Harnessing The Power Of Cyber Threat Intelligence

Here are six real-world examples of how changing your modus operandi from reactive to proactive can drive rapid response to the threats that matter

A core tenant of cyber threat intelligence or CTI is that it has to be “consumable” and “actionable” to be useful. Without these basic underlying concepts, the best CTI in the world, cultivated from the most beneficial sources, and containing the most informed analysis, is nothing more than interesting; and interesting doesn’t mean useful. So the real question is, how do you harness the power of CTI to drive decision advantage and proactive, informed decision making in an ever increasing threat environment?

There is a great deal of power that comes along with knowing your adversary. By mapping his (or her) past activities and capabilities, historical and current affiliations, and ability to influence within a real and aspirational community of like minded individuals,  understanding his current readiness and objectives, and anticipating his future ambitions, you can obtain a position of dominance that can drastically reduce his chances of success. 

 This knowledge also extends to both the technical and non-technical nature of the tools and tactics that he has or aspires to use to achieve a real impact.  The marriage of these concepts enables actionable knowledge of what defensive postures to take, and how to best position to recognize, detect, mitigate, or in some cases, completely avoid the impacts associated with malicious intent. 

Whether you are a sports club conducting scouting on an upcoming opponent, a Fortune 500 company conducting competitive research, or a nation state monitoring capabilities of a foe, the best way to win is to know your opponent – and the quickest way to lose is to walk forward in any engagement without that knowledge. Unfortunately, we’ve seen the latter play out far too many times over the past decade in information security, where a lack of deep intelligence on our adversaries has resulted in countless breaches.

“Know thy enemy” & improve every workflow 

Many of your peers are already using CTI to revolutionize and reinvigorate the relationship between security and the business – changing their operating models from reactive to proactive and risk based. True CTI (not raw information but intelligence) helps organizations prioritize better and drive rapid response to the threats that matter. It helps them get ahead of the curve on threats that are “over the horizon” by driving the right investments through risk-based security decisions that map to the needs of the business.

Here are six examples of how CTI is working right now:

Better Board & Business Communications: Look for intelligence that isn’t just deep into the technical weeds. Keep in mind that you can harness the power of threat intelligence to drive strategic decisions. Provide executive summaries written in layman’s language with reporting on adversaries, vulnerabilities and exploitation, and security trends geared specifically towards business leaders. These types of reports help CISOs communicate to the rest of the business, providing tools to highlight the need for action and when required even debunk hype in the industry.

Improved Patch Management Process: True CTI can help GRC teams streamline patch management processes. Using actionable vulnerability and exploitation data, these teams are able to better prioritize which vulnerabilities to patch and on what time schedule.

More Effective “Attack Surface” Protection Systems: CTI plays a key role in making existing security tools better. Many legacy security protection tools are blind to today’s threats. Further, even when tools can be configured to automatically block based off of data in raw threat feeds, network operations often does not turn this feature on for fear that they will block the wrong things and adversely impact the business. With highly validated CTI, organizations that are otherwise reticent to turn on automatic blocking can now block with confidence.

Situational Awareness & Event Prioritization: High fidelity CTI enables SOC teams to prioritize which events are most important by delivering more power to security information and event management (SIEM) systems.

IR Attribution & Messaging: CTI can help incident responders understand who is targeting their organization and improve communications across the business – resulting in better informed response. CTI changes the discussion from “We were hit with malware variant x” to “an actor group from Eastern Europe is targeting us, and others in our sector, and actively trying to steal personally identifiable information (PII). They can use this PII to take out credit cards in our customer’s names.”

Find & Fix Everything: True CTI helps forensic teams determine incident attribution and make sure they find and fix everything. Figuring out who is attacking you is impossible without adversary-focused intelligence. Further, if you don’t know who attacked you or what else they may have used against you in the past, you or your third-party forensic team many not find and fix everything.