How can you use threat intelligence to protect your organization?

The four types of Threat Intelligence—Strategic, Tactical, Operational, and Technical—are often misunderstood and at times misapplied. The first three categories, Strategic, Tactical, and Operational, are primarily borrowed from the military field. This borrowing can result in some confusion, especially between Operational and Tactical intelligence, leading to overlaps. Additionally, in my opinion, there is no point to distinguish Technical Threat Intelligence as a separate category as it serves as the foundation and can be integrated throughout all levels of intelligence. My 2c :)

Building a robust CTI program offers several advantages and finds applications across a wide range of domains, but it may be difficult to establish. You need to set a clear strategy, recruit resources to employ as CTI analysts, define the right methodology for the analysis, understand how to collect high-quality information, improve internal collaboration, buy threat intelligence platforms (TIP), enhance automation, and create deliverables to add real value to your organization. This may cost a lot, and the whole process could easily fail. For this reason, using a threat intelligence managed service could prove to be the best choice for improving an organization's security posture and withstanding cyber attacks.

Threat intelligence offers a comprehensive understanding of the cybersecurity landscape. It goes beyond identifying dangers by providing context, answering the 'why' and 'how' behind threats. Integrating this intelligence reshapes defense strategies, transitioning from mere reactive measures to proactive preparation.

It is indeed so crucial to explain what is Threat Intelligence ... I used to present it using the four pillars : Strategic, Tactical, Operational and Technical - First : it helps to introduce the global portolio from the CTI producer I used to work for. it helps to make sure the audience get the whole picture ... Second : I especialy keep the technical pillar to make sure people understand CTI is not only machine readable threat indicators which usually tarket a specifics audience : network monitoring for instance. So just at the pedagogic point of view, I would keep the technical pillar ... and maybe we would avoid this idea : "I've already susbscribed to some feeds so I have CTI"

Threat intelligence transcends mere data, serving as the very bedrock of a proactive cybersecurity strategy. While the compartmentalization into strategic, tactical, operational, and technical provides structure, it's essential to remember that in the rapidly evolving cyber landscape, fluidity between these types is vital. A piece of tactical intelligence today could reshape strategic decision-making tomorrow. Effective threat intelligence bridges the gap between abstract cyber risks and tangible threats, ensuring that defenses are attuned not just to historical threats but to emerging ones as well.

Most organizations don't understand what real threat intelligence is, and therefore don't know the benefits. There are many misconceptions about threat intelligence, for example it's just pulling IOC feeds from vendors, or it's using a threat intelligence service to tell them about upcoming attacks on the "dark web". Whilst these things make up the collection elements of intel, the true benefit of threat intelligence is the blend of turning raw threat data into actionable insight, and prioritization based on what your organization is truly worried about or wants to protect. Intelligence essentially quantifies the what, when, why, who, and how likely the threat is to materalise in the orgs environment.

Threat intelligence is crucial because just having security tools isn't enough. With cyber threats becoming more sophisticated, you need insights into who's out there trying to target you, their methods, and their motivations. Threat intelligence helps you be proactive, not just reactive. Without it, you're essentially navigating the cyber world blindfolded.

You need the intelligence to give you context to the data your environment is providing, logs only give you at best high fidelity information without the context the intelligence data provides. For example, if a firewall shows an external IP address making a successful connection to an externally facing resource, without threat intelligence you might not know initially whether the external IP is known bad , the log itself is telling you nothing without that context. Now if you know that IP is definitely bad you will want to take action or monitor more carefully what is happening in your environment, its an indicator of attack (IOA) possibly before they have started to attack in earnest.

With more standards, guidelines and industry frameworks recognising the value of threat intelligence organisations of all sizes and industries adopt this capability as a centrepiece in a more proactive, and threat-informed defence approach. Great! What I have observed though is that often the discussion and perceived benefits and outcomes are mostly of a technical nature, limited to talking about IOCs and TTPs and how it improves detection & response - at the tactical and operational level. Sure this is where it has immediate and tangible impact but there are so much more use cases.

Threat Intelligence is an essential need these days, as it provides proactive intelligence on threats that could be a risk to your sector/organisation. With that it can help you detect and respond to adversaries/APTs providing relevant IOCs and analysis of your organisation infrastructure as well.

Firstly you need to understand what it is you want to collect intelligence on, and why. Formalising your intelligence requirements, understanding what your stakeholders need and how they need to action that information is pivotal. You also need to understand the technologies in use, your external footprint and ideally your supply chain, so you can monitor for things of relevance and respond in a timely manner. You also want to move away from historical data such as IOC feeds and be more proactive in detection and mitigation of threats. This is a long journey for most organisations but can be achieved with the appropriate support from the top down.

Almost every infosec vendor offers a threat intel feed these days, often based on a combination of activity they see across their customer base, as well as sensors across the internet, and other feeds. The challenge is determining how relevant that data is to your threat landscape, how heavy of a weight do you assign it when making policy or automated actions, because the vendor will almost never tell you the source or reasoning behind any specific entry in their threat intel feed. Having your own home-grown threat intel feed is just as important. Being able to cross reference the two adds confidence to automated decisions.

