Threat intelligence is a category of intelligence that focuses on information security. As defined by Gartner, it is “evidence-based knowledge…about an existing or emerging menace or hazard…to inform decisions regarding the subject’s response to that menace or hazard.” Essentially, threat intelligence provides you with curated information to inform you about potential malicious activity and helps you make better decisions about how to prevent bad things occurring to you or your organisation.
In order to sustain a strong security posture, an organisation must develop and answer questions specific to the business, many of which must be answered continually as situations and environments evolve. Questions such as: will bringing in additional security solutions really give that much more additional protection? Is updating each and every legacy system worth the cost? Who are my enemies and how might they attack me? Threat intelligence helps organisations to tackle these questions and make more informed decisions with context.
There are generally three ’levels’ of cyber threat intelligence: strategic, operational and tactical, which serve different functions.
- Strategic intelligence (who/why)
Focuses on assessing and mitigating current and future risks to businesses. As an example, a corporation releasing a new product or completing a merger will want to understand not only the potential impact but also the associated risks with the activity. This is particularly useful for CISOs and executive leadership who must justify budgets and make well informed investment decisions.
- Operational intelligence (how/where)
Helps fuel meaningful detection, incident response and threat hunting programs. This level of intelligence enables information security teams to identify patterns in attacks, from which logical system rules can be developed that can then detect specific indicators of malicious activity.
- Tactical intelligence (what)
Provides a reference material for analysts to interpret and extract context for use in defensive operations. This intelligence comes in the form of Indicators of Compromise (IOCs), which include items such as domains or IPs. Indicators are often changed quickly though, meaning that it is important for operational and strategic intelligence to also be incorporated into decisions.
The combination of these different levels of threat intelligence give security teams the ability to know how to proactively and reactively respond to risks. This includes what solutions to use, how they should be leveraged, and even just who to keep an eye on.
A further look into Strategic Threat Intelligence
Strategic intelligence gives the bigger picture, looking at how threats and cyber attacks are changing over time. Common focuses of strategic intelligence include historical trends, motivations, or attributions as to who is behind an attack. With strategic intelligence, you can answer questions like who is attacking your organisation and why?? Why are you within scope for an attack? What major trends are happening? What can you do to reduce your risk profile? All of this helps to profile your adversaries and provide clues to their future operations and tactics.
All of this makes strategic intelligence a solid starting point for deciding which defensive measures will be most effective. This gives insight into the following:
- Targeting trends for industry sectors and geographies
- Major attacker Tactics, Techniques and Procedures (TTP) changes over time
- Attribution for intrusions and data breaches
- Mapping cyber attacks to geopolitical conflicts and events (South China Sea, Arab Spring, Russia-Ukraine)
- Threat actor group trends
- Global statistics on breaches, malware and information theft
- Carrying out a thorough risk analysis and review of the entire technology supply chain
- Informing your executive leadership about high risk threat actors, relevant risk scenarios, and threat exposure in the public-facing technology sphere and criminal underground
- Learning which commercial ventures, vendors, partners, and technology products are most likely to increase or decrease risk to your enterprise environment
For example, if you are in the education sector, you may wonder what nation states and threat actor groups you should be concerned about, or where you need to focus your resources to reduce risk of an intrusion and theft of intellectual property.
Strategic threat intelligence is invaluable, incorporating expert opinions and insights that are based on aggregating both operational and tactical intelligence from known cyber attacks. By leveraging this data, organisations are better positioned to trade punches with tomorrow’s threats.
