Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10:30 AM
Connect Directly
E-Mail vvv

Operationalizing Threat Intelligence at Scale in the SOC

Open source platforms such as the Malware Information Sharing Platform are well positioned to drive a community-based approach to intelligence sharing.

Today's security operations centers (SOCs) are struggling. Cyber threats are ever-increasing and growing daily in sophistication. Massive volumes of data created every second lead to new vulnerabilities and attack vectors. How do SOCs keep pace with the threats happening across the landscape and better understand them to increase their organization's security posture?

A Ponemon Institute survey, "Improving the Effectiveness of the Security Operations Center," found that 53% of respondents believe their SOC is ineffective at gathering evidence, investigating, and finding the source of threats. To be effective, SOCs must have access to the right data with the right context at the right time to fulfill their mission of identifying and responding to threats.

Cyber threat intelligence (CTI) has become a key tool for SOCs in this mission. According to the 2019 SANS' "Evolution of Cyber Threat Intelligence" survey, 70% of customers consider CTI a necessity for security operations. Yet many organizations still struggle to operationalize the disparate sources of threat intelligence or institute an effective culture of sharing to combine forces against adversaries.

Leveraging the Different Types of Threat Data
CTI intelligence feeds come from many sources, and there are two primary categories. The first is open source/community feeds, such as the Collective Intelligence Framework (CIF) and sector-based Information Sharing and Analysis Centers (ISACs); the second is vendor-specific and paid-for threat intelligence services (iDefense, Cisco, Team Cymru, Greynoise.io, McAfee, Symantec, ATLAS, Farsight, and Reversing Labs, to name a few). Security operations teams also produce proprietary intelligence that needs to be shared internally.

There are several challenges to making the most of this threat data, however:

• Scaling Up the Pyramid of Pain: The more useful the threat data, the more difficult (or painful) it is to obtain and integrate into workflows. Imagine a pyramid formed by threat data values versus the level of integration difficulty:

o Tactics, techniques, and procedures (TTPs): Tough (Top of pyramid)

o Tools: Challenging

o Network/host artifacts: Annoying

o Domain names: Simple

o IP addresses: Easy

o Hash values: Trivial (base of pyramid)

At the top of the pyramid is intelligence on threat actor tools and TTPs. These are the most painful indicators to detect and verify but also the most useful for knowing context about threat actors, their intentions, and their methods to understand a threat well enough to respond.

• Timing, Complexity, Taxonomy, and Formatting: The period of time for which threat data is valid is limited. Organizations need current information about vulnerabilities and malware being used in attacks before they are targeted. Intelligence feeds will have shifting levels of urgency and simplifying the prioritization process is a complex task.

In the past, security practitioners shared Word documents, PDFs, or simple file formats like CSV tables and Excel Sheets of indicators of compromise These were difficult to operationalize due to taxonomy and formatting differences, lack of integration, and the time-sensitive nature of the data. Also, it is difficult to describe and share a more complex behavioral indicator such as a threat actor tactic in a standardized format.

• Sharing and Consumption: The cyber community has tried — and failed — to institute an effective culture of sharing. Taxonomies and standards have been created but none have caught on at scale, leaving accessibility to CTI fragmented. As a result, most sharing doesn't go beyond domains. And even though security analysts across industries share common goals, often the organization does not see it that way and sharing and collaborating is hidden from management.

Automated analysis and instantaneous sharing of threat intelligence is the key that has been missing to unlock CTI to live up to its potential value.

What Is MISP and Why Is It Important? 
MISP — the Malware Information Sharing Platform — has gained traction as a pragmatic, flexible approach to the threat intelligence consumption and sharing problem. MISP is a vendor-agnostic, open source standard with a growing community, co-financed by the European Union. It is an infrastructure for consuming, collecting, and sharing indicators of malware either in a trusted circle or with the general public, depending on the user's preferences. MISP provides a number of benefits:

• MISP allows users to push and query known indicators of compromise collected and shared by a community of security practitioners from around the globe.

• MISP is flexible because it does not enforce a single methodology for sharing threat intelligence, and it outputs information in multiple formats.

• MISP reduces double-work within the intelligence community by sharing information across CERTs, organizations, governments, and security vendors.

• MISP provides a level of control to ensure that the right data is confidentially shared and consumed.

To operationalize threat intelligence at scale without overburdening security teams, practitioners should consider integrating MISP with their existing security information and event management (SIEM) solution. MISP is built for flexible ingestion and extraction, rapid analysis, automation, and sharing. A SIEM's integration with MISP builds threat data consumption and threat sharing directly into the analyst workflow. This enables analysts to find and share threats much faster than before by correlating community intelligence with multiple other data sources through their SIEM.

The SANS survey found that 33.7% of organizations produce and consume threat intelligence, while 60.5% only consume it. This means that a majority of organizations recognize the value of CTI yet for different reasons currently decline to participate in sharing their findings.

Open source platforms such as MISP, combined with automated integration into SIEMs, are well positioned to drive a community-based approach to intelligence sharing. This will enable SOCs to stand together through collaborative analysis, potentially driving the industry to an inflection point for moving beyond source-to-subscriber to partner-to-partner sharing.

Related Content:

Sebastien Tricaud is the Director of Security Engineering at Devo. He has worked on numerous open source projects, such as Linux PAM, Prelude IDS, etc. He is the lead developer of Faup, a URL Parser that is widely popular. Sebastien is also a board member of the Honeynet ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Post a Comment
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-14
DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or in extreme case bring the system to a halt. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTR...
PUBLISHED: 2021-06-13
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.