Why Did Threat Intelligence Platforms Become a Must?

The goal of threat intelligence is ultimately to dramatically reduce the incoming number of cyber-threats including hacking, malware, and internal threats. This end is achieved through an active, ongoing effort to identify potential threats. Discovering would-be targeted attacks as well as random Trojan injections is an ongoing project. This undertaking can require effort, expertise, and the right software configurations.Adaptation of multiple monitored connections and traffic data collection points created multiple environments in which threats can be discovered. The perimeter model based on a solid firewall has been determined to be inadequate if not overly optimistic. Cyber security experts now agree that such as hackers work in steps and layers so must the security applications. Such as a secure home has a fence, entrance alarms and a safe, multiple applications are employed across the network in their respective environments.When the threat data gathered by these separate elements can be leveraged together, they become <a href="{page_3258}">more valuable than the sum of their parts</a>. A threat intelligence platform is not a defensive mechanism so much as it is a research tool.Actionable information about threats on the horizon can come from more sources than your own threat intelligence platform. Data describing threat actors, their methodologies and other identifying factors can be anonymized and channeled into a standard machine-readable language. Threat feeds are channels through which you can request, send and receive intelligence. These libraries are enormous and continually getting bigger. The volumes against which your own traffic logs are compared are too big to store locally, so remote delivery models have been adapted. They vary by product and vendor but all work to analyze all of your network events together to present alerts which are reliable and meaningful.These sophisticated applications were initially developed for and marketed to large scale operations, most of which held highly sought after data. Hackers soon realized smaller and medium sized organizations were, by and large, not using a threat intelligence platform and subsequently, <a href="http://www.ponemon.org/blog/smbs-are-vulnerable-to-cyber-attacks" target="_blank">SMEs were attacked more</a>. Having less security but still possessing exploitable resources, they were overall a more desirable target. That gap was shored up with the introduction of more threat feed options. Services can be scaled up or down to accommodate any network. Analysts have, through much hindsight, identified indicators of a pending insider threat. This was impossible before experts looked beyond the firewall.With the introduction of an open source honeypot code free to download, even more users came on board. So many users created a plethora of data which can be further mined for specifics about individual threat actors as well as discoverable patterns or tactics. These users can publish, request and share intelligence with others through their threat intelligence platform. There are different models to describe various vendor/peer or peer/peer relationships, some of which are subscription-based while others are free.Some users have reservations about privacy, as we all should. Programmers understood these concerns and addressed them. Indicators of Compromise and other intelligence must be made anonymous to protect the identities of victims. Practices are in place for unilaterally <a href="{page_253}">sharing intelligence with peers</a> in self-defined groups.This technique holds so much merit that the US government, along with many others, has adopted threat intelligence into its mainstream security operations. Government agencies and contractors are all now required to run cyber-threat intelligence programs and participate in threat sharing. If your enterprise plans to grow big enough to take on government contracts, this will apply to you as well. For the rest of us, it’s currently encouraged but not mandated.When you consider the effectiveness of collecting intelligence it makes a compelling case. In one survey, <a href="http://www.ponemon.org/blog/the-second-annual-study-on-exchanging-cyber-threat-intelligence-there-has-to-be-a-better-way" target="_blank">75% of users believe intelligence gathering is critical</a> for an effective cybersecurity strategy. Considering that these programs are much less of an undertaking than they were at their inception and now work from even more data, we cannot think of a reason not to use a threat intelligence platform.<a class="cta_button" cta_dest_link="{page_3457}" href="https://cta-service-cms2.hubspot.com/ctas/v2/public/cs/c/?cta_guid=bfe9d714-b9a1-4733-8b89-44b169eb6a53&placement_guid=bd3e320b-6f5f-47ad-ae30-589597d266a4&portal_id=458120&redirect_url=APefjpElrzWvvMBSKgYM_rPFb6cu7d0r0rQbTVnW9isPH2gdEMKJvqnMjjUfUOT5GfXXMSGA_YyDsPLN-gDoK2iDzFZQgNwb959rOoweUN4LTXvGWW_LkcdMk16tLxFVG-VFP2StGjyhptlCyn_lKPGJ6FeO9UBOvFPbYu8pbEnSZ9pNORzGLDP7rj3Lwb6Zw5SoL5z57wiYa09cPAGR827wIEnYFSRfzr3450PvvQsDsyKca0-IRTFkOaXe2X4Lwkz4CYonljgkNNBgznYu3CKOwQolrgmDMxKtpeYPajlYm36trqS67sbAIDclKAKrZRz8fmdyKqfo4CYEa_q9mqYqsLK7FMHUPQ&hsutk=2767d93d6471d657e0c9f660e4b58ef8&utm_referrer=https%3A%2F%2Fblog.anomali.com%2Fwhy-did-threat-intelligence-platforms-become-a-must-find-out-here&canon=https%3A%2F%2Fblog.anomali.com%2Fwhy-did-threat-intelligence-platforms-become-a-must-find-out-here&pageId=4335043504&__hstc=41179005.2767d93d6471d657e0c9f660e4b58ef8.1456736058655.1478467980860.1478822660171.178&__hssc=41179005.38.1478822660171&__hsfp=1335165674" id="cta_button_458120_bfe9d714-b9a1-4733-8b89-44b169eb6a53" style="margin: 20px auto;" target="_blank" title="Download Here">Download Here </a> <script charset="utf-8" src="https://js.hscta.net/cta/current.js"></script> <script type="text/javascript">hbspt.cta.load(458120, 'bd3e320b-6f5f-47ad-ae30-589597d266a4', {});</script>