What’s next for threat intelligence? – ITProPortal
It seems that right now, everyone is talking about threat intelligence. Nearly every security vendor wants to get in on the action and the majority of security operations groups are either being told by their management to get on board with it, or they’ve attended various security conferences and realised they need to add threat intelligence into their security program.
That said, the questions most security operations groups always come back with, though, are: What should I get? How do I use it effectively and ultimately, how is it going to help me?
I’ve been in threat intelligence and security operations for most of my career; first with various military, government and intelligence organisations, then as a co-founder of iSIGHT Partners, and now with ThreatQuotient. I’ve worked with threat intelligence since before it was cool, helping numerous early adopters around the globe to understand what threat intelligence is and how to use it within their organisations.
In my experience, a threat intelligence platform that’s worth its salt has the potential to help organisations in three key areas, which are to communicate more effectively, focus resources more efficiently and manage risk more successfully. These are by no means the only areas of your security strategy that will feel the benefits, but here’s my quick take on why they are my top three.
Improve communication
At some stage, every CISO or SOC manager will be asked by management, concerned about the latest hack: What do you know about it? How does it affect us? What are we doing about it? A solid threat intelligence strategy provides you with a means of being proactive and ensuring that you’re on top of your cyber security, so that you’re in a position to answer these questions before they are even asked.
Leaders also want a way to answer these questions in business terms and let management know what you are doing as a security operations group. Effective threat intelligence gives you the information you need to change the conversation from “we blocked a million events this month,” to “we stopped ransomware attacks which would have cost the company $2M.”
Focus resources
On a network, there are only three things security operators need to deal with; noise, nuisance and threats. You need to filter out the noise (blocking it at the perimeter or detecting it and automatically remediating), focus on threats (the real gotchas that can negatively impact shareholder value) and determine if a nuisance is actually noise or a threat and deal with it accordingly.
An effective threat intelligence platform helps organise the threats and provide the information you need to isolate what really matters. It provides a means of automatically filtering the noise while also enabling threat intelligence enrichment through an analyst workbench to understand and address the nuisances. In short, a good threat intelligence platform lets you operationalise your approach to cyber security.
Manage risk
Once you are using threat intelligence to improve communications and focus your resources, you can start diving into risk management. A threat intelligence platform lets you take a more strategic view of the business critical assets you need to protect, the threats that are targeting these assets and the ways in which they are going about it, and the countermeasures you have in place. From there, you can figure out your risk gap and turn that into a strategic discussion with the board about accepting, transferring or mitigating risk, and the investments required.
As VP of Strategy, it’s my responsibility to ensure that our platform meets these requirements and helps organisations to strategically implement threat intelligence. Moving forward, I’m convinced that threat intelligence will be a deciding factor in the success of many cyber security strategies and it is vital that organisations are staying ahead of the curve by actively looking at how they improve communication, operationalise threat intelligence and manage risk.
I therefore think we will be hearing a lot more about threat intel and seeing adoption accelerate over the coming few years.
Jonathan Couch, VP of Strategy, ThreatQuotient
Image source: Shutterstock/BeeBright
Threat Intel
via threat intelligence http://ift.tt/290FOXX
September 15, 2016 at 02:12AM
securityXspace 
Leave a Reply