登录查看更多内容

How do you create a threat intelligence framework for your organization?

由人工智能和领英社区提供技术支持

Threat intelligence is the process of collecting, analyzing, and sharing information about current and emerging threats to your organization's assets, operations, and reputation. A threat intelligence framework is a set of guidelines and best practices that help you plan, execute, and improve your threat intelligence activities. In this article, you will learn how to create a threat intelligence framework for your organization in six steps.

此文章中的业界达人

由社区从 6 条内容中精选。了解更多

Daniel Kwong

CISO at Fortinet North Asia | Cybersecurity Top of Mind | Data Science Enthusiast | Executive experience in C-level IT…
Keaton Fisher

Supporting Threat Intelligence Teams at Silobreaker | Cybersecurity & Digital Privacy Writer | Customer Success Manager
Pranay Kokane

All Things CTI | LinkedIn Top Voice | Executive Member- CyberEdBoard | Ex.McKinsey & Company | Ex.Morgan Stanley |…

1 Define your objectives

The first step is to define your objectives for threat intelligence. What are the specific questions you want to answer, the problems you want to solve, or the decisions you want to support with threat intelligence? For example, you may want to identify the most likely attackers, their tactics, techniques, and procedures (TTPs), their motivations and goals, and their indicators of compromise (IOCs). You may also want to assess your own vulnerabilities, risks, and mitigation strategies. Your objectives should be SMART: specific, measurable, achievable, relevant, and time-bound.

添加您的观点

Keaton Fisher

Supporting Threat Intelligence Teams at Silobreaker | Cybersecurity & Digital Privacy Writer | Customer Success Manager
举报内容
This step is commonly referred to as the Planning stage in the threat intelligence lifecycle and typically entails sitting down with stakeholders to create these requirements. Active listening techniques can be a valuable asset here as many of the stakeholders you speak to will all have different requirements in their own, unique "language". The goal of the threat intelligence function should be to produce actionable, valuable intelligence.

已翻译

赞

2 Identify your sources

The second step is to identify your sources of threat intelligence. There are four main types of sources: open, closed, internal, and external. Open sources are publicly available information, such as blogs, reports, news, and social media. Closed sources are restricted or paid information, such as threat intelligence platforms, dark web forums, or private groups. Internal sources are data from your own organization, such as logs, alerts, incidents, or feedback. External sources are data from your partners, customers, suppliers, or peers, such as threat sharing platforms, reports, or surveys. You should evaluate your sources based on their reliability, relevance, timeliness, and completeness.

添加您的观点

Keaton Fisher

Supporting Threat Intelligence Teams at Silobreaker | Cybersecurity & Digital Privacy Writer | Customer Success Manager
举报内容
An example I've seen is to map out your collections/sources to your requirements. Once you have your intelligence requirements, evaluate each of them individually and attach the sources you'll need to satisfy them. For example, Stakeholder A wants reports on relevant vulnerabilities in your organization's tech stack. What sources of information could we use to satisfy Stakeholder A's needs? Most likely, we'll need external sources where we can find vulnerabilities and internal sources to compile a list of our technologies.

已翻译

赞

3 Collect and process your data

The third step is to collect and process your data from your sources. You should use automated tools and methods to gather, filter, normalize, enrich, and store your data. For example, you can use web crawlers, APIs, parsers, scripts, or databases. You should also use human analysts to validate, verify, and contextualize your data. For example, you can use research, investigation, or collaboration skills. You should follow the data protection and privacy laws and regulations that apply to your organization and your sources.

添加您的观点

4 Analyze and produce your intelligence

The fourth step is to analyze and produce your intelligence from your data. You should use analytical techniques and frameworks to identify patterns, trends, correlations, anomalies, and insights from your data. For example, you can use the Diamond Model, the Kill Chain Model, the MITRE ATT&CK Framework, or the Cyber Threat Framework. You should also use visualization tools and methods to present your intelligence in a clear, concise, and actionable way. For example, you can use charts, graphs, maps, dashboards, or reports.

添加您的观点

5 Disseminate and consume your intelligence

The fifth step is to disseminate and consume your intelligence to your stakeholders. You should use communication tools and methods to deliver your intelligence to the right people, at the right time, in the right format, and with the right level of detail. For example, you can use email, chat, webinars, or briefings. You should also use feedback tools and methods to collect and measure the impact, value, and satisfaction of your intelligence. For example, you can use surveys, metrics, or reviews.

添加您的观点

Daniel Kwong

CISO at Fortinet North Asia | Cybersecurity Top of Mind | Data Science Enthusiast | Executive experience in C-level IT Management
举报内容
In addition to how to process threat intelligence data. It is also important to consider the threat intelligence sharing from two prospective, both internally and externally. Internally, make sure protection and detection tools has ability to understand and automate remediation for treat intelligence generated by others. For example, EDR detected an abnormally, an IOC is being built and submit to SOC that confirmed it is a threat. SOC need to have ability to automate and broadcast to all cyber security tools in the network to activate block/remediation actions.

已翻译

赞

6 Review and improve your framework

The sixth and final step is to review and improve your framework based on your results, feedback, and lessons learned. You should use evaluation tools and methods to assess the strengths, weaknesses, opportunities, and threats of your framework. For example, you can use SWOT analysis, gap analysis, or benchmarking. You should also use improvement tools and methods to implement changes, enhancements, or innovations to your framework. For example, you can use PDCA cycle, agile methodology, or continuous learning.

添加您的观点

Daniel Kwong

CISO at Fortinet North Asia | Cybersecurity Top of Mind | Data Science Enthusiast | Executive experience in C-level IT Management
举报内容
Externally, cyber security is a team sport, depends on your industry, CISO should actively involve threat intelligence Sharing amongst communication and follow The Traffic Light Protocol (TLP version 2) best practices standard with Forum of Incident Response and Security Teams (FIRST).

已翻译

赞

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Pranay Kokane

All Things CTI | LinkedIn Top Voice | Executive Member- CyberEdBoard | Ex.McKinsey & Company | Ex.Morgan Stanley | Ex.HDFC Bank | Threat Intelligence | Threat Hunt | AI | SIBM
举报内容
In addition to the points mentioned, to effectively manage intelligence activities, we need to prioritize intelligence requirements(PIR) based on the criticality of the decisions they support. For example, identifying a new threat actor is less important than understanding the capabilities of an existing threat actor who has changed their intent to sabotage. By prioritizing intelligence requirements, we can ensure that our intelligence activities are focused on the most important information that can help us make informed decisions.

已翻译

赞
Ayoub Khlifi

Cyber Security Engineer || Data Scientist (MSc)
举报内容
Threat Intelligence is a broad topic indeed. However, being aligned with a unified process can succeed the mission. Once it's efficiently implemented, entreprise can defeat the most complicated cyber threats.

已翻译

赞

Information Security

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you create a threat intelligence framework for your organization?

1

2

3

4

5

6

7

1 Define your objectives

2 Identify your sources

3 Collect and process your data

4 Analyze and produce your intelligence

5 Disseminate and consume your intelligence

6 Review and improve your framework

7 Here’s what else to consider

Information Security

给文章评分

感谢您的反馈

更多Information Security相关文章

更多相关阅读内容

How do you create a threat intelligence framework for your organization?

1

2

3

4

5

6

7

1 Define your objectives

2 Identify your sources

3 Collect and process your data

4 Analyze and produce your intelligence

5 Disseminate and consume your intelligence

6 Review and improve your framework

7 Here’s what else to consider

Information Security

给文章评分

感谢您的反馈

查看其他技能