Cyber-Risks and Liabilities Sept/Oct 2022
The Benefits of Threat Intelligence
Threat Intelligence (TI) refers to data that is collected, processed, and analysed to understand a threat actor’s motives, targets, and attack behaviours. Through TI, organisations can analyse both previous cyber-attacks and potential future threats.
Rather than being reactive, TI allows organisations to adopt a proactive approach to cyber-security. This could prove vital, especially now that cyber-attacks are happening so frequently. In fact, more than 80% of UK organisations experienced a cyber-attack in 2021-2022, according to a CyberEdge report. By gathering TI data, organisations can bolster their cyber-defences, safeguard key assets and stay one step ahead of cyber-criminals.
TI feeds can include free indicator feeds, paid feeds, bulletins, internal intelligence gathering, and strategic partnerships. Regardless of method, TI can be grouped into three broad categories:
Indicators of Compromise (IoC) – Many TI feeds will provide IoC, including bad IP addresses, domains, hashes, and strings. This is actionable data that can be scanned against an organisation’s environment. If matches are found – indicative of system interaction with a known IoC – remedial action can be taken.
Tactics, techniques, and procedures (TTPs) – Considered a qualitative TI method, TTPs are the patterns of activities or methods associated with a specific threat actor or group. Organisations may find it beneficial to examine behavioural analystics and the latest modes of attack. For example, many recent cyber-attacks have been initiated through phising emails. Through this intelligence, organisatoins can take steps to close entry points for attackers (eg organising phising awareness training for employees).
Situational – This refers to other information useful to an organisation’s security strategy, such as details on cyber-trends and geopolitical situations.
With a multitude of TI platforms available, its important that organisations adopt tools or strategies that work for them. Regardless of the method, by utilising TI, organisations can become proactive in their approach to cyber-security. Rather than waiting for cyber-security events to happen, TI can help organisations pinpoint weaknesses, implement mitigation measures and close off entry points for threat actors.
For more cyber-security guidance, contact us today.
