Careers & People

2/4/2016
10:30 AM
Bob G. Stasio
Bob G. Stasio
Commentary
100%
0%

New Kid On The Block: Cyber Threat Analyst

Drawing from the financial service industry, this new role uses the "art of the intelligence cycle" to drive efficiency in the security operations center.

With the rapid rise, frequency, severity and cost of cyber attacks, many companies today are looking to the government military intelligence industry for the skills, talent and experience to run their security operations center.

Leaders in the financial markets were the first to realize that an SOC driven by intelligence could be a force multiplier in achieving operational efficiency and effectiveness. Early adopters such as JPMorgan Chase & Co. used this expertise to restructure personnel into new tiers with new priorities and job functions. One of the newest roles to emerge from this shift is that of the cyber threat analyst. 

What is the exact role of the cyber threat analyst and how does the analyst’s work help prevent attackers from stealing critical data or causing other harm to a business? What the cyber threat analyst brings to the table is the “art of the intelligence cycle.” This is where information is directed, collected, processed, analyzed, produced, and disseminated.

For example, in an organization where I once worked as a cyber analyst, my team was tasked with finding a better way to identify insider threats within the company. First, I identified the relevant sources of data by which could identify insider threats, in this case, badge logs, web proxy traffic, and print logs. Then I began determining the patterns likely to be associated with malicious activity. These patterns allowed me to narrow down potential suspects to only .0001% of the employee pool.

After we disseminated our report, others on the security operations team became much more effective in monitoring insider threats. Intelligence truly began to drive operations – which was the optimal outcome.

Worth the effort
Building the capability of cyber threat analysis is a challenging endeavor that will yield tangible results – but it takes time and discipline. Here are three key principles for developing a successful cadre of analysts:

  1. The rule of three. Cyber threat analysis is composed of three distinct skillsets, and very rarely will one individual maintain all three. To properly learn cyber threat analysis, an analyst must learn information security (e.g. network defense, information assurance), intelligence analysis (e.g. the mastery of the intelligence cycle), and forensic science (e.g. investigations, evidence handling, discovery). It is essential to recruit individuals strong in one or two of these areas and also facilitate a training program to compliment skillsets. 
  2. Intelligence is a journey, not a destination. Building an intelligence program is an iterative process. The maturation of the program should be laid out in a phased approach, where simple “quick wins” can be achieved early on in the process. For example, a four-phased approach would include: ad hoc analysis, integration of non-traditional data into security analysis, increasing speed of searches in addition to higher tier threats, and finally, continuous feeds of real-time data and automated detection analytics.
  3. Knowledge is cumulative and must be nurtured over time. Cyber threat analysis is like many other professions where practice is necessary to continue learning the craft. Consider a surgeon: after eight full years of classroom education, can a newly minted physician walk into an operating room and conduct surgery? No, they must enter a five to eight year residency where they learn the craft under a seasoned, attending surgeon. Similarly, cyber threat analysts learn best under a “master operator;” a recent college graduate simply cannot operate close to the same level as a seasoned pro. During my experience in the intelligence community, it took over a decade to develop a cadre of cyber threat analysts with the requisite skillsets.

Companies implementing any of the three principles outlined above will see a reduction in the severity of cyber attacks impacting their organizations. But those implementing all three will see the best results. 

Bob Stasio is currently a Senior Product Manager at IBM i2 Safer Planet. Prior to this role, Bob worked in the private sector standing up threat intelligence programs at Bloomberg and global financial firms. He accomplished these efforts as the owner of his own consulting ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DeeM743
50%
50%
DeeM743,
User Rank: Apprentice
4/29/2016 | 11:27:33 AM
Cyber Threat Response
I enjoyed this article. Most analysts do not posses all 3 crafts in their trade. Most will be strong in IA and processes but lack creativity and imagination when it comes to hunting, understanding and trapping a skilled exploiter or hacker, whichever one is defined in your realm. I find that most organizations suffer from hiring white hat minded operators out of fear that if they were to hire grey hat minded they risk their own property but then can't understand why they can't profile their attackers. Skilled threat intelligence analysts see the digital world as a battlefield and clearly understand the environment and excites themselves In understanding their adversary. These analysts are the ones that need to be at the front of the line for hiring, not your Master degree graduates with a major in computer science that have no clue of what the real digital battlespace is.
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Empathy: The Next Killer App for Cybersecurity?
Shay Colson, CISSP, Senior Manager, CyberClarity360,  11/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18805
PUBLISHED: 2018-11-16
PointOfSales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb.
CVE-2018-18806
PUBLISHED: 2018-11-16
School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb.
CVE-2018-16396
PUBLISHED: 2018-11-16
An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.
CVE-2018-18755
PUBLISHED: 2018-11-16
K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user_group_id parameter or the admin/user/user/update user_id parameter.
CVE-2018-18756
PUBLISHED: 2018-11-16
Local Server 1.0.9 has a Buffer Overflow via crafted data on Port 4008.