Best Threat Intelligence Platforms

Threat intelligence platforms comprise various features that will help your security team to quickly understand what threats your organization is facing, to make better decisions, and to act upon them faster. Threat Intelligence Platforms can be deployed as an on-premise or SaaS solution and should be able to perform the following key functions:

• Aggregate global data from multiple sources into one manageable location and convert it into a uniform format. It should also be able to bring together internal threat and event data from sources such as the log management repository, ticketing systems, case management systems, and SIEM (security information and event management) system.
  
  
• Curate the data, correlate indicators and events with external data, and provide context as to the who, what, where, when, why, and how of an attack.
  
  
• Integrate with existing security systems and tools such as SIEM and case management solutions, allowing these technologies to work more efficiently and to deliver fewer false positives. It should also integrate with the sensor grid (IPS/IDS, next-gen firewalls (NGFW), routers, endpoint protection, email and web security, etc.) to generate and apply updated rules and policies.
  
  
• Analyze and share threat intelligence that will empower your security teams to act quickly against relevant threats. The time it takes to detect and respond to threats should be reduced and ultimately the threat intelligence platform should help your organization garner valuable insights that will allow you to anticipate threats and be more proactive in preventing them.
  

There are three kinds of threat intelligence:

1. Strategic threat intelligence provides you with a broad overview of your organization’s threat landscape. It helps inform high-level decision-makers, so the content is generally less technical. Strategic intelligence should explain broad patterns in threat actor targets and tactics as well as geopolitical trends and events, and should provide insight into the risks associated with taking certain actions.
   
   Sources for strategic threat intelligence may include:

• news from national and/or local media and other publications.
• policy documents from nation-states or organizations.
• research reports, white papers, and other documents produced by security organizations.

Analysts who have expertise outside of technical cybersecurity skills - such as an understanding of business and sociopolitical concepts - are required for producing strategic threat intelligence. They must conduct large amounts of research, some of which is difficult to perform manually. Threat intelligence solutions that automate data collection and processing are helpful in this process.

2. Tactical threat intelligence outlines the TTPs of threat actors in order to help you understand specifically how your organization might be attacked and how you can best defend against those attacks. Tactical threat intelligence is generally technical and is used by security staff, system architects, and administrators who are directly involved in cybersecurity.

Tactical threat intelligence can be found in reports produced by security vendors. It is important for informing improvements to your existing security controls and processes and to speeding up response time. Many tactical intelligence questions need to be answered on a short deadline, so it is important to have a threat intelligence solution that can integrate data from within your own network.

3. Operational threat intelligence is specific knowledge about cyber attacks, campaigns, or events that can help your incident response teams understand the nature, intent, and timing of specific attacks. This is also known as technical threat intelligence because it includes technical information such as what vulnerabilities are being exploited, what command and control domains are being employed, or what attack vector is being used. Threat data feeds are a common source of this technical information, as are closed sources such as the interception of threat group communications.

The following are barriers that can get in the way of gathering operational threat intelligence:

• Access to threat groups due to privacy settings/encryption or language barriers.
• Noise from high-volume sources (e.g. social media, chat rooms) can make it difficult to manually gather good intelligence.
• To avoid detection, threat groups might use code names or employ other obfuscation tactics in order to avoid detection. Many of these issues can be overcome with threat intelligence solutions that collect data through machine learning processes.
  

Many of these issues can be overcome with threat intelligence solutions that collect data through machine learning processes.

1. Social engineering. Almost one-third of security breaches in 2020 incorporated social engineering techniques. These include phishing (posing in an email or phone call as a legitimate institution to get personal details and passwords; scareware (manipulating users into believing they need to download malware), and quid pro quo (calling random people and pretending they are tech support int order to get access to the victims’ computers). At the core of all of these techniques is a manipulation of human psychology.

2. Ransomware. This is a program that encrypts data and then demands payment for its release. Ransomware is one of the most popular kinds of malware used for data breaches.

3. DDoS attacks. A distributed denial-of-service attack occurs when a system’s bandwidth or resources are flooded, causing a disruption in service. While the computers are down, hackers employ those that were previously compromised by malware to perform criminal activity. Criminals have also begun to employ AI (artificial intelligence) to perform DDoS attacks. Recent dependence on digital services and increased online traffic has created more vulnerability than ever.

4. Third-party software. If a program that was developed by a company other than the original developer is compromised, this opens a gateway for hackers to gain access to other domains. As many as 80% of organizations have experienced a cybersecurity breach caused by a vulnerability from one of their third-party vendors.

