Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/9/2020
10:30 AM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Operationalizing Threat Intelligence at Scale in the SOC

Open source platforms such as the Malware Information Sharing Platform are well positioned to drive a community-based approach to intelligence sharing.

Today's security operations centers (SOCs) are struggling. Cyber threats are ever-increasing and growing daily in sophistication. Massive volumes of data created every second lead to new vulnerabilities and attack vectors. How do SOCs keep pace with the threats happening across the landscape and better understand them to increase their organization's security posture?

A Ponemon Institute survey, "Improving the Effectiveness of the Security Operations Center," found that 53% of respondents believe their SOC is ineffective at gathering evidence, investigating, and finding the source of threats. To be effective, SOCs must have access to the right data with the right context at the right time to fulfill their mission of identifying and responding to threats.

Cyber threat intelligence (CTI) has become a key tool for SOCs in this mission. According to the 2019 SANS' "Evolution of Cyber Threat Intelligence" survey, 70% of customers consider CTI a necessity for security operations. Yet many organizations still struggle to operationalize the disparate sources of threat intelligence or institute an effective culture of sharing to combine forces against adversaries.

Leveraging the Different Types of Threat Data
CTI intelligence feeds come from many sources, and there are two primary categories. The first is open source/community feeds, such as the Collective Intelligence Framework (CIF) and sector-based Information Sharing and Analysis Centers (ISACs); the second is vendor-specific and paid-for threat intelligence services (iDefense, Cisco, Team Cymru, Greynoise.io, McAfee, Symantec, ATLAS, Farsight, and Reversing Labs, to name a few). Security operations teams also produce proprietary intelligence that needs to be shared internally.

There are several challenges to making the most of this threat data, however:

• Scaling Up the Pyramid of Pain: The more useful the threat data, the more difficult (or painful) it is to obtain and integrate into workflows. Imagine a pyramid formed by threat data values versus the level of integration difficulty:

o Tactics, techniques, and procedures (TTPs): Tough (Top of pyramid)

o Tools: Challenging

o Network/host artifacts: Annoying

o Domain names: Simple

o IP addresses: Easy

o Hash values: Trivial (base of pyramid)

At the top of the pyramid is intelligence on threat actor tools and TTPs. These are the most painful indicators to detect and verify but also the most useful for knowing context about threat actors, their intentions, and their methods to understand a threat well enough to respond.

• Timing, Complexity, Taxonomy, and Formatting: The period of time for which threat data is valid is limited. Organizations need current information about vulnerabilities and malware being used in attacks before they are targeted. Intelligence feeds will have shifting levels of urgency and simplifying the prioritization process is a complex task.

In the past, security practitioners shared Word documents, PDFs, or simple file formats like CSV tables and Excel Sheets of indicators of compromise These were difficult to operationalize due to taxonomy and formatting differences, lack of integration, and the time-sensitive nature of the data. Also, it is difficult to describe and share a more complex behavioral indicator such as a threat actor tactic in a standardized format.

• Sharing and Consumption: The cyber community has tried — and failed — to institute an effective culture of sharing. Taxonomies and standards have been created but none have caught on at scale, leaving accessibility to CTI fragmented. As a result, most sharing doesn't go beyond domains. And even though security analysts across industries share common goals, often the organization does not see it that way and sharing and collaborating is hidden from management.

Automated analysis and instantaneous sharing of threat intelligence is the key that has been missing to unlock CTI to live up to its potential value.

What Is MISP and Why Is It Important? 
MISP — the Malware Information Sharing Platform — has gained traction as a pragmatic, flexible approach to the threat intelligence consumption and sharing problem. MISP is a vendor-agnostic, open source standard with a growing community, co-financed by the European Union. It is an infrastructure for consuming, collecting, and sharing indicators of malware either in a trusted circle or with the general public, depending on the user's preferences. MISP provides a number of benefits:

• MISP allows users to push and query known indicators of compromise collected and shared by a community of security practitioners from around the globe.

• MISP is flexible because it does not enforce a single methodology for sharing threat intelligence, and it outputs information in multiple formats.

• MISP reduces double-work within the intelligence community by sharing information across CERTs, organizations, governments, and security vendors.

• MISP provides a level of control to ensure that the right data is confidentially shared and consumed.

To operationalize threat intelligence at scale without overburdening security teams, practitioners should consider integrating MISP with their existing security information and event management (SIEM) solution. MISP is built for flexible ingestion and extraction, rapid analysis, automation, and sharing. A SIEM's integration with MISP builds threat data consumption and threat sharing directly into the analyst workflow. This enables analysts to find and share threats much faster than before by correlating community intelligence with multiple other data sources through their SIEM.

The SANS survey found that 33.7% of organizations produce and consume threat intelligence, while 60.5% only consume it. This means that a majority of organizations recognize the value of CTI yet for different reasons currently decline to participate in sharing their findings.

Open source platforms such as MISP, combined with automated integration into SIEMs, are well positioned to drive a community-based approach to intelligence sharing. This will enable SOCs to stand together through collaborative analysis, potentially driving the industry to an inflection point for moving beyond source-to-subscriber to partner-to-partner sharing.

Related Content:
 
 

Sebastien Tricaud is the Director of Security Engineering at Devo. He has worked on numerous open source projects, such as Linux PAM, Prelude IDS, etc. He is the lead developer of Faup, a URL Parser that is widely popular. Sebastien is also a board member of the Honeynet ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5615
PUBLISHED: 2020-08-04
Cross-site request forgery (CSRF) vulnerability in [Calendar01] free edition ver1.0.0 and [Calendar02] free edition ver1.0.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVE-2020-5616
PUBLISHED: 2020-08-04
[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calendar02] free edition ver1.0.0, [PKOBO-News01] free edition ver1.0.3 and earlier, [PKOBO-vote01] free edition ver1.0.1 and earlier, [Telop01] fre...
CVE-2020-5617
PUBLISHED: 2020-08-04
Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unauthorized privileges and modify/obtain sensitive information or perform unintended operations via unspecified vectors.
CVE-2020-11583
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-11584
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.