Best Practices for Threat Intelligence Management

Threat intelligence management is the culmination of a broad scope of practices which are all means to the same end. The objective of threat intelligence management is to get a comprehensive and accurate understanding of active and potential cyber-security events. During your assessment, all manner of traffic and other intel sources should be addressed together.

Begin with a thorough assessment of assets. Digital assets include your proprietary information, business outlook forecasts, financial information, etc. Are they centrally located or housed on separate servers? If web function and the ability to perform e-commerce is something on which you rely, try and estimate its exact value. Assets critical to your operation will naturally be at the top of the list and prioritized. Other concepts such as credit rating, insurance liability, and consumer confidence should be sized up and included among potential losses.

Next, perform due diligence to discover weaknesses and liabilities. This refers to actual stopgaps in the network security or disconnects between the server and cloud as well as personnel vulnerabilities. Using a white hat hacker to test your security can be a valuable research exercise. Ethical hacking is a growing industry. Employees or subcontractors affiliated with white-hat organizations will test your network. Some companies will pay a from $50 up to $20K for a single flaw. These skilled consultants will test the ports and firewalls, etc. They will also probe for insider threats - weak link employees who inadvertently or overtly compromise your network.

This knowledge transfer may require information flow models. IT security specialists cannot do their best work if all of the salient details about threats are confined to informational “siloes” in other departments such as risk management and human resources. Committees for sharing information about threats must be created with great care.

Address the human element of threat intelligence management by looking for “analog signals” which forewarn trouble. Using a formal inside threat awareness program requires a task force that includes members of HR, legal, physical security. Insiders can inadvertently invite trouble if they fail to perform due diligence. An employee who routinely falls for phishing is a potential disaster that should be communicated. Early signs of an inside threat may require communication among departments which do not typically share info about employees. Train management to recognize the signs of a mole or employee disgruntled enough to create a threat upon hiring and throughout employment. A malicious insider may be identified in time if you look out for these such conditions or behaviors:

• Was demoted, passed over, disciplined, or otherwise “slighted”
• Is experiencing financial troubles
• Has been disruptive or exhibited anti-establishment views
• Is underperforming
• Requests access to sensitive or important files
• Approaches others to share credentials

Social media isn’t just “a PR thing” when it comes to risk management. Personal and social networks can be both a great research tool and a giant blind spot. A target attack may begin with the hacker researching company or employees’ social media. Social engineering schemes work best with specific details which can be lifted from profiles and posts. Sites which share company structure or upcoming events can inform phishing attempts. Hackers who need to enlist an insider to their cause watch for signs of malice or discontent.

Further, prevent insider jobs by limiting network access to only files identified as relevant to job duties. Login credentials should be monitored closely. Upon termination, the exit process should include revocation of access to email, VPN, Cloud servers, social accounts, etc.

The sources of malicious traffic can be custom defined. Start with general SIEM and firewall as a basis to complement threat intelligence. Intelligence feeds must be well informed in the context of probably external threats. The platform configuration should be strategized using the aforementioned research.

Plan for the inevitable, a successful hack. It has been deemed unrealistic to say that you will never experience any breaches. Threats and vulnerabilities are constantly evolving, and with these fluxes will come gaps in your defenses. Have a solid recovery strategy for both the network itself and the people affected. Identify ahead of time who will be the point-persons, and how will they respond.

Form solid backup policies that will reduce down time. Assemble ahead of time a crisis team that includes IT security, physical security, and public relations. In cases of an insider threat, human resources may need to be involved. In scenarios where other parties are harmed, the legal team will be called upon.

Comprehensive threat intelligence management requires you consider the sources thoroughly. If you’ve never taken a top-down approach to including threat intelligence in your whole organization, do not be overwhelmed. There are lots of informative resources to guide your cyber-security efforts.

Download Here