There are multiple ways to collect threat intelligence including: - OSINT: news articles, social media, forums, and blogs, about information on emerging threats, vulnerabilities, and attack tactics. - Paid feeds - Industry-specific Information Sharing and Analysis Organizations to exchange threat information with peers. - Threat intelligence reports and alerts from government agencies like Cert-IN, US Cert - Threat intelligence reports from security vendors - Dark Web Monitoring - Own incident data - Honeypots and Decoys

Collection and sources of Intelligence for Threats are usually based on Threat Feeds, ASM tools, Dashboards and commercial or OSINT based sources. Varying on needs and conditions one can implement different frameworks, tools as well as vendor based feeds to get needed intelligence.

While the division between internal and external sources is well-understood, the nuance lies in discerning signal from noise. With a deluge of threat indicators pouring in daily, a successful threat intelligence operation discerns relevant data from irrelevant. It's not the quantity but the quality and relevance of data that matters. Leveraging tools like TIPs is invaluable, but integrating human expertise ensures the extracted intelligence aligns with the organizational context, maximizing its actionable potential.

Analysis of the correct as well as relevant information is about connecting Dots, analysing facts and verifying them as well. As vast the whole cyberspace is, we investigators should only accept information with relevant facts and data sources. Converting raw information to intelligence is a crucial task as information can be easily tempered in the open source. Proactive research and analysis is required as Human based sources are more reliable than tools.

1. Use the diamond model 2. collect and normalize the IOCs 3. analyze the timeline and historical data 4. TTP analysis 5. Correlation etc.

Analysis turns raw data into a strategic asset. However, the true expertise lies not just in employing frameworks like the Diamond Model or the MITRE ATT&CK Matrix but in customizing and evolving them to fit an organization's unique threat profile. An adaptive approach to analysis, which combines the precision of automation with the nuance of human expertise, helps in understanding the subtleties of threats, uncovering patterns that might remain hidden to purely algorithmic approaches.

Threat intelligence analysis is not only a technical skill, but also a critical thinking skill. It requires not only tools and frameworks, but also logic and creativity. Therefore, threat intelligence analysts should have a good understanding of the problem, the data, and the solution. They should also be able to question, challenge, and validate their assumptions and findings, and generate alternative hypotheses and scenarios.

To share threat intelligence effectively, utilize centralized platforms, join industry-specific groups, adopt standardized formats like STIX, and integrate real-time threat feeds. Always prioritize confidentiality, engage in regular intelligence briefings, and establish a feedback system for continuous improvement. This collaborative approach amplifies collective cybersecurity defenses.

Threat intelligence sharing is not only a technical process, but also a social one. It requires not only data and tools, but also norms and values. Therefore, threat intelligence sharers should follow some best practices and standards, such as the Traffic Light Protocol (TLP), the STIX and TAXII formats, or the FIRST framework, to ensure the quality, security, and privacy of the data, as well as the trust and cooperation among the participants.

The sharing of threat intelligence amplifies its value exponentially, cultivating a collaborative defense against shared adversaries. While the technological aspect of sharing—ensuring data consistency, security, and privacy—is pivotal, the human aspect is equally significant. Building a trusted community of organizations and stakeholders fosters a collective defense, ensuring that one organization's detection becomes another's prevention. As the adage goes, "Unity is strength."

Threat intelligence sharing is pivotal in today's interconnected digital landscape. While its benefits are clear, the challenges highlight a need for trust and transparency. I wonder, "How can we cultivate genuine collaboration in an often secretive industry?" Beyond just data precision, building trusting relationships is key for a safer digital ecosystem.

The reason people try to bring intelligence into existing tools is that they want one place to go to identify threats, the intelligence gives the context that is much needed to make a decision how to respond to that threat. I find that businesses without experience do not get value from intelligence alone, its like drinking from a fire hose there is too much to unpack, to use intel effectively you need to reduce the noise and work out how you will use the intelligence. It needs to be part of your process to regularly review logs and other security products alerts, the intelligence helps to prioritise the threat. Intelligence might show that you are a big target at the moment because a tool you use has a new vulnerability for example.

Using threat intelligence isn't about mere integration into existing systems; it's about transformation. Properly leveraged, threat intelligence transforms reactive security postures into proactive defense strategies. It's akin to having a weather forecast in a sea voyage. You won't just be responding to storms as they hit, but you'll be navigating around them, ensuring smoother and safer journeys. However, the forecast's accuracy and timeliness, akin to threat intelligence, make all the difference.

You can integrate your threat intelligence feed (E.g TAXII) with your SIEM data to enrich it and give you a overall picture of your monitored IT threat landscape. This allow you to understand what type of threats the organization is facing and taking the additional steps to mitigate the threats.

TI helps proactive monitoring for emerging threats, implement informed security measures to mitigate risks and improve security posture

From a small business perspective, trying to run your own threat intelligence analysis in-house is not cost effective. Arguably, you may not even be able to afford subscribing to one of the paid threat intelligence services. So what's the best low budget option? When you're selecting a security vendor, choose one that performs their own threat intelligence research and uses that to inform the service they provide you.

While the technical facets of threat intelligence are widely discussed, a more philosophical consideration is its ethical implications. In the era of information warfare, discerning the authenticity and intent behind threat intelligence becomes paramount. Engaging in red teaming and wargaming can offer organizations real-world insights into their resilience, providing context to the intelligence gathered. In the end, threat intelligence isn't a mere tool but a mindset—a commitment to staying one step ahead in the ever-evolving cyber chess game.

Leveraging on threat intelligence feeds to enrich your SIEM data and to built an effective SOAR (Security Orchestration, automation and response) to mitigate threats in real-time would be the goal.