Unlocking the Power of Threat Intelligence: Navigating the Evolving Cybersecurity Landscape

Organisations face an ever-increasing array of cybersecurity threats in today's world. As cyber criminals become more sophisticated and relentless in their attacks, the need for proactive and effective defence strategies has never been greater. This is where threat intelligence comes into play.

What is Threat Intelligence?

Threat intelligence is the process of gathering, analysing, and disseminating information about potential or current threats to an organisation's assets, operations, and reputation. It enables security teams to make informed decisions, prioritise resources, and stay one step ahead of adversaries.

Threat intelligence encompasses a wide range of information, including:

• Indicators of Compromise (IoCs): specific pieces of forensic data, such as IP addresses, domain names, or file hashes, that indicate a potential intrusion
• Tactics, Techniques, and Procedures (TTPs): the methods and behaviour used by threat actors to carry out their attacks
• Threat Actor Profiles: detailed information about the motivations, capabilities, and historical activities of specific adversaries
• Vulnerability Information: data about known software vulnerabilities and associated exploit methods
• Geopolitical Context: information about the broader political, economic, and social factors that may influence threat actor behaviour

By aggregating and analysing this diverse information set, threat intelligence provides a comprehensive view of the threat landscape. It helps organisations prioritise defences based on the most relevant and impactful risks.

Why is Threat Intelligence Important?

According to a recent report by the Ponemon Institute [https://www.ponemon.org/], organisations that leverage threat intelligence experience:

• Faster detection and response times: Threat intelligence provides early warning of emerging threats, allowing security teams to identify and contain incidents more quickly
• Reduced costs associated with data breaches: By prioritising defences based on the most relevant threats, organisations can minimise the likelihood and impact of successful attacks
• Improved overall security posture: Threat intelligence helps organisations identify and address gaps in their defences, leading to a more resilient and adaptive security posture

78% of respondents believe threat intelligence is essential to a robust security infrastructure. However, implementing an effective threat intelligence programme has its challenges:

• The sheer volume and complexity of threat data can be overwhelming: With countless sources available, it can be challenging to identify the most relevant and actionable information.
• Extracting actionable insights from the noise can be tricky: Raw threat data often requires significant analysis and contextualisation to be useful for decision-making.
• The rapidly evolving nature of the threat landscape requires continuous intelligence updates and refinements: As threat actors adapt their tactics and new vulnerabilities emerge, threat intelligence must keep pace to remain relevant.

Organisations need a structured and strategic approach to threat intelligence to overcome these challenges that aligns with their unique risk profile and business objectives.

Types of Threat Intelligence

1. Strategic Threat Intelligence

• Provides high-level insights into the overall threat landscape
• Informs executive decision-making and guides long-term security strategies
• Examples: annual threat reports, industry-specific risk assessments, geopolitical analysis

Strategic threat intelligence focuses on the "big picture" of cybersecurity risks. It gives decision-makers a broad understanding of the threat landscape, including emerging trends, high-level patterns, and geopolitical factors that may influence threat actor behaviour.

This type of intelligence is typically less technical and more focused on business impact. It helps executives and board members understand the organisation's overall risk posture and make informed decisions about cybersecurity investments and priorities.

Examples of strategic threat intelligence include:

• Annual Threat Reports: comprehensive assessments of the global threat landscape, including an overview of major threat actors, their motivations, and observed activities over the past year
• Industry-Specific Risk Assessments: analyses of the unique cybersecurity risks facing industries, such as financial services, healthcare, or energy
• Geopolitical Analysis: an examination of how international relations, economic conditions, and political events may shape the behaviour of nation-state threat actors

Senior leadership typically consumes strategic threat intelligence to guide long-term security strategy and investment decisions.

2. Tactical Threat Intelligence

• Focuses on specific tactics, techniques, and procedures (TTP) used by adversaries
• Provides detailed information about tools, malware, infrastructure, and indicators of compromise (IoCs)
• Consumed by security operations teams to fine-tune detection and response capabilities

Tactical threat intelligence focuses on the specific methods and tools used by threat actors. It provides detailed technical information that security teams can use to detect, prevent, and respond to attacks.

