6 Steps for Sharing Threat Intelligence
Industry experts offer specific reasons to share threat information, why it's important - and how to get started.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt2e2fa229b55bac54/64f0d77815ed147fd7ad5e5b/Slide-1-CoverArt.jpg?width=700&auto=webp&quality=80&disable=upscale)
Threat information-sharing first started getting more attention and interest in the cybersecurity industry after the 9/11 terror attacks.
So you'd think by now it would be a routine process, especially with the volume of high-profile data breaches in the past few years. But while there has been much progress between the federal government and the vertical flavors of the Information Sharing Analysis Centers (ISACs), threat information-sharing still has been put on the back burner by many organizations.
"What's happened is that CISOs are so busy today that information sharing has become the kind of thing that they know will make them a better CISO, or at least a better person, but they put it off," says Paul Kurtz, founder and CEO of TruStar Technology. "They don't always recognize the benefits of information sharing."
[See Paul Kurtz discuss threat intelligence-sharing best practices at Dark Reading's INsecurity conference].
Kurtz says the key principles of threat information-sharing are:
1. Information sharing is not altruistic. The objective of data exchange is to identify problems more quickly and mitigate attacks faster. When an industry vertical shares common threat data and other companies in the field don't have to reinvent the wheel, everyone benefits.
2. Information sharing is also not about breach notification. Organizations need to share event data early in the security cycle – before an event happens – such as information about suspicious activity.
3. Sharing data with other organizations about exploits and vulnerabilities is legal so long as you don't share personally identifiable information. For example, a victim's email address is usually not shared. Typical types of information that are fair game include suspicious URLs, hash tags, and IP addresses. The Cybersecurity Information Sharing Act of 2015 provides more detail here.
4. The sharing system must be easy to use. Make sure the system is user-friendly and can easily integrate with your established workflow within a SOC, a hunting team, or a fraud investigation unit.
Greg Temm, chief information risk officer at the Financial Services Information Sharing and Analysis Center (FS-ISAC), cautions that organizations need to have patience with threat intel-sharing.
"Threat intelligence takes time," Temm says. "We might have lists of suspicious activity, but what we really want are the reasons why threat actors are making their attacks. What's really significant is whether the bad threat actors are working for a nation state, are cybercriminals in it for the money, or possibly hacktivists looking to make a political point. Getting to the bottom of that takes a combination of the shared data, analytics, and the threat intelligence tradecraft."
Neal Dennis, a senior ISAC analyst at the Retail Cyber Intelligence Sharing Center (R-CISC), says companies that don't know where to start or don't have deep pockets for security tools should contact their industry ISAC. "A lot of our members are smaller retail companies that don't have the resources of a Target or Home Depot, so it makes sense for them to seek of the retail ISAC for threat information and guidance on potential tools to deploy," Dennis says.
Here are some tips on how to get started with sharing threat intelligence.
Get your own house in order: Start by understanding the events within your four walls and how they correlate. You can't begin to share information with others until you have an understanding of what's going on inside your own organization. There are many tools out there today that can give you this picture of your event data. Some vendors in this space include TruStar Technology, which specializes in aggregating threat intelligence to share with other verticals and regional geographies, and threat intel providers Anomali and ThreatConnect.
Operationalize threat feeds from other providers with your event data. Make sure you can use what you are getting already, whether it's from CrowdStrike or one of the ISACs, be it the financial, aerospace, or retail sector. Often companies can't easily use external threat feeds from proprietary threat providers or sharing centers. Often they will get an email that lists 20 suspicious IP addresses, but they have no way to sift through all that information. When selecting a tool, ask if the tool can help with this process, because sifting through the listservs is very time consuming and a good way to burn out your security pros.
Now you're ready to exchange data with your peers in the industry and business partners. But be sure to select a system that returns immediate value by allowing you to see how your event data relates to others before you share. For example, if your event correlates with another company or industry ISAC, then move forward and share and get the benefit of what your peers also know about the threat. There's no incentive to share unless you know for sure that the threat is for real.
