Cyber Threat Intelligence has been gaining quite some momentum in recent times due to the surge in cyber threats and its variations. Let’s dissect what CTI really is.
What is Cyber Threat Intelligence?
Cyber Threat Intelligence is the information which an organization utilize to understand the cyber threats that have occurred in the past, currently happening or have chances to occur in the future. The intelligence in the form data – which is collected is then analysed to prepare, prevent, and identify cyber threats which are seeking to take advantage of the organization’s valuable resources. It will help the organization to be proactive and in protecting those resources.
Cyber Threat Intelligence is divided into 3 sub categories:
1. Strategic Cyber Threat Intelligence:
It tells analysts how foreign policies, global events and other international and local actions may potentially impact the cyber security of an organization. Focused on understanding high level trends and adversarial motives, and then leveraging that understanding to engage in strategic security and business decision-making.
Stakeholders: CISO, CIO, CTO, Executive Board, Strategic Intel
2. Tactical Cyber Threat Intelligence:
It tell the analysts about the technicality, focuses on the immediate future and it helps in identifying simple signs of compromise. Focused on performing malware analysis & environment, ingesting atomic, static and behavioural threat indicators.
Stakeholders: SOC Analyst, SIEM, Firewall, Endpoints, IDS/IPS
3. Operational Cyber Threat Intelligence:
Every cyberattack has a “who”, “why” and “how” – which refers to the attribution, motivation and the TTPs the attacker employs, respectively. All these factors of cyberattacks provide context, and the context provides insight into how attackers plan, conduct and sustain major operation and campaigns. Focused on understanding adversarial capabilities, infrastructure, & TTPs.
Stakeholders: Threat Hunter, SOC Analyst, Vulnerability Management, Incident Response, Insider Threat
Threat Intelligence Lifecycle
The Threat Intelligence Lifecycle is a process to transform the maze of raw data into finished intelligence for decision making and action. The main goal of a threat intelligence lifecycle is to guide a cyber security team through the development and execution of an effective intelligence program.
Threat Intelligence is challenging because threats are constantly evolving – means it requires businesses to quickly adapt and take decisive action.The cycle provides a framework to enable terms to optimize their resources and effectively respond to the both traditional and modern threat landscape. Threat Intelligence Lifecycle will consists of six steps resulting in a feedback loop to encourage continuous improvement:
Let’s learn and understand the 6 stages of Threat Intelligence Lifecycle:
1. Requirements:
The first stage is requirements stage – which is crucial to the threat intelligence lifecycle as it sets the roadmap to a specific threat intelligence operation. During this planning stage – the team will agree on the goals and methodology of their intelligence program based on the needs of the involved people. The team would set out to discover:
- Who are the attackers? What’s their motivation?
- What is the attack surface?
- What all specific actions should be taken to strengthen their defences against a future attack
2. Collection:
The second stage of Threat Intelligence Lifecycle is Collection. After the requirements are defined, the team will set out to collect the information required to satisfy the listed objectives. Depending on the goals, the team will generally seek out traffic logs, publically available data sources, relevant forums, social media and industry and subject matter experts.
3. Processing:
The third stage of Threat Intelligence Lifecycle is processing. Once the raw data is been collected. The data needs to be processes into a format suitable for analysis. And almost all of the time, it entails organizing data points into spreadsheets, decrypting files, translating information from foreign sources and evaluating the data for relevance and reliability.
4. Analysis:
The fourth stage of Threat Intelligence Lifecycle is Analysis. Once the dataset has been processed, then the team needs to conduct a thorough analysis to find answers to the questions raised during the requirement phase. So, during the analysis phase, the team will also work to decipher the dataset into action items and valuable recommendations for the organization and stakeholders.
5. Dissemination:
The fifth stage of Threat Intelligence Lifecycle is Dissemination. This phase requires the threat intelligence team and cyber security experts to translate their analysis into a layman language you can say – means in an understandable format. They then will present the results to the organization and stakeholders. It is generally on the audience – how the presentation should get presented. In most of the cases – the recommendation should be presented concisely – like in a more layman language, and not with the technical jargons. It should be either 1-2 pages of simple report or a short presentation of 4-5 slides.
