Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
2/23/2018
09:00 AM
Laurence Pitt
Laurence Pitt
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Enabling Better Risk Mitigation with Threat Intelligence

In order to get the maximum benefit from threat intel you need to be able to operationalize it. Here's how.

To effectively respond to cyber threats these days you need to have a way to prioritize them. Data from your IDS, IPS, firewalls, routers and other internal hardware and software systems is critical to detecting threats on your network. But the sheer volume of alerts generated by these systems can make it very hard for your security team to separate the threats that are likely to cause most harm from the ones that are less severe.

Correlating external cyber threat intelligence with internal telemetry can help provide the context you need for prioritized responses. Indicators of compromise and other intelligence on threat campaigns, recent incidents, threat actors and their TTPs can help give you an idea of the threats that you should be most concerned about.

The data can also help you determine which of your assets are likely already compromised, or are in most danger, so you can put appropriate filters and mitigating controls in place to protect them. Such prioritization is vital at a time when cyberattacks are becoming increasingly targeted, persistent and pervasive.

The SANS Institute describes threat intelligence as "the process of understanding the threats to an organization based on available data points." Threat intelligence is not just about collecting data but also about understanding how to relates to your organization. "Teams must combine data points with contextual information to determine relevant threats to the business," says SANS.

A well-implemented threat intelligence capability can help improve your organization's situational awareness, threat responsiveness and ability to detect threats. Market research firm Markets & Markets estimates the market for threat intelligence services will top $8.9 billion by 2022 from around $3.8 billion in 2017.

Threat intelligence is available from a variety of sources and includes IOCs, malware hashes, listings of bad URLs and files, threat actor TTPs, incident reports, exploits and targets. You can get threat intelligence via free open source feeds, paid commercial services, from peer organizations, from sector-specific information sharing groups, even newsletters, emails and spreadsheets.

Implementation Challenges

In order to benefit from threat intelligence, you need to be able to operationalize it. That means you need to have systems and processes in place for consuming external threat intelligence and correlating it with data from your internal systems. You need to be then able to use the information to identify potential attacks and implement the fixes necessary for them enterprise wide. The whole thing must happen quickly, consistently and reliably each time you identify a relevant threat.

The quality of your threat intelligence is key as well. For an intelligence feed to be useful, it needs to be timely, relevant and most of all accurate. It should give you context about vulnerabilities, exploits and adversaries and how they relate to your organization.  A threat intelligence report should contain IOCs and other artifacts critical to identifying threats such as file-, app-, IP-and web-reputation. If you are consuming threat intelligence from multiple sources, as many organizations do, you need to be able to validate the data from the different feeds and weed out redundancies and inconsistencies.

Your internal telemetry is vital as well. External threat intelligence is of little use if you cannot map it to data from and about your internal systems. The massive data volumes and real-time nature of cyber threat intelligence also mean you require a security information and event management (SIEM) system or some other kind of automated capability for correlating external and internal data. 

Bringing all this together is a large undertaking. Considering that the security team is likely overworked dealing with day-to-day operational issues, you are going to be hard pressed finding the staff and the resources needed for a robust threat intelligence program. But you do not always need a dedicated internal team to implement the capability. Numerous third-party managed services are available these days that can help you collect, aggregate and correlate external threat intelligence with telemetry from your internal systems and then analyze the data so you can take action on it.

Administrators for instance can use the actionable information from these services to automatically apply security policies on key network gateways to protect against unfolding attacks. Threat intelligence platforms and services can help you quickly triage developing events and dramatically shorten threat detection and response times.

To learn more about linking security intelligence to policy enforcement to defend against advanced threats, click here

Laurence Pitt is the Strategic Director for Security with Juniper Networks' marketing organization in EMEA. He has over twenty years' experience of cyber security, having started out in systems design and moved through product management in areas from endpoint security to ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19797
PUBLISHED: 2019-12-15
read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write.
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.