Use of Cyber Threat Intelligence in Security Operation Center

Arun E Thomas

• Publisher: Arun E Thomas
• Year: 2017
• eBook ISBN: 9781641365239
• Edition: 1
• Topic: Computer Science
• Subtopic: Information Technology
• Index: Computer Science

The term “Cyber Threat Intelligence” has gained considerable interest in the Information Security community over the past few years. The main purpose of implementing a Cyber threat intelligence(CTI) program is to prepare businesses to gain awareness of cyber threats and implement adequate defenses before disaster strikes. Threat Intelligence is the knowledge that helps Enterprises make informed decisions about defending against current and future security threats.
This book is a complete practical guide to understanding, planning and building an effective Cyber Threat Intelligence program within an organization. This book is a must read for any Security or IT professional with mid to advanced level of skills. The book provides insights that can be leveraged on in conversations with your management and decision makers to get your organization on the path to building an effective CTI program.

Module 1

Cyber Threat Intelligence Basics

What is Cyber Threat Intelligence?

Today’s cyber attackers are more erudite than ever. To predict and respond to their attacks, you need to understand their impetuses, intents, characteristics, and methods. Legacy, signature-based threat data feeds, can’t deliver those insights. But, Cyber Threat Intelligence can.

In every major data breach that has been recorded, the victimized organizations had lots of security tools and staff. Yet they were hit hard - losing billions of customers’ personal data in the process. Thus, it’s clear that you cannot rely on the traditional cyber-security approach to assure your data is protected. In fact, nearly 75% of cyber attacks occur undetected. And once they are detected, it’s always too late! Rather than waiting until you know you’ve been breached, get proactive with Cyber Threat Intelligence.

Cyber Threat Intelligence is evidence-based refined information that detects looming threats to your organization and helps alleviate your exposures to them. An effectual Cyber Threat Intelligence security team scrutinizes and prioritizes targeted and global threats, so that your organization can proactively thwart security attacks. To sum up, Cyber Threat Intelligence (CTI), also known as Threat Intelligence, is knowledge that helps you identify security threats and make informed decisions in advance.

Generally, CTI is based on the collection of intelligence using social media intelligence (SOCMINT), human Intelligence (HUMINT), open source intelligence (OSINT) or intelligence from the deep and dark network. CTI’s key mission is to investigate and analyze trends and technical progresses in three areas including: Cybercrime, Cyber activism, and Cyber espionage.

Considering the stern impacts of cyber threats, CTI has emerged as an effective solution to maintain international security. The primary purpose of CTI is to help organizations understand the risks of the most common and severe external threats, such as advanced persistent threats (APTs), zero-day threats and exploits.

Types of Cyber Threat Intelligence

CTI is commonly deployed across three levels in an organisation - Tactical, Operational and Strategic levels. Let’s have a look at these levels in detail.

Tactical Intelligence

Tactical Cyber Threat Intelligence is predominantly focused around a quick and immediate response. Up-to-date information and sufficient resources from operations are essential for this area of intelligence to be successful. Tactical intelligence provides support for day-to-day events and operations such as the development of signatures and indicators of compromise (IOC). Firewalls, protection systems along with anti-virus and prevention systems are all vital technologies within this layer of intelligence.

Operational Intelligence

Operational Cyber Threat Intelligence provides technically-focused, highly specialized intelligence to guide and support the response to specific incidents. The contextual level within this form of intelligence focuses profoundly on providing information about the attacker; normally identifying who, when, why and how. Other aspects such as how the attack would impact an organization strategically are also inspected. Such intelligence is most frequently used by an organization to decide its precedence, as well as form context and provide the resources for an appropriate response.

Strategic Intelligence

This layer of intelligence typically states the predominant goals that an organisation wishes to accomplish. Strategic Cyber Threat Intelligence forms an overall picture of the capabilities and the intent of pernicious cyber threats, through the identification of patterns, trends and emerging risks, in order to inform policy and decision makers or to provide timely warnings. Also, Strategic Intelligence is most appropriately used to detect potential new threats that are emerging as well as identify new technologies and how they can be used to benefit the organisation.

Key Features of Threat Intelligence Services

Data Feeds

Several types of data feeds are available through Cyber Threat Intelligence services. Examples include malicious domains/URLs, phishing URLs, IP addresses, malware hashes and many more. A vendor’s Threat Intelligence feeds should draw data from its own global database, open source data as well as from industry groups, to produce a pool of data that is both deep and broad.

Alerts and Reports

Some Threat Intelligence services provide actual time alerts along with daily, weekly, monthly and quarterly threat reports. Intelligence may comprise information about emerging threats, specific types of malware and threat actors and their motives.

Benefits of Cyber Threat Intelligence

With every successful cyber-attack, the significance of real-time Cyber Threat Intelligence becomes more evident. Through Threat Intelligence, organizations can expand their visibility and insight into active and potential threats. However, there are several potential benefits of Threat Intelligence and these include:

Rich Threat Context for Faster Prioritization and Quick Response

There are multiple alerts from sources such as firewall, SIEM and other tools, Security Ops and Incident Response teams will quickly understand the seriousness of threats and try to tackle it first. Cyber Threat Intelligence provides the teams with the necessary context demonstrating what the threat is/or which category it belongs to, when was it first discovered, severity level, etc.

Leverage Network Intelligence to Identify Infected Devices

DHCP (Dynamic Host Configuration Protocol), DNS (Domain Name System) and IP Address Management services provide critical, actionable network intelligence services such as the devices used, IP addresses allocated to, and websites visited by users etc. By combining user and network context with Threat Intelligence, organizations can quickly identify infected devices and the users being targeted.

Streamline Security Operations Resources

With the shortage of cyber security professionals and the emerging threat of data breach, organizations cannot depend on scarce securit...

Table of contents

• Cyber Threat Intelligence
• Module 1
• Module 2
• Module 3
• Module 4
• Module 5
• Module 6
• Module 7