Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

7/22/2015
10:30 AM
Ryan Trost
Ryan Trost
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Finding The ROI Of Threat Intelligence: 5 Steps

Advice from a former SOC manager on how to leverage threat intel without increasing the bottom line.

During my time managing a security operations center at one of the largest defense contractors, executives would constantly scrutinize security budgets, focusing on the areas of security architecture that could be streamlined. The process typically would lead to one burning question: how can security teams leverage threat intelligence to increase ROI without adding headcount or doubling the bottom line? My answer involved five key steps:

Step 1. Develop Key Performance Indicators (KPI)
Every successful security program needs metrics and KPI’s to measure against and report back to their organization. To implement a successful KPI program for threat intel intake, you’ll need to:

  • Deconstruct the team’s mission statement and map KPIs to the key elements (admittedly this is easier said than done but builds a critical foundation).
  • Decide which threats are really affecting your organization and which you can ignore. Cutting through the noise will save your security analysts time.
  • Evaluate each provider and decide which are providing you with solid, fast, and reliable information that you can map back to each quarter.

Step 2. Continually evaluate and reassess threat intelligence providers
There are no silver bullets in the cybersecurity industry and the same is true in the world of threat intelligence. If you’re looking for a one-size-fits-all approach, you’re viewing the problem in the wrong way. Here are the questions you need to address:  

  • Is there overlap among threat intelligence vendors and communities?
  • Which sources cater to your defensive tools?  (If a provider hands you 6 million malicious IP addresses do you have the tools to operationalize them?)
  • Which threat feeds are complimentary?
  • Which providers distribute intelligence that overlaps with attacks your team has investigated?

Step 3. Prioritize alerts to efficiently utilizing security analysts’ time
Instead of seeking out the latest and greatest technologies to add to a roster of network protections, enterprises should identify new ways to effectively leverage the tools they already have. The security information and event management tool is the perfect example. It correlates trillions of events creating alerts, but analysts become submerged by the sheer number because there is little to no true prioritization. However, if teams efficiently integrate threat intelligence feeds with their SIEM, analysts could significantly improve alert prioritization and jumpstart analyst triage investigations.

Skilled analysts are in short supply and high-demand! It can take a massive amount of resources to find, hire, and retain a qualified security analyst. Worse, and one major downfall I’ve frequently observed, is the misuse of security analysts’ time and expertise. Organizations have the tools to properly defend the organization but their analysts are stuck performing manual tasks rather than focusing on bigger picture solutions and processes.

Step 4. Foster collaboration between ALL analyst teams
Too often analysts sitting shoulder-to-shoulder (let alone across the room or building) don’t effectively collaborate on indicators, malware techniques, victimology, etc. And no, the answer isn’t having another daily standup meeting. Instead, make it easier for security analysts, intelligence analysts, malware analysts, incident responders, and signature/content engineers to talk to each other across geographic locations through tools like HipChat, Sococo, or Skype, and coordinate semi-annually onsite meetings to build relationships. Similarly, encourage analysts to collaborate with peers within like-minded communities outside of the organization.  Join local security cohorts rather than wait for RSA and Black Hat every year to share threat intelligence over a few beers.

Step 5. Pilot threat intelligence providers before buying
Many organizations pull the trigger on selecting a provider after reading two or three sample intelligence or malware reports -- the provider’s “golden child” of reports. But that isn’t a good day-to-day representation of what the providers’ publish. I recommend asking for a 30-day evaluation period where you can evaluate:

  • When the threat information is released and figure out which time is most efficient for your organization;
  • How valuable are the reports in relation to industry threats and are they relevant to your organization;
  • The volume of data published and whether the data is easy to consume and push out to your security infrastructure;
  • If the threat feed helps cut down on security analysts’ time and ability to consume the information.

At the end of the day, you need to choose a provider that you and your organization trust. If there isn’t mutual trust at the beginning of an engagement, the relationship will be rocky forever.

Ryan Trost is the CIO and co-founder of ThreatQuotient. Prior to ThreatQuotient, Ryan was Senior Director, Cyber Intelligence Solutions Architect at SRA International and SOC Manager at General Dynamics, where he led the information technology and security teams. Ryan is an ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JulienOrmidal
100%
0%
JulienOrmidal,
User Rank: Apprentice
7/30/2015 | 4:45:56 PM
Analytics
Hi,

Thats a really interesting article. For me it would be more than 5 steps but you did a good resume of how it is hard to really prioritize and deal with analytics issues. For me thats the real challenge for companies and government to deal with Big Data and analytics for the next 10 years atleast...

Julien
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31414
PUBLISHED: 2021-04-16
The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.
CVE-2021-26073
PUBLISHED: 2021-04-16
Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or ...
CVE-2021-26074
PUBLISHED: 2021-04-16
Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a se...
CVE-2018-19942
PUBLISHED: 2021-04-16
A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QT...
CVE-2021-27691
PUBLISHED: 2021-04-16
Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request...