Globally, the cyber threat level to organizations remains high and the current situation only serves to highlight this further.  To this point, any organization that has substantial gaps in its cybersecurity capabilities is operating at risk, and when the threat landscape changes, as it has now, so we become more aware of the vulnerabilities that we have carried for some time and the need for better Cyber Threat Intelligence. 

Why we need Cyber Threat Intelligence (CTI)
Two major cybersecurity events of the past 12 months really showcase the requirement for CTI in network security operations – the SolarWinds software supply chain attack which broke at the start of 2021 and the Log4j vulnerability response process that occurred at the end of 2021. Both of these incidents highlight the need to rapidly gain situational awareness, contextualize vast amounts of information being shared, and prioritize remediation of significant threats.

Looking specifically at Log4j, this is an open-source Java logging library developed under the Apache Software Foundation. Many software developers included it as a package to help with journaling of activity by an application or online service.  In fact, it can be found in many of the devices and services we use every day.  A software flaw was discovered which allowed remote code execution and information disclosure – and the rest is history.

Within days, thousands of attacks were levied as security teams scrambled to plug holes and deal with the impact of these attacks. Multiple advanced persistent threat groups, as well as cybercriminal groups, were spotted targeting Log4j and it serves as a reminder of the need to understand as much as possible, in real-time, as incidents like this unfold.

Developing CTI capabilities
The good news is that many organizations are focusing on developing their cyber threat intelligence capabilities, according to the latest 2022 SANS CTI survey.  The survey showed that more organizations are beginning to develop this capability, with an increase in respondents reporting that they are early on their CTI journey.  200 companies took part in this year’s survey and ThreatQuotient was a key sponsor.  

According to the survey, another vital ingredient for fighting off attacks and finding vulnerabilities is collaboration between CTI teams and business operations groups. That said, this year’s survey found that this sort of collaboration has suffered a decline since the shift to remote work in response to the COVID-19 pandemic. It takes time and effort for various teams to effectively collaborate, and an activity that was already not as intuitive or ingrained when organizations were primarily operating in person may be even more difficult now. 

Furthermore, the survey found that although threat intelligence platforms were not the main tool used by CTI teams — with “spreadsheets and/or emails” leading the way — they were nonetheless important and growing in adoption.  Reasons behind this varied, but it is certainly an area where vendors can improve the analysts’ experience by continuing to understand use cases and share more requirements between practitioners and vendors. 

The need for better collaboration and communication
Collaboration and communication are critical in CTI and, while some key components of collaboration were impacted over the past two years with the shift to remote work, increased threats and high workloads are aspects that can be addressed by both processes and tools. 

The Survey advises organizations to assess whether they have lost communication channels with key stakeholders and, that being the case, identify ways to build those channels back up. Additional tools may be needed to facilitate collaboration. Many CTI tools, such as ThreatQuotient’s threat intelligence platform (TIP), have built-in collaboration functionalities that teams can explore to see if they will fit with existing processes and workflows.  

The conversation around the value of TIPs is not new, and the pros and cons continue to be hotly debated. 

Going forward the SAN Survey recommends that TIP vendors should continue to identify models that are useful to customers and provide resources for those — and remember that analysis is rarely one-size-fits-all. Having more than one modeling option will allow analysts to apply the right frameworks to the right situations.

Why higher automation is the way to go
Half of the respondents advised that they use some sort of homegrown CTI platform and that most of the processing is still done manually, with a very low percentage utilizing full automation.  That said, the use of automation and integration in commercial and open source CTI management platforms has increased, representing a positive trend with the development of such platforms.  However, this is still an area where CTI vendors can improve the experience of analysts by continuing to better understand their use cases and requirements and increasing automation. Considering the number of different data formats and the increasing volume of such data the industry is dealing with, higher automation in processing and correlation is definitely the way to go. 

For under-pressure security teams, the ability to automate repetitive, time-consuming, low-level tasks is essential. If a tool can combine this automation with the real-time data and context needed to empower analysts to investigate high impact, time-sensitive incidents, even better. Effectively, teams need a balance between automation and manual investigation and a threat intelligence platform should deliver that using a native, data-driven approach.

Measuring the effectiveness of your CTI program and tools
Finally, one interesting takeaway from the survey is that there is still a high percentage of organizations that are not able to measure the effectiveness of CTI programs, tools, and sources. Measuring the value of an intelligence program means that teams will be able to justify the need for more resources, new people, new tools, moving organizations and the industry towards a higher maturity level. This is a call to action for both practitioners and vendors alike, to find better and easier ways to measure success in CTI.  If you are interested in reading the full 2022 SANS Survey, sponsored by ThreatQuotient, you can download it here.