The Threat Intelligence Platform of the Future

The prevalence of cyber-crime is, despite fantastic innovations in security, still an increasing challenge. Preventing and responding to network security threats is an industry which continues to grow in leaps and bounds each year. More and more companies are investing in a threat intelligence platform, and experts estimate cyber-security will be <a href="http://www.forbes.com/sites/stevemorgan/2015/10/16/the-business-of-cybersecurity-2015-market-size-cyber-crime-employment-and-industry-statistics/#70ee12ea10b2" target="_blank">a $170 billion dollar industry by 2020</a>. We can expect some ingenious developments in the next few years to come.There is a new approach to studying cyber-crime; looking at their motivations rather than their methods. One might imagine skilled and “employed” hackers help themselves to more money than they know what to do with. Many are surprised to learn that hackers-for-hire generally take in around <a href="https://isc.sans.edu/forums/diary/Guest+Diary+Etay+Nir+Flipping+the+Economy+of+a+Hacker/21283/" target="_blank">$30K a year</a>. When you begin to understand how hackers choose targets, you can plan your defenses proactively.One thing threat actors have in limited quantity is time. <a href="https://www.anomali.com/blog">Deception traps capture hacker behavior</a> for study as well as divert their energy. The more nuanced and convincing your honeypot network is, the better it will work to waste hackers’ time and drain their motivation. Making yourself a less desirable target is a big yet often overlooked strategy for avoiding attack.Malware, spam emails, notorious IP addresses, add patterns to the ways traffic is analyzed for IOCs. Understanding a threat campaign can depend on looking back at a long period of time leading up to a breach. SIEM logs were trained for around three months, so hackers learned to be patient and rotate many “jobs” at once. As with the adage of the better mousetrap, programmers had to develop tools which go farther back in time.As the volume of collected intelligent grows, the task of analyzing logs for matches becomes a bigger task. New intelligence platforms of the future will need a means for rapidly identifying threats. One option is to send your traffic data out through an encrypted channel for referencing against known IOCs, rather than storing ever-growing volumes of threat data locally.Some features will become required in the US with the adoption of Cybersecurity Act of 2015. This rule encourages both private and public agencies to pool their threat intelligence. Government contractors began observing <a href="https://www.carbonblack.com/2016/06/14/federal-government-aims-set-standard-future-cyber-security-via-threat-sharing/" target="_blank">rules of the FAR mandate</a> in June of 2016. Contributing collected indicators of compromise helps others, particularly members of your same industry to have the benefit of previously collected threat data. Sharing attacker IP addresses, tactics, etc. can be done for the greater good without further endangering your network. You can comply by sharing only the relevant data points, and have the agency <a href="{page_253}">choose your own circles of trust</a>.Basic security platforms are sure to change with the times. The firewall, SIEM platform, and anti-malware suite you’re using are all produced by entities who strive to keep up with new threats. Your threat intelligence platform must be dynamic enough to <a href="https://www.anomali.com/partners/integration-partners">integrate seamlessly with these other solutions</a>. To learn more about the future of scaling-up your threat intelligence, download our white paper.<a class="cta_button" cta_dest_link="{page_3454}" href="https://cta-service-cms2.hubspot.com/ctas/v2/public/cs/c/?cta_guid=d082dffc-00d1-4e32-9613-f9706ead4533&placement_guid=b8474223-9140-4d88-8a84-1c87f8974d60&portal_id=458120&redirect_url=APefjpFwREb4ATuCcfUkIyeHHi4942jsutMCZ_jMd3-4h2Yok95jQ12Szg-C3Z_QErQx_R5ym2vJfEKYLbAP4oP1fdlUHbaMuKBFpwkAQfdy4QhgJqRXAbP1jLtmaLv7KCwr4-3baBhKPj8DzPjLY5FaWOmI2FaaHiMU4sU9XnRFZttf5by6K2Z06aYsA3bohtsHHLA_DtlhVGVkJlfVk7KkI8Z5n2UdymSLrblHyZgLjDyT3ONthElxM64YBlp_LPoOw8zXtobfEnGvT9fYXFsvNdNxk0P54WMSeRNJHuqj3DamKa-M1atEhyRykW5VnxYX0AN_FJK1P4MZ_dA8cimjW0oUhCuj9PUcKxVhc5d3YN6T3TEEUUujA9U_fafk41_1ZNCguiMc&hsutk=2767d93d6471d657e0c9f660e4b58ef8&utm_referrer=https%3A%2F%2Fblog.anomali.com%2Fthe-threat-intelligence-platform-of-the-future&canon=https%3A%2F%2Fblog.anomali.com%2Fthe-threat-intelligence-platform-of-the-future&pageId=4299932091&__hstc=41179005.2767d93d6471d657e0c9f660e4b58ef8.1456736058655.1478822660171.1478831861868.179&__hssc=41179005.52.1478831861868&__hsfp=1335165674" id="cta_button_458120_d082dffc-00d1-4e32-9613-f9706ead4533" style="margin: 20px auto;" target="_blank" title="Download Here">Download Here </a> <script charset="utf-8" src="https://js.hscta.net/cta/current.js"></script> <script type="text/javascript">hbspt.cta.load(458120, 'b8474223-9140-4d88-8a84-1c87f8974d60', {});</script>