This type of intelligence often includes:

• Indicators of Compromise (IoCs): specific artefacts that can be used to detect malicious activity, such as IP addresses, domain names, file hashes, or registry keys
• Malware Analysis: detailed technical analysis of the functionality, behaviour, and origins of malicious software
• Infrastructure Analysis: mapping of the command-and-control servers, domains, and other infrastructure used by threat actors
• Tactics, Techniques, and Procedures (TTPs): descriptions of the specific operational methods used by threat actors, often mapped to frameworks like MITRE ATT&CK

Security operations teams, incident responders, and threat hunters typically consume tactical threat intelligence. It tunes detection systems, investigates potential incidents, and develops countermeasures against specific attack methods.

Examples of tactical threat intelligence include:

• Indicator Feeds: real-time streams of IoCs associated with ongoing threats, often machine-readable for easy integration into security tools
• Malware Analysis Reports: in-depth technical analysis of specific malware samples, including behavioural descriptions, code analysis, and attribution
• TTP Profiles: detailed descriptions of the specific tactics, techniques and procedures used by a particular threat actor or in a specific attack campaign

3. Operational Threat Intelligence

• Precise and actionable information about imminent or ongoing attacks
• Enables rapid response and mitigation efforts
• Often sourced from real-time monitoring and incident response activities

Operational threat intelligence provides immediately actionable information about specific, imminent threats. It is highly focused and often relates to an ongoing incident or a threat that is likely to manifest in the near term.

This type of intelligence may include:

• Alerts about active attack campaigns targeting a specific sector or organisation
• Detailed information about a newly discovered vulnerability being actively exploited in the wild
• Contextual information about an ongoing incident, such as the scope of impact, attribution, and mitigation steps

Operational threat intelligence is typically very short-lived in its relevance. It requires rapid dissemination and action to be effective.

This type of intelligence is often generated and consumed by incident response teams and security operations centres. It guides real-time defence efforts, prioritises patches, and coordinates response activities.

Examples of operational threat intelligence include:

• Security Alerts: notifications of active threats, often delivered via email, SMS, or messaging platforms
• Incident Notifications: formal declarations of an ongoing security incident, often including details about the nature of the attack, affected systems, and response actions
• Vulnerability Advisories: urgent notifications of a newly discovered vulnerability, often including details about active exploitation and recommended mitigation steps

Sources of Threat Intelligence

1. Open-Source Intelligence (OSINT)

• Publicly available information (news articles, social media, online forums)
• Valuable insights but time-consuming to collect and analyse

OSINT is information collected from publicly available sources. In the context of threat intelligence, this often includes:

• News Articles and Media Reports: journalistic coverage of cybersecurity incidents, threat actor activities, and industry trends
• Social Media Posts: discussions and announcements related to cybersecurity on platforms like Twitter, LinkedIn, and Reddit
• Academic Publications: research papers and reports on cybersecurity topics, often published by universities, think tanks, and research institutions
• Public Sector Reports: cybersecurity guidance, alerts, and threat assessments published by government agencies and international organisations
• Conference Presentations: slides and recordings of talks given at cybersecurity conferences and events
• Blog Posts: expert commentary and analysis published on personal or corporate blogs
• Online Forums and Discussion Boards: discussions of cybersecurity topics on specialised online communities, often frequented by security researchers and practitioners

OSINT's main advantage is that it is widely available and often free. It can provide valuable insights into emerging trends, threat actor behaviours, and new attack techniques.

However, OSINT can also be time-consuming to collect and analyse. The sheer volume of available information can be overwhelming, and it can be challenging to separate signal from noise. OSINT also often needs more depth and specificity of other types of threat intelligence.

Tips for leveraging OSINT:

• Identify key sources: Focus on a core set of reliable, high-quality sources most relevant to your organisation and industry.
• Use aggregation tools: Leverage tools such as RSS feeds, news aggregators, and social media monitoring platforms that can help you collect and filter OSINT automatically.
• Collaborate with peers: Participate in industry groups and information-sharing communities to collectively source and analyse OSINT.
• Contextualise and corroborate: Always try to corroborate OSINT with other sources and consider each source's credibility and potential biases.

2. Commercial Threat Intelligence

• Outsourced services ranging from raw data feeds to fully managed intelligence programmes
• Well-known providers: Recorded Future, FireEye, CrowdStrike

Commercial threat intelligence providers offer various services to help organisations navigate the complexities of the threat landscape. These can range from raw data feeds of indicators and threats to fully managed intelligence services that include analysis, reporting, and operational support.

The main advantages of commercial threat intelligence include:

• Expertise: Commercial providers often have dedicated teams of researchers and analysts focused full-time on tracking and understanding threats. This can provide expertise and insight that is difficult to maintain in-house.
• Scale: Commercial providers typically have access to a broader range of data sources and can process and analyse information at a scale that individual organisations cannot match.
• Integration: Many commercial providers offer threat intelligence in formats that are easy to integrate into existing security tools and workflows, such as SIEM, EDR, and SOAR platforms.
• Customisation: Some commercial providers offer customised threat intelligence services tailored to an organisation's specific needs and risk profile.

However, commercial threat intelligence can also be expensive, and the quality and relevance of the intelligence can vary significantly between providers. It's essential to carefully evaluate the offerings of different providers and choose one that aligns well with your organisation's needs and budget.

Tips for leveraging commercial threat intelligence:

• Define your requirements: Clearly articulate what you need from a threat intelligence service regarding data types, analysis, integration, and support.
• Evaluate multiple providers: Compare the offerings and reputation of multiple providers and request samples or trials where possible.
• Integrate with your workflow: Ensure that the threat intelligence can be easily integrated into your existing security tools and processes.
• Provide feedback: Regularly provide feedback to your provider about the relevance and quality of the intelligence you're receiving.

3. Government and Industry Partnerships

• Information sharing through formal partnerships and platforms
• Example: U.S. Department of Homeland Security's Automated Indicator Sharing (AIS) programme

Government and industry partnerships are an important source of threat intelligence. Many countries have established formal programs to facilitate the sharing of cybersecurity information between the public and private sectors.

Examples include:

• United States: The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) operates the Automated Indicator Sharing (AIS) program, which allows the real-time exchange of machine-readable cyber threat indicators between the U.S. government and the private sector.
• United Kingdom: The National Cyber Security Centre (NCSC), a part of GCHQ, operates the Cyber Security Information Sharing Partnership (CiSP), which enables UK organisations to share cybersecurity information in a secure and confidential environment.
• Australia: The Australian Cyber Security Centre (ACSC) operates the Cyber Security Information Sharing Platform (CSISP), which facilitates the sharing of cybersecurity information between the Australian government and the private sector.

Industry-specific Information Sharing and Analysis Centers (ISACs) also facilitate the exchange of threat intelligence within sectors such as financial services, healthcare, and energy.

The main advantage of these partnerships is that they provide a trusted channel for sharing sensitive cybersecurity information, often with some level of government vetting or validation. They can also provide access to unique government-sourced intelligence, such as information from classified sources.

However, the intelligence shared through these partnerships can sometimes be delayed or sanitised to protect sensitive sources and methods. Participation also often requires a formal membership or vetting process.

Tips for leveraging government and industry partnerships:

• Join relevant partnerships: Identify and join the government and industry partnerships that are most relevant to your sector and region.
• Establish internal sharing processes: Develop transparent internal processes for sharing intelligence from these partnerships with the appropriate teams and stakeholders.
• Contribute back: When appropriate, actively contribute intelligence back into these partnerships to support the collective security of your industry.
• Leverage existing relationships: If your organisation has existing relationships with government agencies, use these to access additional threat intelligence.

4. Internal Telemetry

• Data from internal sources (network logs, security events, user activity)
• Specific to an organisation's unique environment and risk profile

An organisation's internal data is one of the most valuable but often under-utilised sources of threat intelligence. This includes telemetry from networks, endpoints, security tools, and data on user activity and business operations.

Examples of internal telemetry that can be used for threat intelligence include:

• Network Logs: Data on network traffic, including source and destination IP addresses, ports, protocols, and volume of data transferred.
• Endpoint Logs: Data from endpoints such as workstations and servers, including process execution, file access, and system changes.
• Security Tool Alerts: Alerts and events generated by security tools such as firewalls, intrusion detection systems, and endpoint protection platforms.
• User Activity Data: Information on user logins, access attempts, and resource usage, often from identity and access management systems or application logs.
• Business Process Data: Data on key business processes and transactions can be used to identify anomalous or high-risk activity.

The main advantage of internal telemetry is that it is specific to an organisation's unique environment and risk profile. It can provide visibility into threats and vulnerabilities that are directly relevant to the organisation, and that may not be captured by external sources.

However, collecting and analysing internal telemetry can be challenging. It requires robust data collection and storage infrastructure and the skills and tools to analyse large volumes of data and identify meaningful patterns and anomalies.

Tips for leveraging internal telemetry:

• Identify key data sources: Identify the critical sources of security-relevant data within your organisation, including networks, endpoints, security tools, and business systems.
• Establish data collection and storage: Establish the necessary infrastructure to collect, store, and manage this data securely and efficiently.
• Invest in analytics capabilities: Develop or acquire the tools and skills to analyse this data and extract actionable intelligence, such as security information and event management (SIEM) platforms, user and entity behaviour analytics (UEBA), and machine learning-based anomaly detection.
• Integrate with external intelligence: Use external threat intelligence to provide context and enrich your analysis of internal telemetry.

Operationalising Threat Intelligence

Collecting and analysing threat intelligence is only half the battle. To be truly effective, intelligence must be operationalised and integrated into an organisation's security processes and decision-making frameworks:

1. Define Intelligence Requirements

• What threats are most relevant?
• What level of detail and timeliness is required?
• Who will consume the intelligence, and how will it be used?

The first step in operationalising threat intelligence is to define precise requirements. This involves understanding what types of intelligence are most relevant to your organisation, based on your unique risk profile, industry, and business objectives.

Key questions to consider include:

• What are our most critical assets and processes, and what threats could impact them?
• What are our key risk areas based on our industry, geography, and technology profile?
• What level of detail and timeliness do we require in our intelligence?
• Who are the key intelligence consumers within our organisation, and what are their specific needs?

Tips for defining intelligence requirements:

• Engage stakeholders: Involve a broad range of stakeholders in the process, including security teams, IT, business units, and executives.
• Prioritise based on risk: Focus on the threats that pose the highest potential impact on your most critical assets and processes.
• Be specific: Clearly articulate the types of intelligence needed, the required level of detail, and the desired frequency of updates.
• Align with existing processes: Ensure that your intelligence requirements align with and support your existing risk management, incident response, and security operations processes.

2. Establish Collection and Analysis Processes

• Combine automated tools and manual analysis
• Create a clear pipeline from raw data to actionable intelligence

Once you've defined your intelligence requirements, the next step is establishing processes for collecting and analyzing relevant threat data.

This typically involves a combination of automated tools and manual analysis. Automated tools can help collect and process large volumes of raw data from various sources, while manual analysis is necessary to provide context, identify patterns, and extract actionable insights.

Critical components of a threat intelligence collection and analysis process include:

• Data Aggregation: Collecting raw threat data from multiple sources, including open-source, commercial, industry, government, and internal telemetry.
• Data Processing: Filtering, normalising, and enriching raw data to make it more usable and relevant, often using automated tools and scripts.
• Analysis and Contextualisation: Manually reviewing processed data to identify patterns, trends, and insights and provide context based on understanding the threat landscape and the organisation's risk profile.
• Production and Dissemination: Packaging the resulting intelligence into formats that are easy to consume and act upon, such as reports, alerts, or data feeds, and disseminating it to relevant stakeholders.

Tips for establishing collection and analysis processes:

• Automate where possible: Use tools to automate the collection, processing, and integration of threat data wherever possible, to improve efficiency and timeliness.
• Leverage frameworks: Use established threat intelligence frameworks, such as MITRE ATT&CK, to provide structure and consistency to your analysis.
• Foster collaboration: Encourage collaboration and information sharing among your analysis team and other parts of the organisation.
• Ensure quality control: Implement processes for reviewing and validating intelligence before it is disseminated to ensure accuracy and relevance.

3. Integrate with Security Tools and Processes

• Feed indicators of compromise into SIEM and IDS/IPS systems
• Use intelligence to prioritise vulnerability management efforts
• Incorporate threat data into incident response playbooks

Threat intelligence needs to be integrated into an organisation's security tools and processes to be actionable. This allows the intelligence to inform real-time defense efforts and guide proactive security measures.

Critical areas for integration include:

• Security Monitoring: Feed indicators of compromise (IoCs) and other threat data into your security information and event management (SIEM), intrusion detection/prevention systems (IDS/IPS), and other monitoring tools to enable real-time detection of threats.
• Vulnerability Management: Use threat intelligence to prioritise vulnerability scanning and patching efforts, focusing on the vulnerabilities that are most likely to be exploited based on current threat trends.
• Incident Response: Incorporate threat intelligence into your incident response playbooks and processes, using it to guide investigation and mitigation efforts and to inform root cause analysis and post-incident learning.
• Threat Hunting: Use threat intelligence to guide proactive threat hunting efforts, searching for signs of compromise or attacker activity that may have evaded detection.

Tips for integrating threat intelligence:

• Leverage standards: Use standard formats and protocols for sharing threat intelligence, such as STIX/TAXII, to enable easier tool integration and sharing with partners.
• Prioritise automation: Automate the ingestion and application of threat intelligence in security tools wherever possible, to improve speed and consistency.
• Train teams: Ensure that security teams are trained on how to interpret and use threat intelligence in their daily work.
• Measure effectiveness: Track metrics on how threat intelligence is used and its impact on security outcomes to demonstrate value and identify areas for improvement.

4. Establish Metrics and Feedback Loops

• Measure the effectiveness of the threat intelligence programme
• Track metrics like time to detection, false positive rates, and incidents prevented or mitigated

To ensure that your threat intelligence program is effective and continually improving, it's important to establish metrics and feedback loops.

Key metrics to track include:

• Time to Detection: The time between when a threat first emerges and when it is detected by your organization. Practical threat intelligence should help reduce this time.
• False Positive Rate: The percentage of alerts or detections that are not threats. Good threat intelligence should help reduce false positives by providing context to distinguish real threats from benign activity.
• Incidents Prevented or Mitigated: The number of potential incidents prevented or mitigated due to the use of threat intelligence. This could include attacks that were blocked, vulnerabilities that were patched, or compromises that were detected and contained early.
• Intelligence Utilization: Measures of how widely and consistently threat intelligence is being used across the organisation, such as the percentage of security alerts enriched with threat intelligence.

In addition to tracking metrics, it's important to continually establish feedback loops to improve your threat intelligence. This could include:

• Regular Reviews: Review your threat intelligence regularly with stakeholders to gather feedback on its relevance, timeliness, and actionability.
• Post-Incident Analysis: Review how threat intelligence was or could have been used after major incidents and identify gaps or areas for improvement.
• Threat Intel Provider Feedback: Provide regular feedback to your commercial threat intelligence providers on the quality and relevance of their intelligence.
• Peer Benchmarking: Share and compare practices and metrics with peer organisations to identify best practices and areas for collective improvement.

Tips for establishing metrics and feedback loops:

• Start simple: Begin with a small set of key metrics and expand over time as your program matures.
• Align with business goals: Choose metrics that align with and demonstrate support for critical business goals and risk priorities.
• Automate data collection: Use tools to automatically collect and report on key metrics wherever possible.
• Make it actionable: Ensure that metrics and feedback are regularly reviewed and used to drive improvements in your threat intelligence and security practices.

Challenges and Pitfalls

1. Information Overload

• Focus on intelligence most relevant to specific needs and risk profile

One of the biggest challenges in threat intelligence is the sheer volume of available data. With countless threat information sources, it can be easy to become overwhelmed and lose focus.

To combat this, you must be selective about the intelligence you collect and use. Focus on sources and data that are most relevant to your specific industry, technology stack, and risk profile. Use your defined intelligence requirements as a guide, and regularly reassess the value and relevance of your sources.

Tips for managing information overload:

• Prioritise quality over quantity: Focus on fewer high-quality, relevant sources rather than trying to consume everything.
• Leverage automation: Use tools to automatically filter and prioritise incoming data based on relevance and severity.
• Assign clear responsibilities: Assign responsibilities for monitoring and analysing different types of threat intelligence to ensure focus and avoid duplication of effort.
• Regularly curate sources: Review and prune your intelligence sources to ensure they remain relevant and valuable.

2. False Positives

• Tune detection systems carefully
• Establish processes for quickly identifying and dismissing false positives

Another common challenge in threat intelligence is dealing with false positives—alerts or detections that are not actually indicative of a real threat. If they are too frequent, false positives can waste time and resources and lead to alert fatigue.

To reduce false positives, it's essential to tune your detection systems and rules carefully. This involves setting appropriate thresholds, using contextual data to validate alerts, and continually refining regulations based on feedback.

It's also essential to have transparent processes for quickly identifying and dismissing false positives when they occur. This could involve automated triage based on specific criteria, human review and validation.

Tips for managing false positives:

• Tune rules carefully: Spend time carefully tuning detection rules and thresholds to minimise false positives while still catching real threats.
• Leverage context: Use contextual data, such as asset criticality or user behaviour, to help validate whether an alert will likely be a true positive.
• Automate triage: Set up automated processes to automatically dismiss or de-prioritise certain types of low-confidence alerts.
• Learn from false positives: Regularly review false positives and use them to inform improvements to your detection rules and processes.

3. Stale Intelligence

• Continuously update and refresh intelligence.
• Subscribe to real-time threat feeds, participate in information-sharing communities.

Threat intelligence has a short shelf life. As threats evolve and attackers change tactics, intelligence can quickly become outdated and less relevant.

To ensure that your intelligence remains fresh and actionable, it's essential to have processes in place to update and refresh intelligence continuously. This could involve subscribing to real-time threat data feeds, participating in information-sharing communities, and regularly re-evaluating and rotating your intelligence sources.

Mechanisms for quickly disseminating new intelligence to all relevant stakeholders so that it can be acted upon in a timely manner are also essential.

Tips for keeping intelligence fresh:

• Automate updates: Use tools to ingest and process updates from your key intelligence sources automatically.
• Participate in sharing communities: Actively participate in threat intelligence sharing communities in your industry to get access to the latest intelligence.
• Set freshness policies: Establish clear policies for how long intelligence is considered valid and processes for archiving or removing stale data.
• Prioritise speed of dissemination: Ensure you have fast, automated processes for pushing new intelligence to security tools and teams.

4. Lack of Context

• Invest in people and processes to provide context and make intelligence actionable

Raw threat data is of limited use without the context to make it actionable. Indicators of compromise, for example, are only valuable if you understand what they indicate and how they relate to your specific environment.

To provide this context, investing in the people and processes to analyse and interpret threat intelligence is essential. This includes having skilled threat analysts who can connect the dots between different intelligence pieces, understand your organisation's relevance, and provide actionable recommendations.

It also involves having processes for enriching raw threat data with additional context, such as details about the related malware, the attackers' motivations and targets, and the potential impact of the threat.

Tips for providing context:

• Hire and train skilled analysts: Invest in hiring and training threat analysts with the skills to interpret and contextualise intelligence.
• Leverage structured analysis: Use structured analytic techniques like the Diamond Model or the Kill Chain to analyse and contextualise threats systematically.
• Enrich data: Establish processes for enriching raw threat data with additional context from internal and external sources.
• Collaborate with peers: Collaborate with peers in your industry to share context and analysis about common threats.

Real-World Impact: Case Studies

1. The SolarWinds Breach

• Nation-state actor compromised SolarWinds' software supply chain
• FireEye detected the breach through threat-hunting efforts and shared findings
• Intelligence allowed organisations to quickly identify and mitigate impact

In December 2020, it was revealed that a sophisticated nation-state actor, believed to be associated with Russia, had compromised the software supply chain of SolarWinds, a significant provider of IT management software. The attackers used this access to distribute a malicious update to SolarWinds' Orion platform, which was then installed by thousands of SolarWinds' customers, including numerous U.S. government agencies and Fortune 500 companies.

The breach was first detected and disclosed by FireEye, a leading cybersecurity firm, which discovered the malicious activity through its internal threat-hunting efforts. FireEye quickly shared details about the indicators of compromise and the tactics used by the attackers with the broader cybersecurity community and the U.S. government.

