Getting the Most Out of Cyber Threat Intelligence

Today’s security environment is complex, ever changing, and sometimes even political. Many organizations struggle to keep current about the cyber threats they face. This is due to a number of issues, ranging from the failure to adapt security recommendations to the specific needs of an organization, to an over focus on malware instead of the human adversary.

Adding to the struggle is the fact that every organization is different. For example, inside an industry vertical, you may find political or regional differences beyond just technical ones. There may be differences in how one division within an organization approaches security in comparison to other divisions within the company. These division-based differences can be the result of varying organizational missions or business units. Each disparity impacts the organization’s overarching threat model, and its understanding of its threat landscape.

Over the years defenders have taken a tool-centric approach. But technology alone won't stop a well-focused and funded human adversary. While technology is great at synthesizing data, limiting the attack space, and making human analysts more efficient, at the end of the day, it is a human adversary vs. human defender contest - and it must be treated as such.

Even organizations that appreciate the value of threat intelligence can be misled in their application of it. For example, insight into threats can be limited by a vendor-centric approach to how threat intelligence is consumed. And while processing reports created by external parties and leveraging threat data are a valuable way to gather information on adversaries, capabilities and infrastructure, the information gathered should complement a larger internal effort by the security team, not replace it. Put another way, when security practitioners use information obtained through technology and threat intelligence feeds incorrectly, the result is reactive, Whack-a-Mole security, not a deeper understanding of adversary tradecraft.

The Power of Analysis
To truly be successful in threat intelligence organizations must empower and train their human defenders in analytical approaches so they become good analysts. This means understanding complex scenarios and thinking about them more critically. Simply put, good analysts should look at the world a little differently.

Join Dark Reading LIVE for two days of practical cyber defense discussions from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

While there is significant value in learning how to use a tool in certain environments (and some great vendor-neutral courses to show you how), the real value is in structured analysis training. Becoming a good analyst requires much more than knowing which tool to use and when. When faced with complex scenarios, it is vital that the security community thinks critically and evaluate various options. This requires practitioners to develop skills that expand into complicated topics such as adversary intrusion, campaign analysis, adversary tradecraft, and moving from relying on indicators to leveraging behavioral analytics. 

Security practitioners must also tie together individual intrusions and look at them as long-term campaigns being run against organizations, as opposed to one-off attacks. There are a lot of security efforts where every intrusion is treated as a separate entity, when realistically we might be dealing with an entire campaign from an adversary.

This is not a new concept in of itself. Richard Betjlich was advocating for this approach in the early 2000’s. Today, amazing strides in defense are being made in organizations that are attempting to tie intrusions together successfully in order to reduce risk. Sharing knowledge and analysis of an adversary campaign between tactical and strategic level players is essential to getting – and staying – ahead of adversaries.

While technical training and labs are important, to truly understand the human threat requires that practitioners hone their analysis skills and change their perspective. By that I mean, responders and security operations teams must develop intelligent analysis skills across data sets in a way that gives them a deeper understanding of security from tactical, operational, and strategic approaches. Analysis-based cyber threat intelligence will allow security practitioners to move from putting out fires to fighting the arsonists.  

The ideal training should also help develop an operational view into how a threat program can mature. From a strategic level, it should arm practitioners with insight into adversaries at a level that C-suite and boards of directors can appreciate and leverage to protect the overall organization.

Bottom line: When organizations understand their own environments, can confidently and accurately identify what constitutes a threat to them, and can think critically about the information they receive, only then will threat intelligence becomes an extremely useful addition to security. 

If you wish to learn more, please check out the SANS FOR578: Cyber Threat Intelligence course or research these concepts online.

Related Content: