Threat intelligence overview - Threat Intel Series Part-1

TLDR: Threat intelligence is on way to becoming a must-have capability for every organization. This will not only help protect the firm but also keep them aware of constant threats and the plan to safeguard against those.

Threat intelligence overview:

As defined by Gartner, threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications, and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.

This curated information helps a firm to make better decisions about how to defend ourselves and our business, from cyber-based threats.

Threat intelligence can help identify and analyze different cyber threats relevant to your organization 

The best approach is to use specialized threat intelligence tools to capture and digest feeds and thereafter analyze them via existing knowledge to know if a threat is real and the applicable actions to address that.

Threat intelligence helps us identify:

• Who are my adversaries and how might they attack me?
• How do attack vectors affect the security of my company?
• What should my security operations teams be watching for?
• How to reduce the risk of a cyber attack against my company?

Image source- https://www.kaspersky.com/resource-center/definitions/threat-intelligence

Types of threat intelligence:

1. Tactical threat intelligence

The most commonly used threat intelligence shows common indicators of compromise (IOCs). These are used for machine-to-machine detection of threats and for incident responders to search for specific artifacts in a firm’s network.

2. Operational threat intelligence

Provides intel on threat methodologies to expose potential risks. It provided enhanced detection and incident response to uncover completely new threats.

Leveraged on tools focused on threat groups (utilities, backdoor families, common infrastructure)

Tactics, Techniques, and Procedures (TTP) for specific threat groups (staging directories, file naming conventions, ports, protocols, favorite file types)

Emerging TTP (new persistence methods, exploits, phishing schemes)

3. Strategic threat intelligence

This helps identify historical trends, motivations, or attributions as to who is behind an attack. This provides a starting point for determining defensive measures for maximum effectiveness.

• Attribution for intrusions and data breaches
• Threat group trends
• Targeting trends for industry sectors and geographies
• Mapping cyber-attacks to events
• Global statistics on breaches, malware, and information theft
• Major attacker TTP updates over time

Sources of information for strategic threat intelligence:

1. Policy documents from nation-states or nongovernmental organizations

2. News from local and national media, industry- and subject-specific publications etc.

3. White papers, research reports etc.

Sources of information for tactical threat intelligence:

Reports produced by security vendors are often the easiest way to get tactical threat intelligence giving details on attack vectors, tools, and infrastructure that attackers are using, including specifics about what vulnerabilities are being targeted and what exploits attackers are leveraging, as well as what strategies and tools that they may be using to avoid or delay detection.

Sources of information for operational threat intelligence:

A common source of technical information is threat data feeds, which usually focus on a single type of indicator, like malware hashes or suspicious domains.

Threat intelligence lifecycle

A threat intelligence lifecycle typically includes the below phases:

1. Planning and Direction/ Requirements

2. Collection

3. Processing

4. Analysis

5. Dissemination

6. Feedback

More coming up in part-2!