Understanding the Threat Intelligence Lifecycle

 

Everyone is interested in Threat Intelligence (TI). There is a race to the top of the mountain with regards to providing ‘Intelligence’ on the ‘latest threats’; but what does that really mean for information consumers?

Firstly, let’s look at the term ‘Intelligence’. For most individuals the term Intelligence has several meanings ranging from covert operations to information gathering. However, very little time is actually spent on the Intelligence Lifecycle.

Understanding the lifecycle and some key framework concepts of Intelligence will help people understand where TI really enters into Intelligence; and how the basics can be leveraged to derive value added information into the organization.

The Intelligence Lifecycle
Excluding the scope of Cover Operations and Counter Intelligence one of the key missions of an Intelligence program is to prepare the battle space. However, this article is not working within a military construct so for the contextual use of the rest of the article the battle space will be the organisation.

From a technical perspective preparing the organization requires a mature asset and data management program.  From this perspective there is no one-size-fits-all solution to asset and data management.
For those who are just beginning there are several resources available on the Internet to help organizations get started. Furthermore, there is no need to gather TI if asset management in not addressed as much of the TI will probably pertain to assets owned by the organization.

Once assets have been identified, classified, and entered into a management lifecycle an organization can begin to ask the right questions. This is the consumer request for information.

Some example questions may be: What threats are posed against Java resources, or are there relevant threats currently attacking other Windows based infrastructures? The question initiates the Intelligence Lifecycle: Collect, Analyze, and Disseminate.

Low Budget Entry Points
For organizations wishing to do low budget Proof of Concepts or organisations that do not have the financial resources to developing robust Intelligence capabilities the two best places to start are in the domains of Human Intelligence (HUMINT) and Open Source Intelligence (OSINT). These two terms are some of the most powerful and cost effective terms to learn from a collection standpoint.

HUMINT is comprised of human interactions. This can be anything from fellow security professionals, relationships with security vendors, local law enforcement, Social Media et al.

Developing human relationships with regards to on the ground information can be more valuable than any high tech platform. For example: The creation of a Twitter account that follows such things as hacktivist groups and malware developer communities can reveal large amounts of information.

However, like any other collection effort it will be an effort of labor to manage, maintain, and sift through the vast amount of inbound information.

OSINT is the other low cost effective way to collect Intelligence. Always remember that Google is your friend. Simply typing in search terms like ‘threats to java’ or ‘latest windows hacks’ can reveal countless pages of information.

Furthermore, OSINT comprises of things like vendor supplied threat reports, news wires, streaming video, or just about anything you can obtain legally. For example: companies like Verizon publish yearly threat reports that cover a wide range of topics.

The nice part about these types of reports is that the information is typically backed by some form of metric, which can help with augmenting risk assessments conducted by the organization.

Many security vendors now come with their own form of Intelligence engines. These hardware and software solutions share detected threats with each other to enhance the overall effectiveness of the solution.

So, now that we have a very basic view of Intelligence and Threat Intelligence let’s look at a scenario regarding a local government who is ramping up their Cyber Security program but needs Threat Intelligence information to determine next steps.

The first step the organization performs is to recognize and understand the Intelligence Lifecycle. Once management understands the input(s) and output(s) of their request their expectations of returns will be on par with the initiative.

The second step the organization performs is to mandate the work to a security analyst within the organization. Although there are dedicated vendors who can also provide this information from a cost perspective this local government has decides to use an internal resource.

Once given the mandate for a generalized Intelligence effort the security analyst begins looking at relevant collection mechanisms. The analyst determines that there are some technical capabilities for Intelligence collection, but with regards to specific TI the analyst turns to more open sources of information.

After the information has been disseminated to all relevant stakeholders follow-up meetings are scheduled to continue the discussion, from a roadmap and remediation perspective.
Dark Matters: http://bit.ly/1Tf9zFr

 

« Mystery: US State Dept. Can't Find Missing Clinton Emails
Could IS Create A Cyber War? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81

Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

FREE eBook: Practical Guide To Optimizing Your Cloud Deployments

FREE eBook: Practical Guide To Optimizing Your Cloud Deployments

AWS Marketplace eBook: Optimizing your cloud deployments to accelerate cloud activities, reduce costs, and improve customer experience.

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Waterfall Security

Waterfall Security

Waterfall Security is focused on protecting critical infrastructure and industrial control systems from remote online cyber attacks,

Zerto

Zerto

Zerto provides enterprise-class disaster recovery and business continuity software specifically for virtualized data centers and cloud environments.

Qualitest Group

Qualitest Group

Qualitest is the world’s largest pure play Quality Assurance and software testing company.

Latvian Information & Communications Technology Association (LIKTA)

Latvian Information & Communications Technology Association (LIKTA)

LIKTA brings together leading Latvian companies, organizations and professionals in the field of Information & Communications Technology

Protenus

Protenus

Protenus provide a solution to proactively monitor and protect patient privacy in the electronic health record (EHR).

Scanmeter

Scanmeter

Scanmeter helps identifying vulnerabilities in software and systems before they can be exploited by an attacker.

Department of Justice - Computer Crime and Intellectual Property Section (CCIPS)

Department of Justice - Computer Crime and Intellectual Property Section (CCIPS)

The Computer Crime and Intellectual Property Section (CCIPS) is responsible for implementing the Department's national strategies in combating computer and intellectual property crimes worldwide.

NARIS

NARIS

NARIS is the leading provider of an integrated Governance, Risk and Compliance platform called NARIS GRC.