Advice from a former SOC manager on how to leverage threat intel without increasing the bottom line.

Ryan Trost, CIO & Co-founder, ThreatQuotient

July 22, 2015

4 Min Read

During my time managing a security operations center at one of the largest defense contractors, executives would constantly scrutinize security budgets, focusing on the areas of security architecture that could be streamlined. The process typically would lead to one burning question: how can security teams leverage threat intelligence to increase ROI without adding headcount or doubling the bottom line? My answer involved five key steps:

Step 1. Develop Key Performance Indicators (KPI)
Every successful security program needs metrics and KPI’s to measure against and report back to their organization. To implement a successful KPI program for threat intel intake, you’ll need to:

  • Deconstruct the team’s mission statement and map KPIs to the key elements (admittedly this is easier said than done but builds a critical foundation).

  • Decide which threats are really affecting your organization and which you can ignore. Cutting through the noise will save your security analysts time.

  • Evaluate each provider and decide which are providing you with solid, fast, and reliable information that you can map back to each quarter.

Step 2. Continually evaluate and reassess threat intelligence providers
There are no silver bullets in the cybersecurity industry and the same is true in the world of threat intelligence. If you’re looking for a one-size-fits-all approach, you’re viewing the problem in the wrong way. Here are the questions you need to address:  

  • Is there overlap among threat intelligence vendors and communities?

  • Which sources cater to your defensive tools?  (If a provider hands you 6 million malicious IP addresses do you have the tools to operationalize them?)

  • Which threat feeds are complimentary?

  • Which providers distribute intelligence that overlaps with attacks your team has investigated?

Step 3. Prioritize alerts to efficiently utilizing security analysts’ time
Instead of seeking out the latest and greatest technologies to add to a roster of network protections, enterprises should identify new ways to effectively leverage the tools they already have. The security information and event management tool is the perfect example. It correlates trillions of events creating alerts, but analysts become submerged by the sheer number because there is little to no true prioritization. However, if teams efficiently integrate threat intelligence feeds with their SIEM, analysts could significantly improve alert prioritization and jumpstart analyst triage investigations.

Skilled analysts are in short supply and high-demand! It can take a massive amount of resources to find, hire, and retain a qualified security analyst. Worse, and one major downfall I’ve frequently observed, is the misuse of security analysts’ time and expertise. Organizations have the tools to properly defend the organization but their analysts are stuck performing manual tasks rather than focusing on bigger picture solutions and processes.

Step 4. Foster collaboration between ALL analyst teams
Too often analysts sitting shoulder-to-shoulder (let alone across the room or building) don’t effectively collaborate on indicators, malware techniques, victimology, etc. And no, the answer isn’t having another daily standup meeting. Instead, make it easier for security analysts, intelligence analysts, malware analysts, incident responders, and signature/content engineers to talk to each other across geographic locations through tools like HipChat, Sococo, or Skype, and coordinate semi-annually onsite meetings to build relationships. Similarly, encourage analysts to collaborate with peers within like-minded communities outside of the organization.  Join local security cohorts rather than wait for RSA and Black Hat every year to share threat intelligence over a few beers.

Step 5. Pilot threat intelligence providers before buying
Many organizations pull the trigger on selecting a provider after reading two or three sample intelligence or malware reports -- the provider’s “golden child” of reports. But that isn’t a good day-to-day representation of what the providers’ publish. I recommend asking for a 30-day evaluation period where you can evaluate:

  • When the threat information is released and figure out which time is most efficient for your organization;

  • How valuable are the reports in relation to industry threats and are they relevant to your organization;

  • The volume of data published and whether the data is easy to consume and push out to your security infrastructure;

  • If the threat feed helps cut down on security analysts’ time and ability to consume the information.

At the end of the day, you need to choose a provider that you and your organization trust. If there isn’t mutual trust at the beginning of an engagement, the relationship will be rocky forever.

About the Author(s)

Ryan Trost

CIO & Co-founder, ThreatQuotient

Ryan Trost is the CIO and co-founder of ThreatQuotient. Prior to ThreatQuotient, Ryan was Senior Director, Cyber Intelligence Solutions Architect at SRA International and SOC Manager at General Dynamics, where he led the information technology and security teams. Ryan is an adjunct professor at Northern Virginia Community College where he teaches ethical hacking, IDS/firewalls, and network visualization. Ryan has two books published on threat intelligence and has spoken at numerous industry conferences including DefCon, BlackHat, Interop, and more. Ryan received his B.S. in business management from York College of Pennsylvania and his M.S. in computer science from The George Washington University. Ryan also received his CRISC certification from ISACA and his CISSP certification from (ISC)2.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights