Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

5/23/2018
10:30 AM
Chris McDaniels
Chris McDaniels
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Is Threat Intelligence Garbage?

Most security professionals in a recent survey said that threat intelligence doesn't work. So why all the hype?

Threat intelligence sounds like something security professionals should like — automation has a lot of potential. Artificial intelligence is increasingly making our lives more efficient, and technological solutions could help cybersecurity teams decrease the amount of mundane, repetitive tasks they need to perform on a daily basis.

In reality, however, most security professionals are not yet fans of threat intelligence. For example, the Ponemon Institute, an independent research group that studies information security and privacy, recently released a report about companies' attitudes toward threat intelligence. Seventy percent of the security industry professionals it surveyed said they believe threat intelligence is either too complex or cumbersome to provide usable insights.

Mahendra Ramsinghani, founder of cybersecurity seed fund Secure Octane, included threat intelligence among falsehoods professionals should ditch in a TechCrunch piece. Specifically, she mentions a Black Hat talk titled "Lies and Damn Lies," and provocatively writes that the presenters "spent five months digging into various endpoint offerings and concluded that threat intelligence simply does not work."

This may all come as a surprise to you, particularly if you follow the hype about threat intelligence. You may be wondering if giants like Google and Amazon are investing in threat intelligence-adjacent solutions, then why are so many cybersecurity professionals suspicious of these offerings?

Feeds vs. Platforms
Before we go further, let's understand the difference between a threat intelligence feed and a threat intelligence platform. Put simply, a threat intelligence feed is an ongoing, third-party stream of information, or "feed," about current or potential threats to a company in a particular category. As Recorded Future explains, a feed can solely focus on domains, hashes, or IPs known to be associated with malicious activity, for example. There are also six main sources of threat intelligence feeds, which are all valuable: open source, customer telemetry, honeypots and darknets, scanning and crawling, malware processing, and human intelligence.

There are several challenges to analyzing threat intelligence feeds. First, the reliability of each feed varies tremendously. Many feeds are open source and free, and, thus, not tailored to your company's needs. These need to be monitored heavily to ensure they are even worthwhile. Feeds coming from industries closer to yours will likely be more useful, but, not surprisingly, they are often expensive. Also, you are the only expert who knows exactly what information is applicable to your organization. So, as much as paid feeds may provide high-quality data, you will need to monitor their relevance closely. It might make sense to work closely with vendors in creating tailored feeds, though that is obviously an investment of time and money.

The other key obstacle with threat intelligence feeds is triaging so much information. For every threat intelligence feed you add, the more data you need to analyze, and the higher the chance you'll encounter false positives. Additionally, none of these feeds come with context, which is crucial in determining whether or not you should act upon their alerts.

Threat intelligence platforms are increasingly hailed as a solution to organize and make sense of various feeds. In a recent report, "Hype Cycle for Threat-Facing Technologies, 2017," Gartner's Greg Young writes that threat intelligence platforms "collect, correlate, categorize, share and integrate security threat data in real time to support the prioritization of actions and aid in attack prevention, detection and response. They also integrate with and complement existing security technologies and processes like SIEM, IPSs and firewalls." He asserts that current threat intelligence solutions are most useful for large, sophisticated cybersecurity outfits. However, he notes that threat intelligence is only moderately helpful compared with a string of approaches he deems to be highly beneficial. He prefers enterprise firewalls, operational technology software, and user and entity behavior analytics, among other solutions.

Although threat intelligence platforms would be a lovely silver bullet to the feed aggregation and insight problem, at this point most threat intelligence solutions — both feeds and platforms — fail to measure up. At some point, the higher-end products may be useful beyond large-scale companies. Until then, we recommend using feeds that are helpful and focusing on less sexy but beneficial ways to streamline your operations, such as hiring the right security professional to analyze your organization's unique needs.

Related Content:

Chris McDaniels is Chief Information Security Officer of Mosaic451, a cybersecurity service provider and consultancy with expertise in building, operating, and defending some of the most highly secure networks in North America. McDaniels is a US Air Force veteran with over 14 ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
richchetwynd
50%
50%
richchetwynd,
User Rank: Author
5/24/2018 | 4:35:08 PM
Bespoke threat intelligence has merit
I agree that it's difficult to find value in generic threat intelligence platforms. However there is value in combing both third party intelligence feeds and intelligence that is gathered from internal data sources to create a bespoke intelligence platform. Machine learning and database technologies are so easily accessible these days making custom solutions more viable for developers.
benmiller
100%
0%
benmiller,
User Rank: Apprentice
5/23/2018 | 11:38:33 AM
Threat intelligence Data vs. Threat Intelligence
Threat intelligence data is not finished threat intelligence. The mentions of "feeds" in this article would align more closely with the data that is needed to support a finished intelligence product. A long list of IPs, hashes, domain names, etc... provides very little value when it is not accompanied with a detailed analysis of the situation. This analysis is mentioned in the article and referred as "context". This analysis should result in information that is both actionable and timely and at the same time painting the picture of the threat.
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13360
PUBLISHED: 2019-07-16
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.
CVE-2019-13383
PUBLISHED: 2019-07-16
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response.
CVE-2019-13603
PUBLISHED: 2019-07-16
An issue was discovered in the HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader Windows Biometric Framework driver 5.0.0.5. It has a statically coded initialization vector to encrypt a user's fingerprint image, resulting in weak encryption of that. This, in combination...
CVE-2019-13605
PUBLISHED: 2019-07-16
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-1...
CVE-2019-13615
PUBLISHED: 2019-07-16
VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.