Getting Started with Open Source Cyber Threat Intelligence

More and more enterprises are taking steps to protect their networks from threats by using systems which include open source threat intelligence. As of last year, 76% of businesses reported using threat intelligence collected from the intelligence community. Open source codes are made free to download and are designed to be tweaked to your specific needs. It has fostered an environment for sharing strategies as well as specific indicators of compromise which identify known hackers and their tactics.

Before you commit to software purchases, identify risks and assets to protect. Taking stock of all of the potentially exploitable assets on your network including email servers, file folders, web assets, etc. is an important step. Only after assessing all that you have to protect, you can find the right tools for doing so. Doing this work will help you prepare a case for managerial support. Presenting the need for an open source threat intelligence platform can be its own challenge in some organizations. By demonstrating the need for and value of threat intelligence, you can make your case and have funding approved.

Choose the specific software applications wisely. The system will function to keep overall traffic logs including activity in honeypots. There are some options for the location of these entities. Your honeypot can be installed on a local server, or a virtual machine. Not all programs are created equally, so compare their features before committing. The right platform will integrate with your existing firewall and SIEM, if not already bundled in. The most innovative companies will give you newer features sooner.

There are some basic requirements for installing open source threat intelligence. You will need a specialist to configure the platform, and personnel to manage it. Installation for Windows, Linux, or iOS is a little different, but the outcome is the same. Your system must meet some basic requirements:

• 256MB Ram
• 200MB Disk Space
• 1 Core
• Internet access

Install the platform with the help of an expert who can configure your alerts, firewalls, and honeypots properly. Convincing traps are enticing but not obviously so. Placing honeypots within and outside of your firewall is recommended. Where to place them within your network depends on your particular needs. Exceptions should be accommodated by the settings so that false positives are reduced as much as possible.

Plan for breach alert scenarios; who will respond to them, and how? Whether the staff is in-house or contracted through a vendor usually depends on the size of your company. Make sure you go with a source that will give you the amount of customer support you might need. If you don’t use the services, you can always scale back.

Businesses within the same industry share the same vulnerabilities, challenges, and in many cases have the same enemies. Whether you’re in finance, retail, healthcare, government or an SME, there is a lot you can do to cooperate with your contemporaries, even your direct competition. Contribute your IOCs back to the open source threat intelligence platform and benefit from others’ experiences. Intelligence sharing tools were built with real businesses in mind, so they allow you to withhold or anonymize the logs containing details about the threat. In fact, removing identifiers is required by law, per the CISA Act of 2015.

Sophisticated tools are now accessible to all size of enterprises thanks to affordable open source threat intelligence projects like the Modern Honey Net. For more info about using threat intelligence, check out our complimentary download.

View It Here