How to be intelligent about threat intelligence

By Alexandre François, Senior Content Manager, Threat Intelligence Platform

Planning and executing cyber attacks is no longer the job of one or few individuals. Organized groups are increasingly responsible for data breaches, and  hackers  with more resources can spend more time studying targets carefully to strike harder.

Companies need to  step up as a result and start approaching cyber security comprehensively — bringing together disconnected security guidelines and tools to  bridge exploitable gaps. But security budgets are finite, so it is essential to understand where money should be spent to minimize overall risk.

This is why threat intelligence  is becoming an essential part of the cyber security road map, allowing companies to step back from day-to-day threats and review their IT infrastructure and systems to flag vulnerabilities.

Before investing in threat intelligence products, however, heads  of  security  and  business executives must ask  themselves  several questions. This  post explores  some of the vital ones.

How does  threat  intelligence work?                                           

Threat intelligence all starts with evidence-based data — facts about hosting, websites, and applications such as:

• Configuration parameters of email and name servers
• Domain and IP address allocation and locations
• File extensions hosted and accessible by users
• Publicly available details about domain owners
• Status and validation of SSL certificates

Sources of evidence-based data are then integrated to reveal security threats. For example, invalid or in existent SSL certificates combined with files having extensions capable of running code may indicate an attempt of website forgery.  Hence  hackers may be trying to impersonate a  well-known entity through a  fake  page  and seek gains by deceiving visitors into disclosing sensitive information or download and opening malicious files.

Still, to be truly intelligent, threat intelligence software should enable quick analyses and provide insights as needed in a useful format. Most threats will be overlooked if the process takes too long or lacks action-ability.

How relevant  is threat  intelligence to you?                                                                    

Any business that interacts with customers, employees, and other stakeholders through electronic means  can benefit from threat intelligence  — and that is virtually all businesses. Not all companies are equally vulnerable, however.

As a rule of thumb, the more organizations  have  to  lose  the  more likely they are to be the target of cybercrime. So beware if you have accumulated a lot of sensitive data, possess many IP assets and trade secrets, or have an established reputation in the market, as these  factors make you more attractive  in the eyes of hackers and scammers.

Are  you  confusing threat intelligence and cyber security?                                            

While the two are intrinsically connected, there are some subtle differences. Threat intelligence focuses on identifying vulnerability points  to  anticipate what hackers  might  do to steal data, infect systems, and conduct fraud.

Cyber security, on the other  hand, is about implementing  recommendations through processes, technologies, and best practices to protect websites, networks, hardware,  and users. In other words, the former is about recognizing  what  should  be  done  while the latter is about actually doing it.

Can you act on threat  intelligence  insights?                                                 

So let’s say you established a need for threat intelligence and maybe even started to monitor your systems  and infrastructure more closely. The  question is  now  about whether you can interpret insights and take actions as security gaps emerge.

Do you have the right specialists for the  job? Will they have  enough time to  follow up with threat intelligence recommendations? Are senior executives going to  support reconfiguration and new initiatives? Just knowing what areas for improvement could be  is not enough to prevent and block cyber attacks.

Are  you  approaching threat intelligence too narrowly?                                               

You might think that only IT professionals should be concerned  with threat intelligence.  But since cyber criminals are present at every corner, even regular  employees  can benefit from security insights in their daily job.

For example, they might run quick analyses and receive an overall grading of hosts without having to dig into technical details — allowing them to know whether they can confidently share data on a website or download files.

In a security landscape where cyber criminals are increasingly organized,  threat intelligence provides security analysts and other staff members with the tools to review hosts, websites, and servers to spot vulnerabilities and fix weak links.

About the Author

Alexandre François is a senior content manager at Threat Intelligence Platform. He is knowledgeable about threat detection and prevention and enjoys sharing insights about what organizations can do to  anticipate hackers and scammers’ next moves.