Finding The ROI Of Threat Intelligence: 5 Steps

During my time managing a security operations center at one of the largest defense contractors, executives would constantly scrutinize security budgets, focusing on the areas of security architecture that could be streamlined. The process typically would lead to one burning question: how can security teams leverage threat intelligence to increase ROI without adding headcount or doubling the bottom line? My answer involved five key steps:

Step 1. Develop Key Performance Indicators (KPI)
Every successful security program needs metrics and KPI’s to measure against and report back to their organization. To implement a successful KPI program for threat intel intake, you’ll need to:

Step 2. Continually evaluate and reassess threat intelligence providers
There are no silver bullets in the cybersecurity industry and the same is true in the world of threat intelligence. If you’re looking for a one-size-fits-all approach, you’re viewing the problem in the wrong way. Here are the questions you need to address:  

Step 3. Prioritize alerts to efficiently utilizing security analysts’ time
Instead of seeking out the latest and greatest technologies to add to a roster of network protections, enterprises should identify new ways to effectively leverage the tools they already have. The security information and event management tool is the perfect example. It correlates trillions of events creating alerts, but analysts become submerged by the sheer number because there is little to no true prioritization. However, if teams efficiently integrate threat intelligence feeds with their SIEM, analysts could significantly improve alert prioritization and jumpstart analyst triage investigations.

Skilled analysts are in short supply and high-demand! It can take a massive amount of resources to find, hire, and retain a qualified security analyst. Worse, and one major downfall I’ve frequently observed, is the misuse of security analysts’ time and expertise. Organizations have the tools to properly defend the organization but their analysts are stuck performing manual tasks rather than focusing on bigger picture solutions and processes.

Step 4. Foster collaboration between ALL analyst teams
Too often analysts sitting shoulder-to-shoulder (let alone across the room or building) don’t effectively collaborate on indicators, malware techniques, victimology, etc. And no, the answer isn’t having another daily standup meeting. Instead, make it easier for security analysts, intelligence analysts, malware analysts, incident responders, and signature/content engineers to talk to each other across geographic locations through tools like HipChat, Sococo, or Skype, and coordinate semi-annually onsite meetings to build relationships. Similarly, encourage analysts to collaborate with peers within like-minded communities outside of the organization.  Join local security cohorts rather than wait for RSA and Black Hat every year to share threat intelligence over a few beers.

Step 5. Pilot threat intelligence providers before buying
Many organizations pull the trigger on selecting a provider after reading two or three sample intelligence or malware reports -- the provider’s “golden child” of reports. But that isn’t a good day-to-day representation of what the providers’ publish. I recommend asking for a 30-day evaluation period where you can evaluate:

At the end of the day, you need to choose a provider that you and your organization trust. If there isn’t mutual trust at the beginning of an engagement, the relationship will be rocky forever.