Because cybersecurity teams face numerous threats from bad actors that are continually devising new methods of attacking crucial assets, they must remain vigilant. It’s crucial for an organization’s security team to have access to ample resources to keep pace with new developments in the threat landscape. Having more information at their disposal empowers security analysts to make informed decisions when responding to a threat. This is why threat intelligence plays such an important role in an organization’s security strategy. 

What is Threat Intelligence?

Threat intelligence is evidence-based information about cyber attacks and methods that is organized and distributed by security experts. Its purpose is to inform security practitioners of new, evolving threats so they can better protect their organizations. Threat intelligence can come in different forms, and might include the mechanism of an attack, how that attack might affect an organization, how to identify the attack, and even advice on how to defend against the attack.

Threat intelligence can be categorized into three main categories::

• Strategic: Strategic threat intelligence contains non-technical information that enables individuals without technical expertise to understand the threat context.  This type of threat intelligence is often developed primarily for high-level decision makers within an organization so they can consider how certain decisions might impact the cyber security of that company. For example, a global report on the financial impact of recent cyber threats might be considered strategic threat intelligence.
• Tactical: Tactical threat intelligence is generally composed of details about a threat actor’s tactics, techniques, and procedures (TTPs). This type of threat intelligence also regularly comes in the form of an Indicator of Compromise (IOC) such IP addresses or domains that are known to be malicious. IDS-based rules and signatures can also be considered tactical threat intelligence, as they detect both standard and advanced IOCs and can be gathered from both free and paid threat intelligence sources. This is the most common and easily gathered form of threat intelligence and is often found in free threat intelligence feeds and other open-source projects, though the most accurate and thorough threat intelligence is usually from a commercial product. Tactical threat intelligence is used to help manage defensive strategies and understand how and why an organization might become a target for different types of attacks.
• Operational: Operational threat intelligence is often considered the hardest form of intelligence to gather. This is because it comes directly from the attacker. Gathering this type of threat intelligence requires the analyst to get inside the mind of an attacker, frequent the feeds and forums that attackers do, and understand why the attacker would choose the specific TTPs that they do. By understanding the nature, timing, and intent of an attack, a SOC team can make highly informed decisions on how to detect and respond to specific threat types.

These provide a general overview of the three broad categories of threat intelligence, and each serves a different purpose.  For an organization to have a comprehensive understanding of the evolving threat landscape, it’s crucial that it has access to a diverse range of information sources. Threats change daily, so maintaining a thorough and up-to-date threat intelligence strategy can significantly enhance a company’s security. 

Why is Threat Intelligence Important?

The challenges to cybersecurity teams are continually evolving. Both the number and frequency of threats are on an upward trend. Many detection systems are overloaded with false alerts, and there is an ongoing shortage of skilled professionals who are able to keep up with the demand. Moreover, since most organizations heavily rely on the internet for their operations and the world increasingly moves online, the number of potential entry points and attack surfaces for companies to manage has become larger than ever before.

Threat intelligence is actionable, useful, context-driven information that can help organizations stay on top of these challenges. By staying up-to-date with the most recent threat developments, an organization can ensure that they have as much information as possible before acting. In other words, threat intelligence minimizes the need to make uninformed decisions, which in turn mitigates the risk associated with the changing threat landscape.

The challenge is managing the information provided by threat intelligence. Many threat detection systems are now employing machine learning to assist with this process, so that unstructured data coming from multiple sources can find a home and be useful. It is important that an organization has systems in place to ensure that their threat intelligence — and all related IOCs, TTPs, and contextual information — are actually being put to use and are accessible to those who need the information.

Threat Intelligence Sharing

There are numerous resources for both third-party and private threat intelligence. Some organizations choose to employ a threat intelligence platform such as these reviewed by Gartner Peer Insights. Other organizations use common open-source solutions like the MITRE ATT&CK knowledge base. Outside of platforms and databases for threat intelligence, there are also programs for threat intelligence sharing like the Malware Information Sharing Project (MISP). MISP is incredibly useful for organizations and allows users to share threat intelligence publicly in open community feeds as well as privately with peers.

Threat Intelligence and Stamus Security Platform

Stamus Security Platform (SSP) is an open network-based threat detection and response (NDR) system that gives security teams greater visibility into their network activity with advanced threat detection capabilities paired with extensible contextual evidence. SSP not only includes third-party threat intelligence and the ability to integrate with platforms like MISP, but users also receive weekly email updates from the Stamus Labs threat research team on new threat intelligence and updated detection algorithms.

To learn more about how to optimize your network security with NDR, click here.