6. Feedback:
The final stage of the cycle is Feedback – what does it involve? It involves in getting feedback/review on the provided report to determine whether adjustments need to be made for future threat intelligence operations. After receiving a feedback from the experts’ side, the experts’ team might need to change their priorities as well. The cadence at which they wish to receive intelligence reports – how data should be disseminated or presented.
Why is Cyber Threat Intelligence Important?
After facing lot of small and huge threats, now organizations are recognizing the value of threat intelligence, and 72% are planning to increase threat intelligence spending in upcoming quarters.
As we know, if we are upgrading the security, the cyber criminals will upgrade themselves too. And through this, organizations can figure out the attackers’ next moves where they can proactively defend their sensitive data and prevent future attacks. And to achieve this, cyber security experts need the knowledge of it.
“Threat intelligence is evidence-based knowledge (e.g., context, mechanisms, indicators, implications and action-oriented advice) about existing or emerging menaces or hazards to assets.”
– Gartner
There is a difference between recognizing the value and receiving the value. Almost all of the organizations today are focusing their efforts on only the most basic use cases like integrating threat data feeds with existing networks, IPS, firewalls and SIEMs and don’t even take advantage of the insights that intelligence has to offer. So the companies like this – which stick to this basic level of threat intelligence are missing out on real advantages that can significantly strengthen their security postures.
Especially, Threat Intelligence is important for following reasons:
- To shed lights on the unknown, enabling security teams to make better decisions
- To empower cyber security stakeholders by revealing adversarial motives and their tactics, techniques and procedures (TTPs)
- To help cyber security experts better understand the threat actor’s decision making process
- To help empowering the business stakeholders like C-suite executives and board members to invest wisely in the technologies that mitigate risk, become more efficient and make faster decisions.
- The cyber expert teams become proactive about future cyber threats.
What is Cyber Threat Intelligence Training?
Cyber Threat Intelligence (CTI) helps the learners and students to learn the skills and knowledge required to implement and Cyber Threat Intelligence unit within their organizations. The Cyber Threat Intelligence course’s objective will include below points:
- What does the CTI terminology mean?
- How to identify what implementation CTI is required for, based on the organizations’ capacity and capabilities
- How CTI interacts with other organizational units
- Defines the type of intelligence the CTI team provides based on the unit which require information
- The basic concepts to build the core of a CTI unit
What does a Cyber Threat Intelligence Analyst do?
Cyber Threat Intelligence Analysts conduct all-source analysis, digital forensics and adversary targeting to identify, monitor, assess and counter the threat posed by foreign cyber actors against the government information systems, critical and vulnerable infrastructure and cyber related interests.
Cyber Threat Intelligence Analysts are the security experts who are responsible for helping to counter activities of the cyber criminals. They generally use their skills and expertise in network administration or network engineering. Plus the job position/profile requires a combination of strong computer and communication skills, and of course excellent analytical abilities – which can sometimes be hard to find people with the right combination.
What all they do? Let’s learn it with below points:
Technical Research: Which means collecting information regarding the cyber criminal’s activities that are internet based and malware related.
Intelligence Analysis: Which allows them to predict about cyber attackers and possible future attacks – based on what is already known about them.
Communication: Through which, they’ll communicate the results of their analysis – from the intelligence report to leadership who need to know them.
So from time to time, Cyber Security experts and the CTI analysts need to keep themselves updated. It can be one of the exciting career opportunities if you can solve the errors and not get lost into the maze of cyber world.
Source: https://www.crowdstrike.com/epp-101/threat-intelligence/
Conclusion
Cyber Solutions Vendors like Centripetal Networks, Ixia and Looking glass – are designed to alleviate the data management, policy management and technology integration challenges. Nowadays almost all the organizations are transforming the way they do business through digital processes. They have started moving data from the local servers to the cloud and started gathering more information. As we know the free flow of data comes with a price, making data easier to collect, store and analyse is changing many industries for the better. Threat intelligence is one of the ways to solve such issues. Threat intelligence will provide transparency into the threat environments of the third parties you work with.
