The Need to Share

<p><em>The Benefits of Sharing Threat Intelligence Inside and Outside Your Organization</em></p> <p>Welcome to this week’s blog. I hope you’re enjoying this series and what you’ve read so far if you’ve been following along. If you’re new, welcome as I dive deeper into the Top 10 Cybersecurity Challenges enterprise organizations face, as found in our recently released <a href="https://www.anomali.com/resources/whitepapers/anomali-cybersecurity-insights-report?utm_medium=document&utm_source=anomali&utm_campaign=harris-poll&utm_content=blog&cid=7014z000001Ivxt">Cybersecurity Insights Report 2022: The State of Cyber Resilience</a>. </p> <p>Coming in at number seven on our <strong>Top 10 List of the Challenges Cybersecurity Professionals Face</strong> is "<em>Lack of ability to share threat intelligence cross-functionally</em>."</p> <p>In an August <a href="{page_5707}">blog</a>, I wrote about President Biden’s Executive Order that sought to ensure that IT service providers share threat information about incidents with the federal government and collect and preserve data that could aid threat detection, investigation, and response. My comment was that before we share information as an industry, organizations need to break down their silos to share threat intelligence internally. It was not surprising to see this surface as one of the Top 10 Challenges organizations face. (I know, a clock is right twice a day, too, I’m taking the win here. Even if no one else is reading, I enjoy writing these.)</p> <p>Digital transformation has quickly expanded attack surfaces. Now more than ever, global organizations must balance a rapidly evolving cybersecurity threat landscape against business requirements. Threat information sharing is critical for security teams and organizations to protect themselves from cyber-attacks. The problem with sharing threat intelligence is that most organizations don’t know where to start.</p> <h2>Enter Cyber Fusion</h2> <p>Thirty years ago, military intelligence organizations developed the concept of cyber fusion, which combines HUMINT (human Intelligence) with COMINT (computer intelligence). They used the idea to collaborate with different intelligence communities and gain an in-depth understanding of the threat landscape. Cyber fusion is becoming increasingly popular in the cybersecurity industry, with organizations creating cyber fusion centers or using technologies like threat intelligence management or XDR (extended detection and response) solutions to eliminate silos, enhance threat visibility, and increase cyber resilience and collaboration between security teams.</p> <p>Cyber fusion offers a unified approach to cybersecurity by combining the intelligence from different teams into one cohesive picture. It also helps to integrate contextualized strategic, tactical, and operational threat intelligence for immediate threat prediction, detection, and analysis.</p> <h2>How to Start Sharing Threat Intelligence Internally</h2> <p>Cyber fusion takes a proactive approach to cybersecurity that helps organizations break down barriers and open communications across their entire organization to help them identify and address cyber risks before they become an issue. A cyber fusion approach helps foster collaboration among different departments within the company to focus on areas that ensure protection against relevant threats.</p> <p>By getting more people involved in keeping up with security issues and cyber incidents, organizations can ensure their investments and resources focus right where they need to be.</p> <p>Click on the image below to <a href="{page_6052}">download</a> our new ebook to learn more about how you can utilize cyber fusion to help break down silos within your organization.</p> <p><a href="{page_6052}"><img alt="" src="https://cdn.filestackcontent.com/MzOfcGJUQQ44vywJTNAo"/></a></p> <h2>Concerns with Sharing Threat Intelligence</h2> <p>Legal issues have prevented most companies from sharing information about attacks, with the primary debate focused on what data should be shared and how. Other concerns, as outlined on our <a href="https://www.anomali.com/resources/sharing-threat-intelligence">resource page</a>, include:</p> <ul> <li><strong>Privacy and liability concerns</strong>: These can be overcome through a more accurate perception of sharing intelligence, protective clauses in legal agreements, recent legislation, or care in what is being shared.</li> <li><strong>“There is nothing of value to contribute”</strong>: No organization sees every attack. Sharing seemingly insignificant details can aid visibility and help produce a more fully sourced intelligence analysis.</li> <li><strong>Lack of expertise: </strong>Even if you are not a trained professional, adding whatever context, observed attack details, and, if possible, analysis developed by those on staff is still beneficial to the community.</li> <li><strong>Fear of revealing an organization has been hacked:</strong> The fear of sharing breach details more broadly than with the entities necessary is common but can be remedied by following best practices while sharing.</li> </ul> <h2>Sharing Threat Intelligence is Good for Everyone</h2> <p>As threat actors become progressively more sophisticated, it is increasingly essential for organizations to share threat intel and leverage the community’s collective knowledge to improve their security posture and timely implementation of adequate defensive measures.</p> <p>With detailed and contextualized threat intel, organizations can better anticipate and identify malicious activity and utilize intelligence to speed detection and prevent attacks.</p> <ul> <li><strong>Collaborate:</strong> Foster relationships between organizations and increase trust among them.</li> <li><strong>Get context:</strong> Gain varied insights from people within the community with broad contexts.</li> <li><strong>Discover blind spots</strong>: Uncover threat actor insights that might not have been seen previously.