Effective integration of threat intelligence with cyber defence

Threat Intelligence (TI) can help you gain deep insight into the risks and threats in your own system landscape by linking information modules. The benefits are faster detection of vulnerabilities and threats, and the ability to prevent or minimise data loss or system degradation through early detection.

What is Cyber Threat Intelligence?

Cyber threat intelligence is evidence-based knowledge that includes context, mechanisms, indicators, implications and actionable advice about an existing or emerging threat or hazard. Threat information without context is not very meaningful. It is only of practical value when linked to other data collected by cyber security researchers worldwide – for example, assessments, background knowledge on attacker groups, forensic investigations, reconstructions of malicious infrastructure or characteristics for actor identification.

Classifying data according to tactical, strategic and operational levels has proven itself. In addition to the temporal and geographical dimension, categorisation according to vulnerabilities, malware, indicators, techniques, affected systems, etc. is also beneficial.

Data feeds: Quality and relevance are crucial

Threat Intelligence gives organisations a decisive advantage in risk analysis and strategic reporting, monitoring, and threat hunting, detecting indicators of compromise and responding to security incidents.

The quality and relevance of data feeds is critical. Inadequate data can lead to frequent false alarms. This increases the workload and reduces the speed of response. The goal, on the other hand, is valuable input that allows alerts and tasks to be prioritised. Only by focusing on relevant alerts can the full added value for prevention work and the IT team’s responsiveness be realised.

In addition to external sources, internal data on malware detections and other security-related events can be incorporated into threat intelligence. This data is also placed in a broader context, for example, to understand attack entry points or to identify the typical behaviour of particular attacker groups. This can help determine whether a security incident within an organisation is a random, isolated event or the start of a professional attack campaign.

Prerequisites for the effective use of threat intelligence

Working productively with threat intelligence requires sufficient resources to make use of the data and the insights it provides. This includes financial resources and the appropriate technological infrastructure, as well as skilled personnel with expertise in cyber security, network security and incident response.

Automated tools and technologies such as security information and event management (SIEM) and threat intelligence platforms can be used to process and analyse large volumes of data. Access to a variety of trusted and up-to-date data sources is essential. These include public threat databases, security forums, proprietary data sources and commercial threat intelligence feeds. A combination of international and local data is ideal as it can give organisations a time advantage.

Effects and benefits of threat intelligence

Threat intelligence can provide insight into which areas of the organisation should be better protected as they are likely targets for attack. By having access to up-to-date and relevant information, organisations can take proactive measures to improve their cyber resilience.

• By analysing threat intelligence data, it is possible to better understand and assess individual risks and take appropriate action to minimise or automate risk. When integrated with a SIEM, threat intelligence can be used for case management to define customised workflows for security incidents, events, incident response and hunting missions.
• In the event of a security incident, threat intelligence can help IT teams respond more quickly and effectively by analysing the threat, initiating countermeasures, and mitigating the impact. In particular, it enables organisations to identify indicators and correlate attack patterns, better understand the motives and objectives behind attacks, and take targeted countermeasures to defend against advanced attack techniques such as Advanced Persistent Threats (APTs).
• Actions and integrations can also be implemented using SOAR (Security Orchestration, Automation and Response) services. Actions are defined as the unidirectional execution of an action from the platform to another defence technology, e.g., EDR containment, firewall or proxy rules. Integration refers to the bi-directional integration of other systems or software components, such as MISP export/import, ticketing systems or CMDB.

Integrating threat intelligence into your own company

Cloud or on-premises, traditional SIEM integration, IT platform or air-gap systems – the best way to integrate threat intelligence into your organisation depends on your infrastructure and your specific needs and objectives.

SIEM integration enables automated monitoring and correlation of events in real time. Integrated with case management, SIEM can check indicators associated with threat data, such as IP addresses, domains, or file hashes, and generate alerts when there are matches.

Threat intelligence can also feed firewalls/Intrusion Detection/Prevention Systems (IDS/IPS) to target traffic. Indicators from the feeds are compared with inbound and outbound traffic to identify and block known threats.

In addition to automated use, threat intelligence is used for targeted research, threat hunting and forensic analysis. Platforms that provide a user interface and do not require in-house infrastructure are well suited to these use cases.

This might also interest you:

Expert interview: Cyber Threat Intelligence for Incident Response and Threat Prevention

Cyber Threat Intelligence for OT and Critical Infrastructure

Solutions:

Datasheet IKARUS threat.intelligence.platform

Datasheet IKARUS 24/7 incident.response