Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
New Kid On The Block: Cyber Threat Analyst
Drawing from the financial service industry, this new role uses the “art of the intelligence cycle” to drive efficiency in the security operations center.
3 Min Read
With the rapid rise, frequency, severity and cost of cyber attacks, many companies today are looking to the government military intelligence industry for the skills, talent and experience to run their security operations center.
Leaders in the financial markets were the first to realize that an SOC driven by intelligence could be a force multiplier in achieving operational efficiency and effectiveness. Early adopters such as JPMorgan Chase & Co. used this expertise to restructure personnel into new tiers with new priorities and job functions. One of the newest roles to emerge from this shift is that of the cyber threat analyst.
What is the exact role of the cyber threat analyst and how does the analyst’s work help prevent attackers from stealing critical data or causing other harm to a business? What the cyber threat analyst brings to the table is the “art of the intelligence cycle.” This is where information is directed, collected, processed, analyzed, produced, and disseminated.
For example, in an organization where I once worked as a cyber analyst, my team was tasked with finding a better way to identify insider threats within the company. First, I identified the relevant sources of data by which could identify insider threats, in this case, badge logs, web proxy traffic, and print logs. Then I began determining the patterns likely to be associated with malicious activity. These patterns allowed me to narrow down potential suspects to only .0001% of the employee pool.
After we disseminated our report, others on the security operations team became much more effective in monitoring insider threats. Intelligence truly began to drive operations – which was the optimal outcome.
Worth the effort
Building the capability of cyber threat analysis is a challenging endeavor that will yield tangible results – but it takes time and discipline. Here are three key principles for developing a successful cadre of analysts:
The rule of three. Cyber threat analysis is composed of three distinct skillsets, and very rarely will one individual maintain all three. To properly learn cyber threat analysis, an analyst must learn information security (e.g. network defense, information assurance), intelligence analysis (e.g. the mastery of the intelligence cycle), and forensic science (e.g. investigations, evidence handling, discovery). It is essential to recruit individuals strong in one or two of these areas and also facilitate a training program to compliment skillsets.
Intelligence is a journey, not a destination. Building an intelligence program is an iterative process. The maturation of the program should be laid out in a phased approach, where simple “quick wins” can be achieved early on in the process. For example, a four-phased approach would include: ad hoc analysis, integration of non-traditional data into security analysis, increasing speed of searches in addition to higher tier threats, and finally, continuous feeds of real-time data and automated detection analytics.
Knowledge is cumulative and must be nurtured over time. Cyber threat analysis is like many other professions where practice is necessary to continue learning the craft. Consider a surgeon: after eight full years of classroom education, can a newly minted physician walk into an operating room and conduct surgery? No, they must enter a five to eight year residency where they learn the craft under a seasoned, attending surgeon. Similarly, cyber threat analysts learn best under a “master operator;” a recent college graduate simply cannot operate close to the same level as a seasoned pro. During my experience in the intelligence community, it took over a decade to develop a cadre of cyber threat analysts with the requisite skillsets.
Companies implementing any of the three principles outlined above will see a reduction in the severity of cyber attacks impacting their organizations. But those implementing all three will see the best results.
About the Author
You May Also Like
More Insights