Select a system that allows you to join any number of sharing organizations or partnerships, while still protecting attribution as you see fit. Some events can be broadly shared, while others may require more special handling. The benefit to seeking out sharing arrangements with other verticals is that you may find common patterns in terms of bad URLs, IP addresses, or browser data.
It may benefit your organization to share information with the Department of Homeland Security's Automated Indicator Sharing (AIS) service. Over the past couple of years, DHS has worked to develop an ecosystem of partners that share threat intelligence information. AIS seeks to share this threat intelligence broadly across the public and private sector so organizations can more efficiently protect themselves against cyberattacks.
Small- and midsized companies simply don't have the money to pay for the more sophisticated threat intelligence feeds, and they probably can't afford to hire a threat hunter. Those organizations should work with their industry-specific ISACs to set up a low-cost threat intelligence system. Odds are, your industry ISAC will have contacts with vendors, and may even have special deals available for setting up relationships with companies that specialize in threat intelligence.
Small- and midsized companies simply don't have the money to pay for the more sophisticated threat intelligence feeds, and they probably can't afford to hire a threat hunter. Those organizations should work with their industry-specific ISACs to set up a low-cost threat intelligence system. Odds are, your industry ISAC will have contacts with vendors, and may even have special deals available for setting up relationships with companies that specialize in threat intelligence.
Threat information-sharing first started getting more attention and interest in the cybersecurity industry after the 9/11 terror attacks.
So you'd think by now it would be a routine process, especially with the volume of high-profile data breaches in the past few years. But while there has been much progress between the federal government and the vertical flavors of the Information Sharing Analysis Centers (ISACs), threat information-sharing still has been put on the back burner by many organizations.
"What's happened is that CISOs are so busy today that information sharing has become the kind of thing that they know will make them a better CISO, or at least a better person, but they put it off," says Paul Kurtz, founder and CEO of TruStar Technology. "They don't always recognize the benefits of information sharing."
[See Paul Kurtz discuss threat intelligence-sharing best practices at Dark Reading's INsecurity conference].
Kurtz says the key principles of threat information-sharing are:
1. Information sharing is not altruistic. The objective of data exchange is to identify problems more quickly and mitigate attacks faster. When an industry vertical shares common threat data and other companies in the field don't have to reinvent the wheel, everyone benefits.
2. Information sharing is also not about breach notification. Organizations need to share event data early in the security cycle – before an event happens – such as information about suspicious activity.
3. Sharing data with other organizations about exploits and vulnerabilities is legal so long as you don't share personally identifiable information. For example, a victim's email address is usually not shared. Typical types of information that are fair game include suspicious URLs, hash tags, and IP addresses. The Cybersecurity Information Sharing Act of 2015 provides more detail here.
4. The sharing system must be easy to use. Make sure the system is user-friendly and can easily integrate with your established workflow within a SOC, a hunting team, or a fraud investigation unit.
Greg Temm, chief information risk officer at the Financial Services Information Sharing and Analysis Center (FS-ISAC), cautions that organizations need to have patience with threat intel-sharing.
"Threat intelligence takes time," Temm says. "We might have lists of suspicious activity, but what we really want are the reasons why threat actors are making their attacks. What's really significant is whether the bad threat actors are working for a nation state, are cybercriminals in it for the money, or possibly hacktivists looking to make a political point. Getting to the bottom of that takes a combination of the shared data, analytics, and the threat intelligence tradecraft."
Neal Dennis, a senior ISAC analyst at the Retail Cyber Intelligence Sharing Center (R-CISC), says companies that don't know where to start or don't have deep pockets for security tools should contact their industry ISAC. "A lot of our members are smaller retail companies that don't have the resources of a Target or Home Depot, so it makes sense for them to seek of the retail ISAC for threat information and guidance on potential tools to deploy," Dennis says.
Here are some tips on how to get started with sharing threat intelligence.
About the Author(s)
You May Also Like
CISO Perspectives: How to make AI an Accelerator, Not a Blocker
August 20, 2024Securing Your Cloud Assets
August 27, 2024