The Need for Maintaining a Pulse on Emerging Global Cybersecurity Threats

Welcome to the final blog in the series where I’ve been diving deeper into the Top 10 Cybersecurity Challenges Organizations Face as found in our Cybersecurity Insights Report.

If you’ve followed along and kept up with me, thank you. If you’ve downloaded the report, thank you again.

Coming in at number one on our list (drum roll, please): Maintaining a pulse on new and emerging global cybersecurity threats.

I think the fact that this came in at number one should come as no surprise to security professionals, especially considering that the threat landscape is constantly changing and evolving at an alarming rate. Today’s attackers are more innovative, adapting and deploying sophisticated attacks daily.

According to our research, 62% of organizations use tools and technology to monitor global threats and accelerate their threat intelligence performance.

Threat intelligence should be foundational to any security program, as should threat intelligence platforms or threat intelligence management solutions.

These tools inform security teams, helping to turn raw data into relevant intelligence. They also help automate processes for intelligence professionals to manage stakeholder requirements, maximize data analysis by understanding adversaries’ intent and objectives, and improve decision making.

Cybersecurity Risks are Global

The world is changing rapidly, with technology becoming increasingly central to how we live and work. This digital transformation presents challenges and opportunities and requires organizations to think differently about cybersecurity.

The threat landscape has never been as complex as today. There are no longer just “traditional” cyber threats. Everything is interconnected, and attacks can come from anywhere.

Organizations must look beyond their perimeter to take a holistic view of cyber risks and consider the full range of potential attack vectors, including physical infrastructure, communications networks; software applications; human behavior; and data center operations.

The threat environment is evolving quickly, and security professionals must ensure they keep pace.

Threat Actors Are Growing More Sophisticated

In today’s world, hacking is a multi-billion-dollar business. Gone is the traditional stereotype of the lone hacker in a hoodie, working solo. Cybercrime as a service, modeled after the Software as a Service (SaaS) business model, is stronger than ever.

For example, ransomware attacks can be purchased via an affiliate program. Affiliates can use already-developed tools to execute ransomware attacks. And earn a percentage for each successful ransom payment.

Even customer care centers field ransomware victims’ inquiries, instructing them on how to procure the bitcoins attackers demand in exchange for a decryption key for unlocking a forcibly encrypted PC or server.

Keeping Pace with Attackers

As attackers develop new ways to exploit critical vulnerabilities, the number of threats continues to rise. Cybersecurity professionals face various threats from multiple groups, including nation-states, organized crime, hacktivism, and human error.

In addition to the traditional security concerns of data breaches, financial loss, identity theft, and fraud, security teams now face challenges related to the speed and sophistication of modern attacks. These include:

• Attacks that target critical infrastructure
• Sophisticated forms of social engineering
• Zero-day exploits
• Targeted phishing campaigns
• Automated lateral movement

The Past Informs the Future

Technology is constantly evolving, making it difficult for most to keep up with the latest changes and innovations. This is nowhere more apparent than within cybersecurity.

Like other industries (or Hollywood), most new hacking innovations don’t appear out of the blue. Many of today’s threats are both extremely familiar and yet entirely new. (Much like the Point Break remake.)

They are typically based on previous iterations, trying to improve upon what worked before and leaving behind what didn’t.

That’s why cybersecurity professionals must stay focused and keep up to date with the latest threats and technological trends.

Maintaining a Pulse Starts and Ends with Threat Intelligence

Threat intelligence needs to be at the foundation of any security program. Threat intelligence enhances detection capabilities and informs security professionals of potential cyber risks with real-time information to help them better understand:

• Who are my adversaries, and how could they attack me?
• What are the attack vectors that affect the security of my business?
• What should my security teams be looking out for?
• How can I reduce my company’s risk of a cyber attack?

When we came out with the report, one of the biggest challenges security teams said was a lack of threat intelligence information, which I found surprising at the time.

I’ll repeat what I said: there is no shortage of threat data out there. What they may lack is RELEVANT intelligence.

True Threat Intelligence is Organization-Specific

There’s no way to effectively defend an organization or its sensitive data without knowing what threats they face in the first place. Threat intelligence offers critical insights into the policies and technology deployments needed to best defend against potential risks or threats targeting an organization.

The effectiveness of your security posture relates directly to the quality and timeliness of your threat intelligence. Analysts equipped with curated, relevant threat data can act quickly, securing the organization’s most valuable assets first and conducting efficient investigations afterward.

Threat Intelligence Management Solutions

Keeping up with the threat landscape is hard to do. Today, most threat intelligence solutions focus on helping organizations automate the process of finding the needles in the haystacks.

