets, scanning and crawling, malware processing, and human intelligence.

There are several challenges to analyzing threat intelligence feeds. First, the reliability of each feed varies tremendously. Many feeds are open source and free, and, thus, not tailored to your company's needs. These need to be monitored heavily to ensure they are even worthwhile. Feeds coming from industries closer to yours will likely be more useful, but, not surprisingly, they are often expensive. Also, you are the only expert who knows exactly what information is applicable to your organization. So, as much as paid feeds may provide high-quality data, you will need to monitor their relevance closely. It might make sense to work closely with vendors in creating tailored feeds, though that is obviously an investment of time and money.

The other key obstacle with threat intelligence feeds is triaging so much information. For every threat intelligence feed you add, the more data you need to analyze, and the higher the chance you'll encounter false positives. Additionally, none of these feeds come with context, which is crucial in determining whether or not you should act upon their alerts.

Threat intelligence platforms are increasingly hailed as a solution to organize and make sense of various feeds. In a recent report, "Hype Cycle for Threat-Facing Technologies, 2017," Gartner's Greg Young writes that threat intelligence platforms "collect, correlate, categorize, share and integrate security threat data in real time to support the prioritization of actions and aid in attack prevention, detection and response. They also integrate with and complement existing security technologies and processes like SIEM, IPSs and firewalls." He asserts that current threat intelligence solutions are most useful for large, sophisticated cybersecurity outfits. However, he notes that threat intelligence is only moderately helpful compared with a string of approaches he deems to be highly beneficial. He prefers enterprise firewalls, operational technology software, and user and entity behavior analytics, among other solutions.

Although threat intelligence platforms would be a lovely silver bullet to the feed aggregation and insight problem, at this point most threat intelligence solutions — both feeds and platforms — fail to measure up. At some point, the higher-end products may be useful beyond large-scale companies. Until then, we recommend using feeds that are helpful and focusing on less sexy but beneficial ways to streamline your operations, such as hiring the right security professional to analyze your organization's unique needs.

Related Content:

Chris McDaniels is Chief Information Security Officer of Mosaic451, a cybersecurity service provider and consultancy with expertise in building, operating, and defending some of the most highly secure networks in North America. McDaniels is a US Air Force veteran with over 14 ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
richchetwynd
50%
50%
richchetwynd,
User Rank: Author
5/24/2018 | 4:35:08 PM
Bespoke threat intelligence has merit
I agree that it's difficult to find value in generic threat intelligence platforms. However there is value in combing both third party intelligence feeds and intelligence that is gathered from internal data sources to create a bespoke intelligence platform. Machine learning and database technologies are so easily accessible these days making custom solutions more viable for developers.
benmiller
100%
0%
benmiller,
User Rank: Apprentice
5/23/2018 | 11:38:33 AM
Threat intelligence Data vs. Threat Intelligence
Threat intelligence data is not finished threat intelligence. The mentions of "feeds" in this article would align more closely with the data that is needed to support a finished intelligence product. A long list of IPs, hashes, domain names, etc... provides very little value when it is not accompanied with a detailed analysis of the situation. This analysis is mentioned in the article and referred as "context". This analysis should result in information that is both actionable and timely and at the same time painting the picture of the threat.
Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
Election Websites, Backend Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10510
PUBLISHED: 2018-08-15
A Directory Traversal Remote Code Execution vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to execute arbitrary code on vulnerable installations.
CVE-2018-10511
PUBLISHED: 2018-08-15
A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a server-side request forgery (SSRF) attack on vulnerable installations.
CVE-2018-10512
PUBLISHED: 2018-08-15
A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations, which may lead to a denial of server (DoS).
CVE-2018-8753
PUBLISHED: 2018-08-15
The IKEv1 implementation in Clavister cOS Core before 11.00.11, 11.20.xx before 11.20.06, and 12.00.xx before 12.00.09 allows remote attackers to decrypt RSA-encrypted nonces by leveraging a Bleichenbacher attack.
CVE-2018-9129
PUBLISHED: 2018-08-15
ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.