Enabling Better Risk Mitigation with Threat Intelligence

To effectively respond to cyber threats these days you need to have a way to prioritize them. Data from your IDS, IPS, firewalls, routers and other internal hardware and software systems is critical to detecting threats on your network. But the sheer volume of alerts generated by these systems can make it very hard for your security team to separate the threats that are likely to cause most harm from the ones that are less severe.

Correlating external cyber threat intelligence with internal telemetry can help provide the context you need for prioritized responses. Indicators of compromise and other intelligence on threat campaigns, recent incidents, threat actors and their TTPs can help give you an idea of the threats that you should be most concerned about.

The data can also help you determine which of your assets are likely already compromised, or are in most danger, so you can put appropriate filters and mitigating controls in place to protect them. Such prioritization is vital at a time when cyberattacks are becoming increasingly targeted, persistent and pervasive.

The SANS Institute describes threat intelligence as "the process of understanding the threats to an organization based on available data points." Threat intelligence is not just about collecting data but also about understanding how to relates to your organization. "Teams must combine data points with contextual information to determine relevant threats to the business," says SANS.

A well-implemented threat intelligence capability can help improve your organization's situational awareness, threat responsiveness and ability to detect threats. Market research firm Markets & Markets estimates the market for threat intelligence services will top $8.9 billion by 2022 from around $3.8 billion in 2017.

Threat intelligence is available from a variety of sources and includes IOCs, malware hashes, listings of bad URLs and files, threat actor TTPs, incident reports, exploits and targets. You can get threat intelligence via free open source feeds, paid commercial services, from peer organizations, from sector-specific information sharing groups, even newsletters, emails and spreadsheets.

Implementation Challenges

In order to benefit from threat intelligence, you need to be able to operationalize it. That means you need to have systems and processes in place for consuming external threat intelligence and correlating it with data from your internal systems. You need to be then able to use the information to identify potential attacks and implement the fixes necessary for them enterprise wide. The whole thing must happen quickly, consistently and reliably each time you identify a relevant threat.

The quality of your threat intelligence is key as well. For an intelligence feed to be useful, it needs to be timely, relevant and most of all accurate. It should give you context about vulnerabilities, exploits and adversaries and how they relate to your organization.  A threat intelligence report should contain IOCs and other artifacts critical to identifying threats such as file-, app-, IP-and web-reputation. If you are consuming threat intelligence from multiple sources, as many organizations do, you need to be able to validate the data from the different feeds and weed out redundancies and inconsistencies.

Your internal telemetry is vital as well. External threat intelligence is of little use if you cannot map it to data from and about your internal systems. The massive data volumes and real-time nature of cyber threat intelligence also mean you require a security information and event management (SIEM) system or some other kind of automated capability for correlating external and internal data. 

Bringing all this together is a large undertaking. Considering that the security team is likely overworked dealing with day-to-day operational issues, you are going to be hard pressed finding the staff and the resources needed for a robust threat intelligence program. But you do not always need a dedicated internal team to implement the capability. Numerous third-party managed services are available these days that can help you collect, aggregate and correlate external threat intelligence with telemetry from your internal systems and then analyze the data so you can take action on it.

Administrators for instance can use the actionable information from these services to automatically apply security policies on key network gateways to protect against unfolding attacks. Threat intelligence platforms and services can help you quickly triage developing events and dramatically shorten threat detection and response times.

To learn more about linking security intelligence to policy enforcement to defend against advanced threats, click here.