From the trenches: A CISO's guide to threat intelligence

Gone are the days of reactive-only security. Patching vulnerabilities after a breach is like locking the barn door after the horses have bolted. Threat intelligence allows us to shift to a more proactive stance. It’s about gathering, analyzing, and disseminating information on potential and ongoing threats. This intel helps us understand attacker tactics, techniques, and procedures (TTPs). In turn, we take proactive steps:

• Prioritize security efforts: We can focus resources on the most relevant threats based on our industry, attack surface, and vulnerabilities. No CISO has ever told me that they had more than enough resources (people, time, or budget). This is why security prioritization ranks as the first bullet item.
• Strengthen defenses: Knowing how attackers operate allows us to identify and plug security gaps before they’re exploited. If we know their TTPs and have prioritized our efforts, we can employ proper defenses in the areas most likely to be targeted or exploited.
• Informed decision-making: Investing in threat intelligence allows us to make data-driven decisions about security investments. No more throwing ideas at the wall and seeing what sticks. We can receive actual data from other organizations on what they saw, the impacts it had, and their response. This allows us to make smarter decisions! We’re not fighting alone when we use threat intelligence data to improve our programs.
• Improve incident response: We can tailor our response strategies to specific attacker behaviors, leading to faster and more effective mitigation.

Threat intelligence isn’t a one-person show. Building a strong team requires a diverse skill set. Here’s what I look for:

• Security analysts: These are the data detectives, sifting through threat feeds, malware samples, and dark web chatter to identify patterns and emerging threats.
• Threat hunters: Think of them as the proactive security SWAT team, actively searching for vulnerabilities and potential threats within our network.
• Intelligence analysts: These folks translate raw data into actionable insights, creating reports and threat briefs to keep everyone informed.

Collaboration is key in the cybersecurity world. Thankfully, we have standardized formats like Structured Threat Information eXchange (STIX) for sharing threat data and Trusted Automated Exchange of Indicator Information (TAXII) for secure communication. Imagine a global threat intelligence network where everyone contributes and benefits – that’s the power of STIX/TAXII. Building a threat intelligence program can seem daunting, but don’t despair. Here’s how to get started:

1. Define your goals: What threats are you most concerned about? Are you looking to receive or distribute information (hopefully both)?
2. Identify your resources: What skills and tools do you already have, and what gaps need to be filled? Do you have a network of peers that you can tap into? Talk to fellow CISOs and see if they have a resource who would like to build their own program.
3. Seek out threat intelligence feeds: There’s a wealth of free and paid options available, catering to specific industries and threats. In this case, the free resources are, in fact, valuable. Our industry cares and shares. Free feeds might demonstrate their value and convince you to upgrade to paid feeds!
4. Integrate with existing security tools: Threat intelligence should flow seamlessly into your security ecosystem. Make sure what you’re planning to use will integrate with your existing tools/technology. The data will only be valuable if you can interpret and action it.
5. Foster a culture of intelligence sharing: Encourage communication between your threat intelligence team and other departments (internally and externally). I go back to the US TSA tagline “If you see something, say something”. As an industry, the more we share, the better we all become at protecting our organizations.
6. Embrace automation: Use automated tools to collect and analyze threat data. This frees up your team’s time for more strategic tasks, like threat hunting and vulnerability assessment. Manual tasks will always (in my personal opinion) exist. Use automation as much as possible.

As we often say, security is a marathon, not a sprint. The same is true with threat intel. As threats evolve, so should our threat intelligence programs. By leveraging this powerful tool, we can transform our security posture from reactive to proactive and sleep a little sounder knowing we’ve got the upper hand (or at the very least aren’t getting totally behind) in the fight against cybercrime. If knowledge is power, why are we not actively seeking it? Threat intelligence data is one of our most potent weapons in our cyber arsenal. Don’t neglect it.

So, let’s go forth, fellow CISOs, and become masters of the intelligence game!