Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

9/29/2015
12:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Why Many Organizations Still Don't Use Threat Intelligence Portals

New data shows definite interest in adopting threat intel offerings, but also concerns about costs, resources.

Threat intelligence is hot, but as a mainstream function for all organizations it is not.

A new survey by Osterman Research on behalf of DomainTools found that only half of organizations with an average of 20,000 employees that had experienced a data breach in the past 12 months use a threat intelligence portal.

Their main reasons for not employing threat intel services: 44% say the attacks they've experienced thus far haven't been "serious enough" to warrant using threat intel; 36% say threat intel is too expensive; 36% say it's "not a good fit" for them; and 24% say they can't get budget to pay for threat intel.

Even so, four out of five respondents in the survey said their organization would indeed use threat intel data if it was available to them. Some more advanced and feature-rich threat intel feeds can cost hundreds of thousands of dollars a year, but there also are free open-source feeds.

Some 82% say they would use threat intelligence data if they had the budget for it, the survey found. Even so, 15% say they don't want to share their threat intelligence information with other organizations.

"But a quarter of them don't know how [malware] got on their network, which is eye-opening," says Tim Chen, CEO of DomainTools, which recently rolled out a threat intel platform of its own. "More than 40 percent don't feel their breach was serious enough for threat intelligence: we find that to be a little scary. Sometimes the things that seem less worrisome become the most worrisome," Chen says of attacks.

But it may be more that most organizations don't even realize they are using at least some elements of threat intelligence. Ryan Olson, director of threat intelligence for Palo Alto Networks' Unit 42, says threat intel is actually relatively pervasive.

"Nearly every organization is probably using some source that would be considered threat intelligence--free and open-source, a SOC, etc.," Olson says. "It sort of scales up toward paid feeds and portals providing more analysis" within larger organizations, he says.

Palo Alto Networks earlier today announced the availability of its AutoFocus threat intel service, which ranges from $35,000 per user per year to $525,000 for an unlimited number of users per year. Both options are for one-, three- or five-year subscriptions.

DomainTools' new IRIS threat intel platform, meanwhile, starts just under $25,000 per year, depending on the number of users.

Threat intel-sharing has become the latest industry buzzword and service arena for security vendors. Most vendors offer some sort of feed providing information and indicators of compromise for the latest attacks and threats, and others are offering platforms for threat intel-sharing as well as cloud-based services.

The explosion began in February, when President Obama rolled out a new Cyber Threat Intelligence Integration Center aimed at supporting and providing a central repository for threat intelligence for government and private industry, and signed an Executive Order to promote sharing among private sector organizations as well as between the private and public sectors. Most of the major vertical markets now have their own intel-sharing groups via intelligence-sharing and analysis centers (ISACs) or information-sharing and analysis organizations (ISAOs). 

The ultimate goal is for companies and government to accrue and share attack intel quickly in order to prevent major breaches or to at least quell the damage. But most intel-sharing is still about ingesting the information provided by ISACs, ISAOs, or feeds.

recent study by the Enterprise Strategy Group (ESG) found that 37% of North American organizations share their intel regularly, while some 45% do so from time to time but not regularly. Of those organizations that currently don’t share intel, only 10% plan to do so in the next 12- to 24 months, 5% sometime in the future, and just 2% have no plans to do so.

Meanwhile, the Osterman/DomainTools survey also supports the conventional wisdom that most initial attack vectors originate from email and the Web -- 67% of the organizations report malware first hitting them via email and 63% via the Web. "But one-fourth don't know which vector the malware is getting in," notes Tim Helming, director of product management at DomainTools.

Some 12% say malware slipped in via cloud-based applications or social media, and 4% via instant messaging.

[New intelligence-sharing groups/ISACs emerge, software tools arrive and the White House adds a coordinating agency -- but not all of the necessary intel-sharing 'plumbing' is in place just yet. Read Efforts To Team Up And Fight Off Hackers Intensify.]

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
StephenNewmanCTO
50%
50%
StephenNewmanCTO,
User Rank: Author
10/2/2015 | 4:02:34 PM
Application of Theat Intelligence (TI)
TI is important, but if you don't have an effective way to use it then it does you no good. And just throwing it in a Siem or IDS doesn't cut it. You need a network monitoring system that can track and assess the behavior of a device with the TI.
AdamF854
0%
100%
AdamF854,
User Rank: Apprentice
9/30/2015 | 11:58:14 AM
The framework is available and has been for years...
Threatstream.com
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .