How Can You Leverage Threat Intelligence Best?Threat intelligence is knowledge if you have it would allow you to prevent or mitigate a large number of cyber-attacks on your organisation. It is a special form of data that is great in giving you the CONTEXT of:
-
Who is attacking you?
-
What their motivations are?
-
What their capabilities are?
-
What Indicators of Compromises (IoCs) in your system, you should look for?
Gartner says--
“Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and action-oriented advice about an existing or emerging menace or hazard to assets. This intelligence can be used to inform decisions regarding the subject’s response to that menace or hazard.”
There is a continuous onslaught of ever-persistent attacks on your organisation, and a daily flood of data that is full of extraneous information. There is also a flood of FALSE alarms emanating from you security systems. There is a severe shortage of skilled people in security.
But simply incorporating these threat-intel feeds into your network devices is not enough. Because too much of extra data would be generated by these feeds. It would do nothing more than adding an huge burden over the shoulders of security analysts. What would they do if they do not have right tools to decide what to PRIORITIZE or what to IGNORE.
Threat Intelligence solution can help you a great deal here.
A cyber threat intelligence solution can address each of these issues. The best solutions out there, use machine learning (ML) and natural language processing, to automate data collection and processing. They also integrate with your existing solutions. They take in unstructured data from disparate sources of threat intel, and then connect the dots by providing context on indicators of compromise (IoCs) and the tactics, techniques, and procedures (TTPs) of threat actors.
You should ensure that you have understood the meaning of words here 'Action-Oriented Advice'. Threat intelligence is actionable. It means that it is timely, it provides context, and it is able to be understood by the people who are in charge of making decisions.
-
Most people tend to have an understanding that threat-intel is to be fed into firewalls. Some people think that these are security analysts who need threat-intel. But most people don't think that even higher-level management executives also need threat-intel. Sometimes they need to know a broad overview of threat-trends, to guide their security investment decisions for the next quarter, for example.
There is no single source of threat-intelligence. It is gathers from inside of your oranisation, e.g., network event logs, records/history of past security incidents. A large part of threat-intel comes from outside of your organisation, e.g. open web (www), the dark web, and many technical sources.
Threat intel may include anything or everything of the followings:
-
Lists of IoCs, e.g., malicious IP addresses, domains, and file hashes
-
Vulnerability information
-
The personally identifiable information of customers
-
Raw code from paste sites
-
Text from news sources or social media, etc
-
The Types of Threat IntelligenceThe final product (threat-intel) will look different depending on the initial intelligence requirements, sources of information, and intended audience.
Threat intelligence is often broken down into three subcategories:
Strategic TI
It includes some 'broad threat/security trends' and it is typically meant for a non-technical audience, for Higher-level IT executives, Managers, Directors etc.
Tactical TI
This kind of threat-intel usually outline the tactics, techniques, and procedures (TTPs) of threat actors, and are meant for a more technical audience
Operational TI
This kind of threat-intel gives you details about specific attacks and campaigns
-
Leverage Threat Intelligence With A Purpose & CONTEXTAlthough threat-intel is perhaps the most valuable immediately when it helps you prevent an attack. Right?
Threat intel is also a useful part of triage, Risk analysis, Vulnerability management, and wide-scope decision making.
Let's examine how much you can achieve with Threat Intelligence:
1. 
You would find that your security analysts who have got the duty of incident response, they are facing the highest level of stress most of the time. They keep scrolling whole day on their screen, trying to find out the IoC in the event-logs coming from so many systems and devices. Yet, very high proportion of daily ALERTS turn out to be false positive.
Threat intelligence can help you reduce this pressure in multiple ways:
-
Automatically identifying and dismissing false positives
-
Enriching alerts with real-time CONTEXT, like custom risk scores
-
Comparing information from internal and external sources, etc
2.
As I mentioned earlier too, most SOC teams have no choice but to deal with huge volumes of alerts generated by the networks they monitor, on a daily basis... Triaging these alerts takes too long, and many important alerts are never investigated at all. This “Alert fatigue” leads your analysts to take alerts less seriously than they should.
Threat intelligence solves many of these problems — helping you gather information about threats more quickly and accurately, filter out false alarms, speed up triage, and simplify incident analysis. With it, your analysts can stop wasting time pursuing alerts based on:
-
Actions that are more likely to be innocuous rather than malicious
-
Attacks that are not relevant to that enterprise
-
Attacks for which defenses and controls are already in place
As well as accelerating triage, threat intelligence can help SOC teams simplify incident analysis and containment.
3.
Now a days, it hardly takes 15-days on average between a new vulnerability being announced and an exploit targeting it appearing.
This has two 
implications:
implications:-
You have two weeks to patch or remediate your systems against a new exploit. If you can’t patch in that timeframe, have a plan to mitigate the damage.
-
If a new vulnerability is not exploited within two weeks to three months, it’s unlikely to ever be — patching it can take lower priority.
Threat intelligence helps you in identifying the vulnerabilities that pose an actual risk to your organization, going beyond CVE scoring by combining internal vulnerability scanning data, external data, and additional context about the TTPs of threat actors.
4.
Threat intelligence provides you the CONTEXT that helps risk models make defined risk measurements and be more transparent about their assumptions, variables, and outcomes. It can help you answer questions such as:
-
Which threat actors are using this attack, and do they target your industry?
-
How often has this specific attack been observed recently by enterprises like yours?
-
Is the trend up or down?
-
Which vulnerabilities does this attack exploit, and are those vulnerabilities present in your enterprise?
-
What kind of damage, technical and financial, has this attack caused in enterprises like yours?
5.
Threat intelligence can provide security leaders with a real-time picture of the latest threats, trends, and events, helping security leaders respond to a threat or communicate the potential impact of a new threat type to business leaders and board members in a timely and efficient manner.
-
Guys, what do you think of this post about Threat Intelligence? You can also share with all of us if the information shared here helps you in some manner.
Kindly write 
your comments on the posts or topics, because when you do that you help me greatly in 
designing new quality article/post on cybersecurity.
your comments on the posts or topics, because when you do that you help me greatly in designing new quality article/post on cybersecurity.This Article Was Written & published by Meena R, Senior Manager - IT, at Luminis Consulting Services Pvt. Ltd, India.
Over the past 16 years, Meena has built a following of IT professionals, particularly in Cybersecurity, Cisco Technologies, and Networking...
She is so obsessed with Cybersecurity domain that she is going out of her way and sharing hugely valuable posts and writings about Cybersecurity on website, and social media platforms.
30,000+ professionals are following her on Facebook and mesmerized by the quality of content of her posts on Facebook.
If you haven't yet been touched by her enthusiastic work of sharing quality info about Cybersecurity, then you can follow her on Facebook:
Click Here to follow her: Cybersecurity PRISM