About Strategic Threat Intelligence

Threat intelligence is a category of intelligence that focuses on information security. As defined by Gartner, it is “evidence-based knowledge…about an existing or emerging menace or hazard…to inform decisions regarding the subject’s response to that menace or hazard.”

Essentially, threat intelligence provides you with curated information to inform you about potential malicious activity and helps you make better decisions about how to prevent bad things occurring to you or your organisation.

In order to sustain a strong security posture, an organisation must develop and answer questions specific to the business, many of which must be answered continually as situations and environments evolve.

Questions such as: will bringing in additional security solutions really give that much more additional protection? Is updating each and every legacy system worth the cost? Who are my enemies and how might they attack me? Threat intelligence helps organisations to tackle these questions and make more informed decisions with context.

There are generally three ’levels’ of cyber threat intelligence: strategic, operational and tactical, which serve different functions.

  • Strategic intelligence (who/why)
    Focuses on assessing and mitigating current and future risks to businesses. As an example, a corporation releasing a new product or completing a merger will want to understand not only the potential impact but also the associated risks with the activity. This is particularly useful for CISOs and executive leadership who must justify budgets and make well informed investment decisions.
  • Operational intelligence (how/where)
    Helps fuel meaningful detection, incident response and threat hunting programs. This level of intelligence enables information security teams to identify patterns in attacks, from which logical system rules can be developed that can then detect specific indicators of malicious activity.
  • Tactical intelligence (what)
    Provides a reference material for analysts to interpret and extract context for use in defensive operations. This intelligence comes in the form of Indicators of Compromise (IOCs), which include items such as domains or IPs. Indicators are often changed quickly though, meaning that it is important for operational and strategic intelligence to also be incorporated into decisions.

The combination of these different levels of threat intelligence give security teams the ability to know how to proactively and reactively respond to risks. This includes what solutions to use, how they should be leveraged, and even just who to keep an eye on.

A Further look into Strategic Threat Intelligence

Strategic intelligence gives the bigger picture, looking at how threats and cyber-attacks are changing over time. Common focuses of strategic intelligence include historical trends, motivations, or attributions as to who is behind an attack.

With strategic intelligence, you can answer questions like who is attacking your organisation and why?? Why are you within scope for an attack? What major trends are happening? What can you do to reduce your risk profile? All of this helps to profile your adversaries and provide clues to their future operations and tactics.
All of this makes strategic intelligence a solid starting point for deciding which defensive measures will be most effective.

This gives insight into the following:

  • Targeting trends for industry sectors and geographies
  • Major attacker Tactics, Techniques and Procedures (TTP) changes over time
  • Attribution for intrusions and data breaches
  • Mapping cyber-attacks to geopolitical conflicts and events (South China Sea, Arab Spring, Russia-Ukraine)
  • Threat actor group trends
  • Global statistics on breaches, malware and information theft
  • Carrying out a thorough risk analysis and review of the entire technology supply chain
  • Informing your executive leadership about high risk threat actors, relevant risk scenarios, and threat exposure in the public-facing technology sphere and criminal underground
  • Learning which commercial ventures, vendors, partners, and technology products are most likely to increase or decrease risk to your enterprise environment

For example, if you are in the education sector, you may wonder what nation states and threat actor groups you should be concerned about, or where you need to focus your resources to reduce risk of an intrusion and theft of intellectual property.

Strategic threat intelligence is invaluable, incorporating expert opinions and insights that are based on aggregating both operational and tactical intelligence from known cyber-attacks.

By leveraging this data, organisations are better positioned to trade punches with tomorrow’s threats.

Information Security Buzz

You Migh Also Read: 

Does Fake News Affect Threat Intelligence?:

Employees Are Still The Cause Of Most Cyber Breaches:

 

 

« Cybercrime Costs Londoners £26m Every Month
Cambridge Analytica Claim To Sway Elections With Facebook Data »

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

eBook: Practical Guide to Security in the AWS Cloud

eBook: Practical Guide to Security in the AWS Cloud

AWS Marketplace would like to present you with a digital copy of the new book, Practical Guide to Security in the AWS Cloud, by the SANS Institute.

Cyber Security Service Supplier Directory

Cyber Security Service Supplier Directory

Free Access: Cyber Security Service Supplier Directory listing 5,000+ specialist service providers.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Global Cyber Security Center (GCSEC)

Global Cyber Security Center (GCSEC)

GCSEC is the Global Cyber Security Center based in Rome, focused on International Cooperation and Policies, Research and Education in the field of cyber security.

Trusted Computing

Trusted Computing

TCG provides open standards, specifications and certification to enable trusted computing in area including IoT, networks, cloud and mobile devices.

PlainID

PlainID

PlainID provides IAM teams with a simple and intuitive means to control their organization’s entire authorization process.

NetDiligence

NetDiligence

NetDiligence is a privately-held cyber risk assessment and data breach services company.

Nozomi Networks

Nozomi Networks

Nozomi Networks is a leader in Industrial Control System (ICS) cybersecurity, with a comprehensive platform to deliver real-time cybersecurity and operational visibility.

Smarttech247

Smarttech247

Smarttech247 deliver a range of cyber security solutions, including cognitive security services using IBM Watson for Cybersecurity, SIEM, Compliance & Governance, and Penetration Testing.

National Cyber Defense Institute (NKI)

National Cyber Defense Institute (NKI)

National Cyber Defense Institute (NKI), part of the Hungarian National Security Service (NSC), is an event management center dealing directly with cyber attacks and threats in Hungary.

Marvell Technology Group

Marvell Technology Group

Marvell is a semiconductor company providing solutions for storage, processing, networking, security and connectivity.