Cyber Threat Intelligence (CTI) – Part 2

In part one, I outlined what CTI is and where it can be acquired to demonstrate its value. Here I will dive deeper into how organizations can be efficient in using this tool to mature their security programs’ management of today’s threats. 

After CTI sources for the company’s threat intelligence program have been selected, the CISO now needs to address use cases on how this information can be leveraged to provide value and reduce risk exposure. Use cases for why CTI is important are as follows: 

Improved network security operations 

CTI can be used by the CISO to help improve the performance of the installed technology suite. Next-generation firewalls, IDS/IPS systems and secured web gateways are just some of the technologies that apply rules to block malicious traffic. CTI can be used to validate threat indicators, malware signatures, domain reputations and can help reduce false positives. Using streaming CTI as a service built into these devices the business should be able to take advantage of near real-time threat analysis. 

Patch management prioritization 

Patch management is one of the primary security controls used by all security programs and it is never 100% effective. The process is time consuming and even when using patch management solutions that have been automated to their respective enterprise environments, a CISO will still need to prioritize which patches to apply. This is where CTI can help patch management teams save time. Additionally, CTI can help teams be more efficient by prioritizing patches based on vulnerabilities that are being actively exploited and are applicable to the current business environment, not based on a CVSS score. 

Security operations 

Most enterprise network environments generate more alerts than security operations center (SOC) teams or incident response (IR) teams can properly investigate. Analysts unfortunately triage this deluge of data into events that should be escalated to the IR team; events to investigate when time permits or events that look normal so we will ignore them. In this environment, CTI can be used to provide situational awareness. Risk scores can be attached to threat indicators that will generate a flag in the security operation centers SIEM. This would then alert analysts to query the threat database to investigate a high priority threat anomaly, allowing both teams more efficient use of their time and providing contextual threat data on the events they are investigating. 

Attack/threat analysis 

CTI for this use case can assist IR teams when they are responding to an active cyber incident. When the attack is initially detected, CTI can provide insight into who may be behind the attack, the tactics and tools used to initiate the attack and the likely impact to the organization. I personally have used it during incident response to obtain real-time information to search in triaging the event and recommended procedures to halt the incident and clean up its after effects. 

Triage & remediation 

In this final use case, CTI is used by the IR teams and information security teams to document and uncover the impact of a breach event. Unfortunately, cyber criminals will conduct attacks in waves using multiple tools and techniques. I myself have seen attacks where several types of malware were used together. By using CTI, my teams knew which indicators to look for as we searched through the debris left after the intrusion incident. Using CTI in this final case provides context to security teams so they can quickly search for and remove any attacker’s residual connections from the network.

I hope from this discussion I have provided valid points on why cyber threat intelligence should be used to improve security programs and provide valuable benefits to an organizations’ strategic business operations. I truly believe CTI is a strategic asset and CISO’s need to incorporate it into their security programs and train their teams on how to efficiently use their selected information sources for the betterment of their company.