Understanding the Threat Intelligence Lifecycle

 

Everyone is interested in Threat Intelligence (TI). There is a race to the top of the mountain with regards to providing ‘Intelligence’ on the ‘latest threats’; but what does that really mean for information consumers?

Firstly, let’s look at the term ‘Intelligence’. For most individuals the term Intelligence has several meanings ranging from covert operations to information gathering. However, very little time is actually spent on the Intelligence Lifecycle.

Understanding the lifecycle and some key framework concepts of Intelligence will help people understand where TI really enters into Intelligence; and how the basics can be leveraged to derive value added information into the organization.

The Intelligence Lifecycle
Excluding the scope of Cover Operations and Counter Intelligence one of the key missions of an Intelligence program is to prepare the battle space. However, this article is not working within a military construct so for the contextual use of the rest of the article the battle space will be the organisation.

From a technical perspective preparing the organization requires a mature asset and data management program.  From this perspective there is no one-size-fits-all solution to asset and data management.
For those who are just beginning there are several resources available on the Internet to help organizations get started. Furthermore, there is no need to gather TI if asset management in not addressed as much of the TI will probably pertain to assets owned by the organization.

Once assets have been identified, classified, and entered into a management lifecycle an organization can begin to ask the right questions. This is the consumer request for information.

Some example questions may be: What threats are posed against Java resources, or are there relevant threats currently attacking other Windows based infrastructures? The question initiates the Intelligence Lifecycle: Collect, Analyze, and Disseminate.

Low Budget Entry Points
For organizations wishing to do low budget Proof of Concepts or organisations that do not have the financial resources to developing robust Intelligence capabilities the two best places to start are in the domains of Human Intelligence (HUMINT) and Open Source Intelligence (OSINT). These two terms are some of the most powerful and cost effective terms to learn from a collection standpoint.

HUMINT is comprised of human interactions. This can be anything from fellow security professionals, relationships with security vendors, local law enforcement, Social Media et al.

Developing human relationships with regards to on the ground information can be more valuable than any high tech platform. For example: The creation of a Twitter account that follows such things as hacktivist groups and malware developer communities can reveal large amounts of information.

However, like any other collection effort it will be an effort of labor to manage, maintain, and sift through the vast amount of inbound information.

OSINT is the other low cost effective way to collect Intelligence. Always remember that Google is your friend. Simply typing in search terms like ‘threats to java’ or ‘latest windows hacks’ can reveal countless pages of information.

Furthermore, OSINT comprises of things like vendor supplied threat reports, news wires, streaming video, or just about anything you can obtain legally. For example: companies like Verizon publish yearly threat reports that cover a wide range of topics.

The nice part about these types of reports is that the information is typically backed by some form of metric, which can help with augmenting risk assessments conducted by the organization.

Many security vendors now come with their own form of Intelligence engines. These hardware and software solutions share detected threats with each other to enhance the overall effectiveness of the solution.

So, now that we have a very basic view of Intelligence and Threat Intelligence let’s look at a scenario regarding a local government who is ramping up their Cyber Security program but needs Threat Intelligence information to determine next steps.

The first step the organization performs is to recognize and understand the Intelligence Lifecycle. Once management understands the input(s) and output(s) of their request their expectations of returns will be on par with the initiative.

The second step the organization performs is to mandate the work to a security analyst within the organization. Although there are dedicated vendors who can also provide this information from a cost perspective this local government has decides to use an internal resource.

Once given the mandate for a generalized Intelligence effort the security analyst begins looking at relevant collection mechanisms. The analyst determines that there are some technical capabilities for Intelligence collection, but with regards to specific TI the analyst turns to more open sources of information.

After the information has been disseminated to all relevant stakeholders follow-up meetings are scheduled to continue the discussion, from a roadmap and remediation perspective.
Dark Matters: http://bit.ly/1Tf9zFr

 

« Mystery: US State Dept. Can't Find Missing Clinton Emails
Could IS Create A Cyber War? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Webroot

Webroot

Webroot delivers next-generation endpoint security and threat intelligence services to protect businesses and individuals around the globe.

The Hacker News (THN)

The Hacker News (THN)

THN is a leading source for Information Security, Hacking News, Cyber Security, Network Security with in-depth technical coverage of issues and events

Gigasoft

Gigasoft

Gigasoft provide secure online data backup & cloud backup services for the education sector and businesses.

Copper Horse Solutions

Copper Horse Solutions

Copper Horse specialises in mobile and IoT security, engineering solutions throughout the product lifecycle from requirements to product security investigations.

Cavirin

Cavirin

Cavirin’s Automated Risk Analysis Platform reduces risk and automates security and compliance.

SEWORKS

SEWORKS

SEWORKS provides offensive and defensive app security that ensures mobile and web apps are safe from dangerous hacking threats.

2Keys

2Keys

2Keys designs, deploys and operates Digital Identity Platforms and Cyber Security Platforms through Managed Service and Professional Service engagements.

Consensys

Consensys

ConsenSys is a global blockchain company. We develop enterprise applications, invest in startups, build developer tools, and offer blockchain education.

Simpliv LLC

Simpliv LLC

Simpliv is a global online learning marketplace that transforms lives by offering online training on a wide variety of topics including Cybersecurity.

ValueMentor

ValueMentor

ValueMentor is a leading cyber security service provider in the Middle East. We enable clients to reduce risk by taking a strategic approach to cybersecurity.

Squad

Squad

Squad provides leading expertise to ensure protection against the most complex cyber threats. Combining the best practices of DevOps and Cybersecurity, we are committed to create a secured cyber space

European Center for CyberSecurity in Aviation (ECCSA)

European Center for CyberSecurity in Aviation (ECCSA)

ECCSA is a cooperative partnership within the aviation community to better understand emerging cybersecurity risks in aviation and provide collective support in dealing with cybersecurity incidents.

Palitronica

Palitronica

Palitronica build cutting-edge hardware and breakthrough software that revolutionizes how we defend critical infrastructure and key resources.

Advantage

Advantage

Advantage exists to provide peace of mind in an evolving technology reliant world. We were created by visionaries who for nearly 4-decades have been passionate about providing world-class solutions.

Tenet3

Tenet3

Tenet3's vision is to make optimal cyber strategy development tractable, data driven, with concrete success metrics. The result is cost effective cyber resilience for our customers.

Krista Software

Krista Software

Krista is an intelligent automation platform that combines iPaaS and Conversational AI to automate complete business processes across your teams and apps.