This threat intelligence was crucial in allowing other organisations to quickly identify if they had been impacted by the breach and take steps to mitigate the damage. Microsoft, for example, used the intelligence to identify and notify more than 40 of its customers that they had been targeted or compromised via the SolarWinds attack.

The SolarWinds case illustrates the critical importance of threat hunting and timely threat intelligence sharing. By proactively searching for signs of compromise and quickly sharing their findings, FireEye enabled a much faster and more coordinated response to one of recent most significant cyber-espionage campaigns.

2. The Kaseya Ransomware Attack

• REvil ransomware gang exploited a vulnerability in Kaseya VSA software
• Kaseya worked with partners to share indicators of compromise and mitigation strategies
• Intelligence enabled affected organisations to contain damage and begin recovery

In July 2021, the REvil ransomware gang believed to operate out of Russia, launched a significant attack by exploiting a vulnerability in Kaseya VSA, a popular remote management tool used by Managed Service Providers (MSPs). By compromising Kaseya, the attackers could push ransomware to the systems of many of Kaseya's MSP customers and, in turn, to the systems of those MSPs' clients. In total, the attack impacted an estimated 1,500 businesses globally.

Kaseya responded quickly, working with government agencies, incident responders, and other cybersecurity partners to investigate the attack and share intelligence. They released regular updates on their response efforts, including details on the vulnerability exploited and guidance on mitigation and recovery steps.

This rapid sharing of threat intelligence was critical in helping affected organisations to contain the damage and begin recovery efforts. Many could use the indicators of compromise shared by Kaseya to detect if they had been compromised and to isolate affected systems. The guidance on patching and recovery helped organisations to restore their systems and data safely.

The Kaseya case highlights the importance of rapid, transparent information sharing after a significant cyber incident. By working openly with partners and keeping the community informed, Kaseya helped to mitigate the impact of a potentially devastating supply chain attack.

3. The Microsoft Exchange Server Vulnerabilities

• Critical vulnerabilities actively exploited by nation-state actors
• Microsoft shared intelligence about vulnerabilities and attacker tactics
• Organisations quickly patched systems and hunted for signs of compromise

In early 2021, Microsoft disclosed that they had detected multiple zero-day vulnerabilities in their Exchange Server software that were being actively exploited by a sophisticated threat actor. The vulnerabilities allowed attackers to access Exchange servers, enabling them to steal data, deploy malware, and move laterally into other systems.

Microsoft attributed the initial attacks to a state-sponsored threat actor operating out of China, dubbed "HAFNIUM." However, after the vulnerabilities were publicly disclosed, numerous other attackers began exploiting them, leading to a widespread and rapidly escalating global threat.

Microsoft quickly released patches for the vulnerabilities and shared detailed threat intelligence about the attacker's tactics, techniques, and procedures. This included indicators of compromise, details on the vulnerabilities exploited, and guidance on detecting and mitigating compromised systems.

This threat intelligence was crucial in enabling organisations to rapidly patch their vulnerable systems and hunt for signs of compromise. Many organisations could use the indicators shared by Microsoft to proactively search for and isolate impacted systems, preventing the further spread of the attack.

The Exchange Server case underscores the critical role of software vendors in providing timely and actionable threat intelligence. By quickly disclosing the vulnerabilities, providing patches, and sharing detailed information about the threats, Microsoft enabled a rapid global response to a highly dangerous situation.

The Future of Threat Intelligence

As the threat landscape continues to evolve, so must the threat intelligence practice. Looking ahead, several key trends and developments are likely to shape the future of this field:

1. Automation and Machine Learning

• Process and analyse threat data at scale

One of the biggest challenges in threat intelligence today is threat data's sheer volume and velocity. As attacks become more frequent and complex, manual analysis becomes increasingly difficult.

In response, we expect to see increasing automation and machine learning use in threat intelligence. Machine learning algorithms can automatically process and categorise large volumes of threat data, identify patterns and anomalies, and even predict future threats.

Automated tools can also help streamline the dissemination and integration of threat intelligence, ensuring it reaches the right people and systems as quickly as possible.

2. Collaborative Defence

• Growth in threat intelligence-sharing initiatives and collaborative defence efforts.

As the saying goes, cybersecurity is a team sport. No single organization can defend against the full spectrum of cyber threats alone. As a result, we're likely to see continued growth in threat intelligence-sharing initiatives and collaborative defence efforts.

