Business Security
By collecting, analyzing and contextualizing information about possible cyber threats, including the most advanced ones, threat intelligence provides an essential method for identifying, assessing and mitigating cyber risks.
November 10, 2023
•
,
4 minutes. read
When it comes to mitigating an organization’s cyber risks, knowledge and expertise are an asset. This alone should make cyber threat intelligence (TI) a key priority for any organization. Unfortunately, this is often not the case. Among the various protection measures that IT managers must consider to help them fend off increasingly sophisticated attacks, threat intelligence is often overlooked. This oversight could, however, be a critical error.
By collecting, analyzing and contextualizing information about possible cyber threats, including the most advanced ones, threat intelligence provides an essential method for identifying, assessing and mitigating cyber risks. When executed well, it can also help your organization prioritize where to focus its limited resources for maximum effect and thereby reduce its exposure to threats, minimize damage from potential attacks, and build resilience against future threats.
What are the main types of IT?
The challenge for your organization is navigating a crowded market of IT providers to find the right offering. After all, it’s a market should be worth more than $44 billion by 2033. There are roughly four types of IT:
- Strategic: Delivered to senior management via white papers and reportsthis offers a contextual analysis of major trends to inform the reader.
- Tactical: Aligned with the needs of more practical Security Operations (SecOps) team members, this document describes actor tactics, techniques, and procedures (TTP) to provide visibility into the attack surface and how malicious actors can compromise the environment.
- Technical: Helps SecOps analysts monitor new or investigate existing threats using Indicators of Compromise (IOCs).
- Operational: Also uses IOCs, but this time to track the opponent’s movements and understand the techniques used during an attack.
While strategic and tactical IT focus on long-term goals, the latter two categories aim to uncover the “what?” short-term attacks.
What to Look for in a Threat Intelligence Solution
Organizations can leverage threat intelligence in a variety of ways, including industry feeds, open source intelligence (OSINT), peer-to-peer sharing within verticals, and directly from sellers. It goes without saying that many of them offer their expertise in this area. Actually, Forrester recorded a 49% increase in paid commercial threat intelligence feeds between 2021 and 2022.
However, it’s best to focus on the following when evaluating whether a vendor is the right fit for your organization:
- Completeness: They must offer a full range of IT covering a wide range of threat actors, threat vectors and data sources – including internal telemetry, OSINT and external feeds. IOC flows should be viewed as part of a holistic IT service rather than a standalone service.
- Precision: Inaccurate information can overwhelm analysts with noise. Suppliers must provide accuracy.
- Relevance: Flows should be tailored to your specific environment, industry and company size, as well as what is most relevant (tactical/strategic) to your organization in the short and long term. Also think about who will use the service. TI is constantly expanding to new characters; even marketing, compliance and legal teams.
- Opportunity: Threats evolve quickly, so any feed must be updated in real time to be useful.
- Scalability: Any provider must be able to meet the IT needs of your organization as it grows.
- Reputation: It always pays to go with a vendor that can boast a proven track record of IT success. Increasingly, this may be a vendor that is not traditionally associated with TI, but rather with SOAR, XDR, or similar adjacent areas.
- The integration: Consider solutions that integrate seamlessly with your existing security infrastructure, including SIEM and SOAR platforms.
Navigating the IT market
The IT market is constantly evolving, with new categories emerging to help assess new threats. This can make it difficult to choose the right option(s). It is useful to think about your longer-term needs to avoid constant reassessment of strategy, although this must be balanced by the need for relevance and agility.
It’s also worth keeping in mind that the maturity of your organization will play a significant role in the number and type of IT services to adopt. Those with dedicated teams and resources can consume up to 15 IT sources across commercial, OSINT and free offerings.
Today’s threat actors are well-resourced, dynamic, determined, and can leverage the element of surprise. TI is one of the best ways organizations can level the playing field and gain the upper hand, including understanding their adversary, assessing the threat landscape, and making more informed decisions. This is the way to not only stop attacks before they impact the organization, but also build resilience for the future.
Each organization will need to choose the combination of IT that suits it. But when reviewing vendors, make sure the data is at least complete, accurate, relevant and timely. Curated feeds will go a long way in saving time and resources for your own team. The key is to find a provider whose feeds you trust. According to IDC, 80% of G2000 companies will increase their investments in threat intelligence by 2024. Make sure you’re set up for success.