</li> </ul> <h2>Challenges Sharing Threat Intelligence</h2> <p>Quantity: An overwhelming number of threats is impossible for analysts to handle manually, as they continue to chase false positives to triage, process, and act on the highest priority security incidents.</p> <ul> <li><strong>Verification</strong>: A threat actor or attacker may file false reports to mislead or overwhelm threat intelligence systems, threat feeds, or a threat investigation.</li> <li><strong>Quality:</strong> If the focus is more on collecting and sharing more threat data without threat processing, there is a risk that much of it will be duplicative, wasting valuable time and effort. </li> <li><strong>Agility:</strong> Security professionals need to share threat intelligence in near-real-time to match attack speeds. Intelligence received too late may not be able to prevent an attack, but it can still help understand it better.</li> <li><strong>Correlation:</strong> The failure to identify relevant patterns, key data points, and trends in threat data makes it challenging to turn data into intelligence, which can be used to inform and direct security operations.</li> </ul> <h2>Where to Start or Expand Intelligence Sharing</h2> <p>Whether your organization is currently sharing intelligence or is considering doing so, here are some tips to help you get started or improve on what you’re already doing.</p> <p>1. <strong>Tools and communities:</strong> Begin with choosing appropriate tools to share threat intelligence. Email is the most accessible place to start but focus on moving into more formal methods of sharing through available tools, possibly leveraging standards such as STIX and TAXII. ISACs (information sharing and analysis center) and other industry organizations are perfect communities to get started with intelligence sharing and typically have mechanisms in place for doing so. </p> <p>2. <strong>Share and contribute</strong>: Make sure to contribute to sharing once sharing partnerships are in place. Also, contribute where your team can add additional context to intelligence shared from other parties. Sharing observed adversary behaviors, attacks seen, or details from incident response are great places to start. </p> <p>3. <strong>Share outside your vertical:</strong> Look for opportunities to share with organizations outside your vertical. This includes localized entities such as fusion centers and other organizations deemed a good fit for sharing intelligence. </p> <p>4. <strong>Consider sharing with vendors:</strong> This suggestion probably isn’t for everybody. If the section on sharing with vendors resonated with you, consider some potential vendors who might be beneficial to share intelligence with and reach out to them. </p> <p>5. <strong>Share hunting & defense techniques:</strong> Threat hunting details such as searches that have proved valuable, specific log entries that are useful, and other related information can turn into short-cuts in other organizations’ hunting efforts</p> <p>6. <strong>Share breach details:</strong> Breaches can be sticky subjects inside organizations. Depending on the legal framework in place that facilitates intelligence sharing, ample protections around disclosure could exist to ensure protection for sharing breach details with sharing partners (consult legal advice pertinent to your specific agreements to be sure). What this brings is a variety of potential benefits for all parties involved. </p> <h2>Learning from Each Other</h2> <p>By exchanging threat intelligence among a sharing community, organizations benefit from the community’s collective knowledge, experience, and capabilities to better understand the threats they face. Therefore, threat intelligence sharing is a critical tool for the cybersecurity community. It takes the knowledge of one organization and spreads it across the entire industry to improve all security practices.</p> <p>Cyber threat intelligence sharing is about finding out indicators of compromise or information around cyber-attacks or vulnerabilities and discussing strategy. By understanding what security defenses other people are using or planning to use in the future, everyone can better prepare for potential threats.</p> <p>Information sharing doesn’t have to just be about an actual cyber threat. Sharing best practices, successful and unsuccessful approaches, attacker strategies, etc., can help organizations strengthen their defenses against modern cybercriminals.</p> <p>Anomali has multiple resources to help you understand the benefits of threat intelligence, including why and how you should share threat intelligence. Download our <a href="https://www.anomali.com/resources/whitepapers/the-definitive-guide-to-sharing-threat-intelligence">Definitive Guide to Sharing Threat Intelligence</a> to learn more.</p> <p>Join me next time as I continue this journey and look at number six on our list. </p> <p>In the meantime, download our <a href="https://www.anomali.com/resources/whitepapers/anomali-cybersecurity-insights-report?utm_medium=document&utm_source=anomali&utm_campaign=harris-poll&utm_content=blog&cid=7014z000001Ivxt">Cybersecurity Insights 2022 Report </a>or scroll through below for direct links to the other blogs in this series.</p> <div data-aspectratio="1.47193878" id="experience-622f9b42b3fc4" style="position: relative;width: auto;padding: 0 0 67.94%;height: 0;top: 0;left: 0;bottom: 0;right: 0;margin: 0;border: 0 none"><iframe allowfullscreen="" class="ceros-experience" frameborder="0" scrolling="no" src="//view.ceros.com/anomali/interactions-build-along-2-12-1" style="position: absolute;top: 0;left: 0;bottom: 0;right: 0;margin: 0;padding: 0;border: 0 none;height: 1px;width: 1px;min-height: 100%;min-width: 100%" title="Top Cybersecurity Challenges for Enterprise Organizations"></iframe></div> <script data-ceros-origin-domains="view.ceros.com" src="//view.ceros.com/scroll-proxy.min.js" type="text/javascript"></script>