Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
2/23/2018
09:00 AM
Laurence Pitt
Laurence Pitt
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Enabling Better Risk Mitigation with Threat Intelligence

In order to get the maximum benefit from threat intel you need to be able to operationalize it. Here's how.

To effectively respond to cyber threats these days you need to have a way to prioritize them. Data from your IDS, IPS, firewalls, routers and other internal hardware and software systems is critical to detecting threats on your network. But the sheer volume of alerts generated by these systems can make it very hard for your security team to separate the threats that are likely to cause most harm from the ones that are less severe.

Correlating external cyber threat intelligence with internal telemetry can help provide the context you need for prioritized responses. Indicators of compromise and other intelligence on threat campaigns, recent incidents, threat actors and their TTPs can help give you an idea of the threats that you should be most concerned about.

The data can also help you determine which of your assets are likely already compromised, or are in most danger, so you can put appropriate filters and mitigating controls in place to protect them. Such prioritization is vital at a time when cyberattacks are becoming increasingly targeted, persistent and pervasive.

The SANS Institute describes threat intelligence as "the process of understanding the threats to an organization based on available data points." Threat intelligence is not just about collecting data but also about understanding how to relates to your organization. "Teams must combine data points with contextual information to determine relevant threats to the business," says SANS.

A well-implemented threat intelligence capability can help improve your organization's situational awareness, threat responsiveness and ability to detect threats. Market research firm Markets & Markets estimates the market for threat intelligence services will top $8.9 billion by 2022 from around $3.8 billion in 2017.

Threat intelligence is available from a variety of sources and includes IOCs, malware hashes, listings of bad URLs and files, threat actor TTPs, incident reports, exploits and targets. You can get threat intelligence via free open source feeds, paid commercial services, from peer organizations, from sector-specific information sharing groups, even newsletters, emails and spreadsheets.

Implementation Challenges

In order to benefit from threat intelligence, you need to be able to operationalize it. That means you need to have systems and processes in place for consuming external threat intelligence and correlating it with data from your internal systems. You need to be then able to use the information to identify potential attacks and implement the fixes necessary for them enterprise wide. The whole thing must happen quickly, consistently and reliably each time you identify a relevant threat.

The quality of your threat intelligence is key as well. For an intelligence feed to be useful, it needs to be timely, relevant and most of all accurate. It should give you context about vulnerabilities, exploits and adversaries and how they relate to your organization.  A threat intelligence report should contain IOCs and other artifacts critical to identifying threats such as file-, app-, IP-and web-reputation. If you are consuming threat intelligence from multiple sources, as many organizations do, you need to be able to validate the data from the different feeds and weed out redundancies and inconsistencies.

Your internal telemetry is vital as well. External threat intelligence is of little use if you cannot map it to data from and about your internal systems. The massive data volumes and real-time nature of cyber threat intelligence also mean you require a security information and event management (SIEM) system or some other kind of automated capability for correlating external and internal data. 

Bringing all this together is a large undertaking. Considering that the security team is likely overworked dealing with day-to-day operational issues, you are going to be hard pressed finding the staff and the resources needed for a robust threat intelligence program. But you do not always need a dedicated internal team to implement the capability. Numerous third-party managed services are available these days that can help you collect, aggregate and correlate external threat intelligence with telemetry from your internal systems and then analyze the data so you can take action on it.

Administrators for instance can use the actionable information from these services to automatically apply security policies on key network gateways to protect against unfolding attacks. Threat intelligence platforms and services can help you quickly triage developing events and dramatically shorten threat detection and response times.

To learn more about linking security intelligence to policy enforcement to defend against advanced threats, click here

Laurence Pitt is the Strategic Director for Security with Juniper Networks' marketing organization in EMEA. He has over twenty years' experience of cyber security, having started out in systems design and moved through product management in areas from endpoint security to ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .