Best sources of actionable threat intelligence
Connecting state and local government leaders
Sources of threat information can be found both inside and outside an organization – not just in network monitoring logs and intrusion prevention systems.
In today’s world of ongoing data breach cycles, federal agencies struggle to keep up with the threats that loom over systems that hold sensitive data – everything from personally identifiable information and protected health information to design plans for the latest stealth aircraft.
The problem is now receiving attention at the highest levels of government. For some time now, the White House has considered the idea of a federal government-led fusion center for coordinating threat intelligence, but it only recently became official when the White House announced the formation of the Cyber Threat Intelligence Integration Center.
So how can organizations provide actionable threat intelligence in an effective and efficient manner?
First, it’s important to accurately understanding the term “threat intelligence.”
Threat (as defined by NIST) is any circumstance with the potential to adversely affect organizational operations and assets, individuals, other organizations or the nation through an information system via unauthorized access, destruction, disclosure, modification of information and/or denial of service.
Intelligence (as defined by the FBI) is information that has been analyzed and refined so that it is useful to policymakers in making decisions – specifically, decisions about potential threats to national security.
Taking these definitions into account, it’s clear that sources of threat information are found in a variety of places both internal and external to an organization – and certainly not limited to technical sources such as network monitoring logs, firewalls, intrusion detection and prevention systems, malware analysis tools, honeypots, phishing traps and so on.
The phrase “any circumstance or event” could also mean heightened activity on a Dark Web forum (the deepest, darkest parts of the Internet where underground cyber criminals discuss and conduct illegal activity), a post on social media or an attack against a government ally in a different part of the world.
Just these few examples show how much work is required to sift through all of these data sources.
So where should agency personnel begin in identifying data sources that will result in actionable threat intelligence? Some potential sources exist in the existing IT environment:
Local data logs: Review system logs, packet captures, malware, incident data, local honeypots, IP addresses that “phone home” to command and control servers operated by the criminals.
Hard drives: Perform forensic analysis on infected machines, looking for attack patterns, targeted files and data.
Logical/physical access system logs: Analyze login attempts, check swipe access logs into the datacenter or server room – wherever the most sensitive data resides. Look for odd or unusual patterns in both.
Performing analysis on this magnitude of data is no small task. As a result, IT managers need to develop a solid data analysis strategy that incorporates people, processes and, most definitely, technology. Automation is absolutely paramount when dealing with this volume of data. The following high-level outline provides a simple starting point:
- Conduct a risk assessment based upon the agency mission.
- Identify the threats that pose the most danger to the mission. Who wants the data? Why? Consider both insider and outsider threats.
- After compiling a good list of potential threats, assess their capability and intent. A disgruntled user who was just fired may want to exact revenge but may be limited in capability. A system administrator in the same scenario has both capability and intent.
- Take inventory of the data sources of threat information needed to help identify the biggest threats to the agency.
- Go one step further and determine how many of those data sources can be compiled by individual staff members and which others require additional effort in order to collect data. For example, does the current service-level agreement (SLA) with the agency’s cloud service provider allow the IT manager access to logs that may hold data critical to help track down attackers?
Finally, the key to identifying threats is to start planning now. Time is the most valuable asset in the event of an attack. Once a system is breached, there’s no turning back the clock. Agencies must rely on thorough preparation and analysis of threats in order to stay one step ahead of the attackers.
NEXT STORY: Senate, DSS eyeing threat scanning systems