Cyber Threat Intelligence

In the last several years, we’ve seen a disturbing trend—attackers are innovating much faster than defenders are. We’ve seen the “commercialization” of malware, with attack kits available on underground forums for anyone who wants to perpetrate a variety of attacks.

Large botnets are available for rent, allowing attackers to send spam or launch DDoS attacks at will. Many attackers reuse malware and command and control protocols and methods, adapting their products” over time to keep ahead of the anti-malware industry and security professionals. As more and more attacks occur, however, the likelihood increases that some organization or group has seen the attack before. 

The idea behind cyber threat intelligence is to provide the ability to recognize and act upon indicators of attack and compromise scenarios in a timely manner. While bits of information about attacks abound, cyber threat intelligence (CTI) recognizes indicators of attacks as they progress, in essence putting these pieces together with shared knowledge about attack methods and processes. 

Read more in the the SANS paper

"Who’s Using Cyberthreat Intelligence and How?"

Stay Safe!

Joe