This could include expanding industry-specific Information Sharing and Analysis Centers (ISACs) and developing new cross-sector and international sharing frameworks. We may also see more examples of joint operations and coordinated responses to major incidents.

Collaborative defence isn't just about sharing data - it's also about sharing skills, knowledge, and resources. We may see the emergence of new models for collaborative threat hunting, incident response, and other cybersecurity functions.

3. Predictive Intelligence

• Use data analytics and modelling to anticipate and proactively defend against future threats.

Today, most threat intelligence is reactive - it's focused on detecting and responding to threats that have already emerged. We can expect to see a shift towards more predictive intelligence in the future.

Predictive intelligence uses data analytics, machine learning, and modelling techniques to identify potential future threats. By analysing trends in attacker behaviour, geopolitical events, technology developments, and other factors, it may be possible to anticipate the next big attack or vulnerability and take proactive steps to defend against it.

This could involve developing "digital vaccines" against predicted malware strains, pre-emptively patching systems against anticipated vulnerabilities, or adjusting defences based on expected changes in attacker tactics.

4. Threat Hunting

• Proactively search for signs of compromise to reduce dwell times and minimise damage.

Threat hunting - proactively searching for signs of compromise in an organisation's systems - is becoming an increasingly important part of many threat intelligence programs.

Unlike traditional threat detection, which relies on automated alerts and signatures, threat hunting involves manually searching for threats that may have evaded detection. This can help reduce dwell times (the time between a threat entering a system and its detection), minimising the damage caused by successful breaches.

As attackers become more sophisticated at evading detection, threat hunting will become essential. We can expect to see more organisations developing dedicated threat-hunting teams and the growth of new tools and methodologies for hunting.

Conclusion

Threat intelligence is a critical capability in the modern cybersecurity landscape. Providing timely, relevant, and actionable information about cyber threats enables organisations to make informed decisions, prioritise their defences, and respond quickly and effectively to attacks.

However, practical threat intelligence isn't just about collecting data - it's about turning that data into insights that can drive action. This requires a combination of the right tools, processes, and skills.

As we've seen, operationalising threat intelligence involves defining specific requirements, establishing processes for collection and analysis, integrating intelligence into security tools and methods, and continuously measuring and improving the program.

It also requires navigating challenges such as information overload, false positives, stale data, and lack of context. Overcoming these challenges requires a focus on relevance, automation, collaboration, and continuous improvement.

Looking to the future, the practice of threat intelligence will continue to evolve to keep pace with the changing threat landscape. Automation and machine learning will help organisations to process and analyse threat data at scale. Collaborative defence efforts will enable more effective sharing of intelligence and resources. Predictive analytics will allow organisations to anticipate and proactively defend against future threats. Threat-hunting will become an essential capability for detecting and responding to advanced threats.

Ultimately, threat intelligence’s goal is to help organizations manage cyber risk more effectively. A deep understanding of the threat landscape allows security leaders to make informed decisions about where to invest their limited resources for maximum impact.

However, it's important to remember that threat intelligence is not a silver bullet. It's part of a comprehensive cybersecurity strategy that must include robust defences, effective incident response capabilities, and continuous employee education and awareness.

As cybersecurity professionals, we have a responsibility to continually advance our threat intelligence practice. This means staying abreast of the latest threats and trends, investing in new tools and skills, and actively participating in the threat intelligence community.

It also means advocating for the value of threat intelligence within our organisations. We need to help business leaders understand how threat intelligence supports the organisation's overall risk management and business objectives and secure the necessary resources and support for our programs.

By doing so, we can help our organisations navigate the complex and ever-changing cyber threat landscape with confidence and resilience. We can shift from a reactive stance to a proactive one, from simply responding to attacks to actively predicting and preventing them.

In a world where cyber threats are a constant and growing concern, practical threat intelligence isn't just a nice to have; it is imperative for business. As we look to the future, it will only become more critical to our collective ability to protect our digital assets, customers, and society.

So, let's embrace the challenge. Let's continue to innovate, collaborate, and push the boundaries of what's possible with threat intelligence. Let us use this powerful tool to build a safer and more secure future for all.