5. Cloud computing vulnerabilities. Criminals scan for cloud servers that are not password protected, exploit unpatched systems, and then perform brute-force attacks to access user accounts. Some also try to steal sensitive data, plant ransomware, or use the cloud systems for coordinated DDoS attacks or cryptojacking (mining cryptocurrency from victims’ accounts).

People often conflate threat intelligence and threat hunting, but they are not the same thing. Threat detection is a more passive approach to monitoring systems and data for potential security issues. Threat intelligence can be used to identify potential threats, aiding a threat hunter in his active pursuit of bad or threatening actors on the network that automated detection methods may have missed. It prioritizes the process over the matching of patterns.

Threat hunters develop hypotheses based on their knowledge of the behaviors of threat actors. They then validate those hypotheses when they actively search the environment for the threat actors. A threat hunter doesn’t necessarily start with an alert or an indicator of compromise (IoC), but rather with forensics and deeper reasoning. In many cases, the threat hunting is actually what creates and substantiates the alert or the IoC.

To be successful, a threat hunter must be able to use his or her toolset to find the most dangerous threats. He or she must also have knowledge of network protocols, exploits, and malware in order to navigate all of the data at hand.

Cyber threat hunting is often compared to real-life hunting. It requires patience, creativity, critical thinking, and a keen eye for spotting “prey.” The prey generally comes in the form of network behavior abnormalities, and a good hunter can detect it even before it has actually been spotted “in the wild.”

Threat intelligence is a part of the greater threat hunting process, but just because you have threat intelligence does not necessarily mean you have a threat hunting program.

Threat hunting is used to find threats that manage to slip through your perimeter-based security architectures. On average, it takes a company more than six months to identify when one or more of its internal systems have been compromised. And once an attacker has snuck into your network, they may stealthily remain, quietly collecting data, looking for confidential material, and obtaining login credentials so that they can move laterally across the environment.

Threat hunting is necessary in order to reduce the amount of time between when our protections fail and when a response to the incident can be initiated. Once an attacker has penetrated your organization’s defenses, you need to be able to find them and stop them. Cyber threat hunters gather as much information as possible about an attacker’s actions, methods and goals. They also analyze collected data to determine trends in an organization’s security environment, eliminate current vulnerabilities, and make predictions to enhance security in the future.

There are typically three steps in the threat hunting process:

1. The trigger - When advanced detection tools identify unusual activity, a trigger points the threat hunters to the system or area of the network that needs to be investigated.
2. Investigation - The threat hunters dive deep into the potential malicious compromise of the system. This investigation continues either until the activity is deemed benign or until the threat hunters have a complete picture of the malicious behavior.
3. Resolution - Relevant intelligence is communicated to security and operations teams so that they can mitigate the threat and respond to the incident. The data gathered can also be fed into automated technology to improve its effectiveness for the future.

Threat levels indicate the level of risk to your organization cyberattacks.

• A low risk level (green) means that there is no unusual activity or elevated concern for viruses, hacking, or malicious activities.
• A guarded risk level (often colored blue) means that there is a general risk for potential viruses, hacking, and malicious activities. No known exploits have been identified or no significant impact has occurred. There may be a new virus or credible warnings about a threat but as yet there has been no impact. When a blue level is reached, vulnerable systems must be identified and appropriate countermeasures put into place.
• An elevated (yellow) risk level indicates a significant risk due to a virus, hacking, or other malicious activity that may compromise systems or diminish services that are not necessarily critical. There are known vulnerabilities being exploited and/or a high potential for significant disruption or damage. At this level, monitoring of systems should be increased and countermeasures should be implemented immediately.
• A high (orange) risk level indicates that there is a high risk of virus, hacking, or other malicious activity that may compromise core infrastructure and multiple critical systems, or infrastructure. When this level is reached, security mechanisms should be monitored closely and you may need to consider limiting or shutting down any connections to external networks that are not critical. It may even be wise to use alternative methods of communication rather than electronic.
• A severe or red threat level indicates a severe risk for a virus, hacking, or other malicious activity that may result in widespread outages and or compromise systems significantly, debilitating critical infrastructure. Targets at this level are core services such as critical routers, VPNs, firewalls, IDS systems, authentication servers, or DNS servers. There may be no known remedy to attacks on this level. If you reach this threat level, you will need to shut down all connections until the issues have been corrected and isolate internal networks to limit or contain the disruption or damage.