Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10:30 AM
Connect Directly
E-Mail vvv

Operationalizing Threat Intelligence at Scale in the SOC

Open source platforms such as the Malware Information Sharing Platform are well positioned to drive a community-based approach to intelligence sharing.

Today's security operations centers (SOCs) are struggling. Cyber threats are ever-increasing and growing daily in sophistication. Massive volumes of data created every second lead to new vulnerabilities and attack vectors. How do SOCs keep pace with the threats happening across the landscape and better understand them to increase their organization's security posture?

A Ponemon Institute survey, "Improving the Effectiveness of the Security Operations Center," found that 53% of respondents believe their SOC is ineffective at gathering evidence, investigating, and finding the source of threats. To be effective, SOCs must have access to the right data with the right context at the right time to fulfill their mission of identifying and responding to threats.

Cyber threat intelligence (CTI) has become a key tool for SOCs in this mission. According to the 2019 SANS' "Evolution of Cyber Threat Intelligence" survey, 70% of customers consider CTI a necessity for security operations. Yet many organizations still struggle to operationalize the disparate sources of threat intelligence or institute an effective culture of sharing to combine forces against adversaries.

Leveraging the Different Types of Threat Data
CTI intelligence feeds come from many sources, and there are two primary categories. The first is open source/community feeds, such as the Collective Intelligence Framework (CIF) and sector-based Information Sharing and Analysis Centers (ISACs); the second is vendor-specific and paid-for threat intelligence services (iDefense, Cisco, Team Cymru, Greynoise.io, McAfee, Symantec, ATLAS, Farsight, and Reversing Labs, to name a few). Security operations teams also produce proprietary intelligence that needs to be shared internally.

There are several challenges to making the most of this threat data, however:

• Scaling Up the Pyramid of Pain: The more useful the threat data, the more difficult (or painful) it is to obtain and integrate into workflows. Imagine a pyramid formed by threat data values versus the level of integration difficulty:

o Tactics, techniques, and procedures (TTPs): Tough (Top of pyramid)

o Tools: Challenging

o Network/host artifacts: Annoying

o Domain names: Simple

o IP addresses: Easy

o Hash values: Trivial (base of pyramid)

At the top of the pyramid is intelligence on threat actor tools and TTPs. These are the most painful indicators to detect and verify but also the most useful for knowing context about threat actors, their intentions, and their methods to understand a threat well enough to respond.

• Timing, Complexity, Taxonomy, and Formatting: The period of time for which threat data is valid is limited. Organizations need current information about vulnerabilities and malware being used in attacks before they are targeted. Intelligence feeds will have shifting levels of urgency and simplifying the prioritization process is a complex task.

In the past, security practitioners shared Word documents, PDFs, or simple file formats like CSV tables and Excel Sheets of indicators of compromise These were difficult to operationalize due to taxonomy and formatting differences, lack of integration, and the time-sensitive nature of the data. Also, it is difficult to describe and share a more complex behavioral indicator such as a threat actor tactic in a standardized format.

• Sharing and Consumption: The cyber community has tried — and failed — to institute an effective culture of sharing. Taxonomies and standards have been created but none have caught on at scale, leaving accessibility to CTI fragmented. As a result, most sharing doesn't go beyond domains. And even though security analysts across industries share common goals, often the organization does not see it that way and sharing and collaborating is hidden from management.

Automated analysis and instantaneous sharing of threat intelligence is the key that has been missing to unlock CTI to live up to its potential value.

What Is MISP and Why Is It Important? 
MISP — the Malware Information Sharing Platform — has gained traction as a pragmatic, flexible approach to the threat intelligence consumption and sharing problem. MISP is a vendor-agnostic, open source standard with a growing community, co-financed by the European Union. It is an infrastructure for consuming, collecting, and sharing indicators of malware either in a trusted circle or with the general public, depending on the user's preferences. MISP provides a number of benefits:

• MISP allows users to push and query known indicators of compromise collected and shared by a community of security practitioners from around the globe.

• MISP is flexible because it does not enforce a single methodology for sharing threat intelligence, and it outputs information in multiple formats.

• MISP reduces double-work within the intelligence community by sharing information across CERTs, organizations, governments, and security vendors.

• MISP provides a level of control to ensure that the right data is confidentially shared and consumed.

To operationalize threat intelligence at scale without overburdening security teams, practitioners should consider integrating MISP with their existing security information and event management (SIEM) solution. MISP is built for flexible ingestion and extraction, rapid analysis, automation, and sharing. A SIEM's integration with MISP builds threat data consumption and threat sharing directly into the analyst workflow. This enables analysts to find and share threats much faster than before by correlating community intelligence with multiple other data sources through their SIEM.

The SANS survey found that 33.7% of organizations produce and consume threat intelligence, while 60.5% only consume it. This means that a majority of organizations recognize the value of CTI yet for different reasons currently decline to participate in sharing their findings.

Open source platforms such as MISP, combined with automated integration into SIEMs, are well positioned to drive a community-based approach to intelligence sharing. This will enable SOCs to stand together through collaborative analysis, potentially driving the industry to an inflection point for moving beyond source-to-subscriber to partner-to-partner sharing.

Related Content:

Sebastien Tricaud is the Director of Security Engineering at Devo. He has worked on numerous open source projects, such as Linux PAM, Prelude IDS, etc. He is the lead developer of Faup, a URL Parser that is widely popular. Sebastien is also a board member of the Honeynet ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-30
Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that if exploited, could allow an attacker to case a kernel panic or crash. An attacker must first obtain the ability to execute high-privileged code on the targ...
PUBLISHED: 2020-10-30
Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privi...
PUBLISHED: 2020-10-29
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s pass...
PUBLISHED: 2020-10-29
A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality
PUBLISHED: 2020-10-29
Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.