Security CERT Global

    Older posts

SEC Threat Intelligence as a Critical Organizational Need – SEC Report

 

The critical need for an evidence based, automated, holistic approach of the threat landscape.

 

These are challenging times for security managers, with corporate boards demanding awareness of cyber risks, faster processing of progressively complex data and efficient managed services for an increasing number of intelligent devices than ever before.

 

Ultimately security teams are in a better position of strength to defend their organizations against threats if they know what is coming in their direction; tools and staff are vital but should be augmented with intelligence. Threat Intelligence is no longer for the large, well-funded organizations, but is required to be an overall component of mitigation strategies for all businesses that operate within this evolving technological environment; the economies of scale and adaptability of solutions now allows small businesses to be able to access credible threat intelligence sources that can be based on an organizations profile and supply chain.

 

Critical data that used to be in a secured datacenter now moves across an increasingly complex ecosystem of networked environments, including IIoT, IoT, cloud servers, virtualized environments and mobile devices. The rate of change in some enterprise environments is so rapid that many organizations are struggling to keep pace with the evolving nature of cyber threats or being able to ascertain knowledge of what arises daily.

 

To build an effective cyber security strategy, awareness of specific cyber threats needs to occur as well as an analysis of how those threats affects the organization. Threat Intelligence provides context, indicators, increased awareness and actionable responses about current or emerging threats that aid in decision making at an operational, tactical or strategic level. Cyber adversaries are increasingly using sophisticated tools, techniques and procedures that are evading stand-alone security solutions with multiyear campaigns that target valuable and sensitive information. Organizations need an evidence based, holistic view of the threat landscape with a proactive security posture to defend organizations from a wide array of threat – A Threat Intelligence led cyber security program.

 

The goal behind Threat Intelligence Services are to provide organizations the ability to become aware, recognize and act upon indicators of attack and compromise scenarios in a timely manner that better protect against zero-day threats, advanced persistent threats and exploits. With security teams across the world being challenged to discover, analyze and interpret the vast number of daily events to discover attacks, there are efforts led through Security Consortiums that are automatically detecting, contextualizing, prioritizing, performing forensic analysis, automating compliance and responding to incidents that will move us beyond Security Information Management to Security Threat Intelligence.

 

Facility owners should define within their overall strategy what they expect to achieve from Threat Intelligence; including the types of alerts needed, vendor news, how intelligence is collected, reported and communicated to relevant stakeholders, analysis process and how threat intelligence would be used. Only adding new and “innovative” products to the environment that requires integration and implementation of additional policies that needs to be managed by an overburdened staff is not the response required; but rather a Threat Intelligence Platform that better prepares their defense of the organization. By combining Threat Intelligence capabilities to an organizations’ software, hardware and policy defense strategy; it enhances staff’s ability to search for advanced attacks, profile atypical malware and detect adversaries.

 

Typical internal threat intelligence teams are hardly common as they have been deployed and structured in a way that is costly, hands on and mis-aligned to the organizations security posture.
Leveraging your tools and data in an effective manner is key to achieve your desired security posture.

 

As we exist in a global environment where attacks are generated at a machine level, Customers must ensure that the identification, sharing, comprehension and application of threat intelligence is as automated as much as possible. An automated platform allows for ease of access to the intelligence and the ability to contextualize and prioritize attacks for immediate mitigation strategies. Effective intelligence assess intelligence from various sources and source types to create a better threat and risk image for an organization. The value to end customers is not the quantity of the various intelligence feeds, but the applicability of those feeds to their entire environment. The ability to customize dashboards and filters to continuously illustrate threats allows security teams to focus on threats that impacts the organization. The threat intelligence market offers different types of information feeds that are not necessarily aligned to any industry or large manufacturer installed base. Though intelligence platforms must be recognized as a critical component to cyber-security, organizations must define their high-level requirements, functional requirements and visibility requirements.

 

Through Continuous Threat Intelligence collection, analysis and optimization, organizations can increase their protective measures and strengthen their security tools.

 

Tags: Critical Data,CyberSecurity,SEC Corporate,SEC Intelligence,SEC Reports,Threat Intelligence,Threat Intelligence Data,Threat Intelligence Information,Threat Intelligence Platforms,