Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
2/23/2018
09:00 AM
Laurence Pitt
Laurence Pitt
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Enabling Better Risk Mitigation with Threat Intelligence

In order to get the maximum benefit from threat intel you need to be able to operationalize it. Here's how.

To effectively respond to cyber threats these days you need to have a way to prioritize them. Data from your IDS, IPS, firewalls, routers and other internal hardware and software systems is critical to detecting threats on your network. But the sheer volume of alerts generated by these systems can make it very hard for your security team to separate the threats that are likely to cause most harm from the ones that are less severe.

Correlating external cyber threat intelligence with internal telemetry can help provide the context you need for prioritized responses. Indicators of compromise and other intelligence on threat campaigns, recent incidents, threat actors and their TTPs can help give you an idea of the threats that you should be most concerned about.

The data can also help you determine which of your assets are likely already compromised, or are in most danger, so you can put appropriate filters and mitigating controls in place to protect them. Such prioritization is vital at a time when cyberattacks are becoming increasingly targeted, persistent and pervasive.

The SANS Institute describes threat intelligence as "the process of understanding the threats to an organization based on available data points." Threat intelligence is not just about collecting data but also about understanding how to relates to your organization. "Teams must combine data points with contextual information to determine relevant threats to the business," says SANS.

A well-implemented threat intelligence capability can help improve your organization's situational awareness, threat responsiveness and ability to detect threats. Market research firm Markets & Markets estimates the market for threat intelligence services will top $8.9 billion by 2022 from around $3.8 billion in 2017.

Threat intelligence is available from a variety of sources and includes IOCs, malware hashes, listings of bad URLs and files, threat actor TTPs, incident reports, exploits and targets. You can get threat intelligence via free open source feeds, paid commercial services, from peer organizations, from sector-specific information sharing groups, even newsletters, emails and spreadsheets.

Implementation Challenges

In order to benefit from threat intelligence, you need to be able to operationalize it. That means you need to have systems and processes in place for consuming external threat intelligence and correlating it with data from your internal systems. You need to be then able to use the information to identify potential attacks and implement the fixes necessary for them enterprise wide. The whole thing must happen quickly, consistently and reliably each time you identify a relevant threat.

The quality of your threat intelligence is key as well. For an intelligence feed to be useful, it needs to be timely, relevant and most of all accurate. It should give you context about vulnerabilities, exploits and adversaries and how they relate to your organization.  A threat intelligence report should contain IOCs and other artifacts critical to identifying threats such as file-, app-, IP-and web-reputation. If you are consuming threat intelligence from multiple sources, as many organizations do, you need to be able to validate the data from the different feeds and weed out redundancies and inconsistencies.

Your internal telemetry is vital as well. External threat intelligence is of little use if you cannot map it to data from and about your internal systems. The massive data volumes and real-time nature of cyber threat intelligence also mean you require a security information and event management (SIEM) system or some other kind of automated capability for correlating external and internal data. 

Bringing all this together is a large undertaking. Considering that the security team is likely overworked dealing with day-to-day operational issues, you are going to be hard pressed finding the staff and the resources needed for a robust threat intelligence program. But you do not always need a dedicated internal team to implement the capability. Numerous third-party managed services are available these days that can help you collect, aggregate and correlate external threat intelligence with telemetry from your internal systems and then analyze the data so you can take action on it.

Administrators for instance can use the actionable information from these services to automatically apply security policies on key network gateways to protect against unfolding attacks. Threat intelligence platforms and services can help you quickly triage developing events and dramatically shorten threat detection and response times.

To learn more about linking security intelligence to policy enforcement to defend against advanced threats, click here

Laurence Pitt is the Strategic Director for Security with Juniper Networks' marketing organization in EMEA. He has over twenty years' experience of cyber security, having started out in systems design and moved through product management in areas from endpoint security to ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14084
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell().
CVE-2018-14085
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. First, suppose that the owner adds the evil contract address to his sweepers. The evil contract looks like this: contract Exploit { uint public start; function swe...
CVE-2018-14086
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for SingaporeCoinOrigin (SCO), an Ethereum token. The contract has an integer overflow. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell(...
CVE-2018-14087
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for EUC (EUC), an Ethereum token. The contract has an integer overflow. If the owner sets the value of buyPrice to a large number in setPrices() then the "msg.value * buyPrice" will cause an integer overflow in the fallback functio...
CVE-2018-14088
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for STeX White List (STE(WL)), an Ethereum token. The contract has an integer overflow. If the owner sets the value of amount to a large number then the "amount * 1000000000000000" will cause an integer overflow in withdrawToFounde...