Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

7/22/2015
10:30 AM
Ryan Trost
Ryan Trost
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Finding The ROI Of Threat Intelligence: 5 Steps

Advice from a former SOC manager on how to leverage threat intel without increasing the bottom line.

During my time managing a security operations center at one of the largest defense contractors, executives would constantly scrutinize security budgets, focusing on the areas of security architecture that could be streamlined. The process typically would lead to one burning question: how can security teams leverage threat intelligence to increase ROI without adding headcount or doubling the bottom line? My answer involved five key steps:

Step 1. Develop Key Performance Indicators (KPI)
Every successful security program needs metrics and KPI’s to measure against and report back to their organization. To implement a successful KPI program for threat intel intake, you’ll need to:

  • Deconstruct the team’s mission statement and map KPIs to the key elements (admittedly this is easier said than done but builds a critical foundation).
  • Decide which threats are really affecting your organization and which you can ignore. Cutting through the noise will save your security analysts time.
  • Evaluate each provider and decide which are providing you with solid, fast, and reliable information that you can map back to each quarter.

Step 2. Continually evaluate and reassess threat intelligence providers
There are no silver bullets in the cybersecurity industry and the same is true in the world of threat intelligence. If you’re looking for a one-size-fits-all approach, you’re viewing the problem in the wrong way. Here are the questions you need to address:  

  • Is there overlap among threat intelligence vendors and communities?
  • Which sources cater to your defensive tools?  (If a provider hands you 6 million malicious IP addresses do you have the tools to operationalize them?)
  • Which threat feeds are complimentary?
  • Which providers distribute intelligence that overlaps with attacks your team has investigated?

Step 3. Prioritize alerts to efficiently utilizing security analysts’ time
Instead of seeking out the latest and greatest technologies to add to a roster of network protections, enterprises should identify new ways to effectively leverage the tools they already have. The security information and event management tool is the perfect example. It correlates trillions of events creating alerts, but analysts become submerged by the sheer number because there is little to no true prioritization. However, if teams efficiently integrate threat intelligence feeds with their SIEM, analysts could significantly improve alert prioritization and jumpstart analyst triage investigations.

Skilled analysts are in short supply and high-demand! It can take a massive amount of resources to find, hire, and retain a qualified security analyst. Worse, and one major downfall I’ve frequently observed, is the misuse of security analysts’ time and expertise. Organizations have the tools to properly defend the organization but their analysts are stuck performing manual tasks rather than focusing on bigger picture solutions and processes.

Step 4. Foster collaboration between ALL analyst teams
Too often analysts sitting shoulder-to-shoulder (let alone across the room or building) don’t effectively collaborate on indicators, malware techniques, victimology, etc. And no, the answer isn’t having another daily standup meeting. Instead, make it easier for security analysts, intelligence analysts, malware analysts, incident responders, and signature/content engineers to talk to each other across geographic locations through tools like HipChat, Sococo, or Skype, and coordinate semi-annually onsite meetings to build relationships. Similarly, encourage analysts to collaborate with peers within like-minded communities outside of the organization.  Join local security cohorts rather than wait for RSA and Black Hat every year to share threat intelligence over a few beers.

Step 5. Pilot threat intelligence providers before buying
Many organizations pull the trigger on selecting a provider after reading two or three sample intelligence or malware reports -- the provider’s “golden child” of reports. But that isn’t a good day-to-day representation of what the providers’ publish. I recommend asking for a 30-day evaluation period where you can evaluate:

  • When the threat information is released and figure out which time is most efficient for your organization;
  • How valuable are the reports in relation to industry threats and are they relevant to your organization;
  • The volume of data published and whether the data is easy to consume and push out to your security infrastructure;
  • If the threat feed helps cut down on security analysts’ time and ability to consume the information.

At the end of the day, you need to choose a provider that you and your organization trust. If there isn’t mutual trust at the beginning of an engagement, the relationship will be rocky forever.

Ryan Trost is the CIO and co-founder of ThreatQuotient. Prior to ThreatQuotient, Ryan was Senior Director, Cyber Intelligence Solutions Architect at SRA International and SOC Manager at General Dynamics, where he led the information technology and security teams. Ryan is an ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JulienOrmidal
100%
0%
JulienOrmidal,
User Rank: Apprentice
7/30/2015 | 4:45:56 PM
Analytics
Hi,

Thats a really interesting article. For me it would be more than 5 steps but you did a good resume of how it is hard to really prioritize and deal with analytics issues. For me thats the real challenge for companies and government to deal with Big Data and analytics for the next 10 years atleast...

Julien
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.