Threat Intelligence

5/23/2018
10:30 AM
Chris McDaniels
Chris McDaniels
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Is Threat Intelligence Garbage?

Most security professionals in a recent survey said that threat intelligence doesn't work. So why all the hype?

Threat intelligence sounds like something security professionals should like — automation has a lot of potential. Artificial intelligence is increasingly making our lives more efficient, and technological solutions could help cybersecurity teams decrease the amount of mundane, repetitive tasks they need to perform on a daily basis.

In reality, however, most security professionals are not yet fans of threat intelligence. For example, the Ponemon Institute, an independent research group that studies information security and privacy, recently released a report about companies' attitudes toward threat intelligence. Seventy percent of the security industry professionals it surveyed said they believe threat intelligence is either too complex or cumbersome to provide usable insights.

Mahendra Ramsinghani, founder of cybersecurity seed fund Secure Octane, included threat intelligence among falsehoods professionals should ditch in a TechCrunch piece. Specifically, she mentions a Black Hat talk titled "Lies and Damn Lies," and provocatively writes that the presenters "spent five months digging into various endpoint offerings and concluded that threat intelligence simply does not work."

This may all come as a surprise to you, particularly if you follow the hype about threat intelligence. You may be wondering if giants like Google and Amazon are investing in threat intelligence-adjacent solutions, then why are so many cybersecurity professionals suspicious of these offerings?

Feeds vs. Platforms
Before we go further, let's understand the difference between a threat intelligence feed and a threat intelligence platform. Put simply, a threat intelligence feed is an ongoing, third-party stream of information, or "feed," about current or potential threats to a company in a particular category. As Recorded Future explains, a feed can solely focus on domains, hashes, or IPs known to be associated with malicious activity, for example. There are also six main sources of threat intelligence feeds, which are all valuable: open source, customer telemetry, honeypots and darknets, scanning and crawling, malware processing, and human intelligence.

There are several challenges to analyzing threat intelligence feeds. First, the reliability of each feed varies tremendously. Many feeds are open source and free, and, thus, not tailored to your company's needs. These need to be monitored heavily to ensure they are even worthwhile. Feeds coming from industries closer to yours will likely be more useful, but, not surprisingly, they are often expensive. Also, you are the only expert who knows exactly what information is applicable to your organization. So, as much as paid feeds may provide high-quality data, you will need to monitor their relevance closely. It might make sense to work closely with vendors in creating tailored feeds, though that is obviously an investment of time and money.

The other key obstacle with threat intelligence feeds is triaging so much information. For every threat intelligence feed you add, the more data you need to analyze, and the higher the chance you'll encounter false positives. Additionally, none of these feeds come with context, which is crucial in determining whether or not you should act upon their alerts.

Threat intelligence platforms are increasingly hailed as a solution to organize and make sense of various feeds. In a recent report, "Hype Cycle for Threat-Facing Technologies, 2017," Gartner's Greg Young writes that threat intelligence platforms "collect, correlate, categorize, share and integrate security threat data in real time to support the prioritization of actions and aid in attack prevention, detection and response. They also integrate with and complement existing security technologies and processes like SIEM, IPSs and firewalls." He asserts that current threat intelligence solutions are most useful for large, sophisticated cybersecurity outfits. However, he notes that threat intelligence is only moderately helpful compared with a string of approaches he deems to be highly beneficial. He prefers enterprise firewalls, operational technology software, and user and entity behavior analytics, among other solutions.

Although threat intelligence platforms would be a lovely silver bullet to the feed aggregation and insight problem, at this point most threat intelligence solutions — both feeds and platforms — fail to measure up. At some point, the higher-end products may be useful beyond large-scale companies. Until then, we recommend using feeds that are helpful and focusing on less sexy but beneficial ways to streamline your operations, such as hiring the right security professional to analyze your organization's unique needs.

Related Content:

Chris McDaniels is Chief Information Security Officer of Mosaic451, a cybersecurity service provider and consultancy with expertise in building, operating, and defending some of the most highly secure networks in North America. McDaniels is a US Air Force veteran with over 14 ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
richchetwynd
50%
50%
richchetwynd,
User Rank: Author
5/24/2018 | 4:35:08 PM
Bespoke threat intelligence has merit
I agree that it's difficult to find value in generic threat intelligence platforms. However there is value in combing both third party intelligence feeds and intelligence that is gathered from internal data sources to create a bespoke intelligence platform. Machine learning and database technologies are so easily accessible these days making custom solutions more viable for developers.
benmiller
100%
0%
benmiller,
User Rank: Apprentice
5/23/2018 | 11:38:33 AM
Threat intelligence Data vs. Threat Intelligence
Threat intelligence data is not finished threat intelligence. The mentions of "feeds" in this article would align more closely with the data that is needed to support a finished intelligence product. A long list of IPs, hashes, domain names, etc... provides very little value when it is not accompanied with a detailed analysis of the situation. This analysis is mentioned in the article and referred as "context". This analysis should result in information that is both actionable and timely and at the same time painting the picture of the threat.
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/12/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: LOL  Hope this one wins
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.