The Definitive Guide to Sharing Threat Intelligence

<p>Threat Intelligence sharing is becoming more mainstream as ISACs and other industry sharing collectives gain popularity. As intelligence sharing becomes more popular, there are some things to consider to get the most out of it. Anomali’s new whitepaper, <a href="https://www.anomali.com/resources/whitepapers/the-definitive-guide-to-sharing-threat-intelligence">The Definitive Guide to Threat Intelligence Sharing</a> explores this topic in-depth.</p><p>Like many other things, the more you put into sharing threat intelligence, the more you can potentially get out of it. It starts with choosing who to share with. Understanding what is good to share is another import aspect to consider. Most of all, collaborating with those you share with is key to improving the value for everyone involved. Adding context to what is shared, or including extra details observed from your own analysis is an important element of sharing threat intelligence.</p><p>Sharing with others in our own industry is the best place to start with sharing intelligence. This is essentially “home” for sharing intelligence and interacting with peers around threats and defenses. For most organizations, this is the full extent of who they share intelligence with and there is nothing wrong with that. There are other considerations for adding additional sharing partners, however. For one, not all attacks come over the Internet; some require a physical presence such as attacks against WIFI infrastructure. Finding local sharing partners, potentially not in your own industry, can be important for localized intelligence sharing. Also important is finding partners to share with outside the echo chamber of your industry or vertical. Sharing within your industry is certainly the best place to start, but looking for organizations to share with beyond your industry as a next step is a good idea.</p><p>In addition to sharing intelligence, other considerations might be sharing defensive measures such as YARA rules, snort rules, scripts, system or application configuration tweaks, security tool configurations, and so on. The idea is to collaborate closely with other sharing partners to:</p><ul><li>Improve visibility for better intelligence analysis</li><li>Deliver stronger defenses that are optimized against observed and perceived threats</li><li>Provide a useful vehicle for coordinating intelligence collection and analysis</li></ul><p>Further thoughts on these topics as well as additional insights on threat intelligence sharing can be found in <a href="https://www.anomali.com/resources/whitepapers/the-definitive-guide-to-sharing-threat-intelligence">The Definitive Guide to Threat Intelligence Sharing</a>.</p><div class="content-block bg-blue-rectangles" style="margin-bottom:30px;"><div class="row"><div class="center col-xs-12 col-sm-4 col-md-3"><img src="https://cdn.filestackcontent.com/kF3YnmnS26q1zvlUhWEA" style="width: 300px;"/></div><div class="col-xs-12 col-sm-8 col-md-9 col-lg-9"><h2 class="text-white">The Definitive Guide to Sharing Threat Intelligence</h2><p class="text-lg text-white"><a class="button button-xlarge button-rounded button-border button-white" href="https://www.anomali.com/resources/whitepapers/the-definitive-guide-to-sharing-threat-intelligence">Read It Now</a></p></div></div></div>