Most security teams turn to Threat Intelligence Platforms (TIPs) or Threat Intelligence Management solutions to help. Solutions, like Anomali ThreatStream, automate the collection and processing of raw data to transform it into actionable threat intelligence for security teams. ThreatStream helps build relationships between the various pieces of data to better prioritize and respond to threats and increase analyst productivity with real-time information, resulting in the following benefits:

• Automated correlation of data with threat intel
• Perform contextual analysis of threat intel data
• Improved ability to correlate and triage threat intel data
• Ability to generate alerts based on threat intel data
• Better visibility into the effectiveness of existing security tools
• More efficient threat hunting
• Increased mean time to detect and respond
• Confidence scoring in the accuracy of threat intel data

You also need relevant intelligence feeds to power these solutions.

Relevant Intelligence Feeds

A threat intelligence feed is an ongoing data stream related to potential or actual threats to an organization’s cybersecurity. TI feeds provide information about attacks, including zero-days, malware, botnets, and other security threats. There are three kinds of threat intelligence feeds, including:

• Commercial or premium feeds - information aggregated by vendors from professional research and customer telemetry information
• Open Source Intelligence (OSINT) feeds - Threat data collected and shared among cybersecurity professionals but is generally focused on one area and may need additional structure.
• Information Sharing and Analysis Center (ISAC) feeds - Threat data curated by industry-specific organizations. These organizations share information on cyber threats and facilitate data sharing between the public and private sectors.

Each feed provides different elements, making it necessary to have multiple feeds and, in turn, a threat intelligence management solution. An effective threat intelligence management solution can combine various feeds, automating the process and surfacing the most relevant information when needed.

Threat Intelligence Sharing

With cyber threats becoming increasingly sophisticated, the need for effective communication and collaboration has never been more critical. Participating in industry-specific sharing initiatives like ISACs and ISAOs enables organizations to compare their threat situations with similar critical infrastructures, products, and vulnerabilities.

Sharing threat intelligence can enable security teams to act quickly and effectively. Unfortunately, most cybersecurity execs don’t want to share information.

Organizations can’t operate in silos anymore when cyber adversaries use a full range of tactics from across multiple industries. Sharing threat intel with others helps reduce redundancy to speed up responses and establishes a united front against cyber criminals.

Download The Definitive Guide to Sharing Threat Intelligence to learn more.

Know Your Adversary

One of my favorite Sun Tzu quotes from the Art of War is:

“If you know the enemy and yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained, you will also suffer a defeat. You will succumb in every battle if you know neither the enemy nor yourself.”

While cyber threats are universal, and it’s essential to know who and what is out there, certain threats and threat actors target specific industries and verticals. You could consider them as “potential” adversaries until your organization has sufficient evidence showing that they are.

Based on the risks outlined in your relevant threat landscape, you can select the right blend of threat intelligence feeds that will help power your threat intelligence program to inform your security team.

Understanding who your enemy is and your attack surface will help you in cyber battles.

The Need for a Proactive Approach

Today, threats evolve quickly, targeting specific vulnerabilities to exploit known weaknesses in real-time. Organizations must shift from a reactive to a proactive mode to keep pace.

Proactive security requires you to collect and analyze data across multiple sources to detect anomalies and identify potential risks. Using threat intelligence as the foundational piece of a cybersecurity program enables organizations to become proactive and fuel other parts of the business and operational technology. For example, being able to trigger a process due to the receipt of new intelligence and take it through several stages to action it on the relevant security controls.

A strong, proactive approach to threat intelligence enables a cybersecurity team to focus on threats that matter most, with relevant context, implications, and remediation recommendations.

Power of Threat Intelligence

A proactive, threat intelligence-driven approach helps organizations defend against known threats but will also help increase the power of other tools to uncover previously unknown security threats.

• Big Data Analytics – Threat intelligence combined with big data analytics enables organizations to capture current and historical event logs, asset data, IOCs, and active threat intelligence to transform billions of alerts into one decisive verdict.
• User Behavior Analytics – User behavior is analyzed using machine learning to develop a baseline of normal behavior. Integrating intelligence allows outliers to be identified for investigation, helping to find any bread crumbs of activity that a threat actor may leave behind.
• MITRE ATT&CK Framework – Map threat detections with the Mitre ATT&CK framework with relevant intelligence to understand—and stay ahead of—adversaries.
• Threat Hunting – Accelerate threat hunting activities with automated intelligence-assisted activities to identify the possibility of something malicious happening within the network or likely about to happen
• XDR - Extended detection and response solutions collect telemetry from security tools in real-time to eliminate security gaps. Anomali provides an intelligence-driven extended detection and response solution that integrates relevant intelligence to enable security analysts to pinpoint relevant threats, understand their criticality, and prioritize response. The result? Improved efficiencies and more robust defenses.

There are many reasons why maintaining a pulse on new and emerging global cybersecurity threats is essential. An effective threat intelligence management solution can help your security team stay on top of your relevant landscape.

Reach out to or download our Managing Threat Intelligence Playbook to learn more.

Thank you all for reading this series. I hope you’ve found it helpful. It’s been fun exploring the Top 10 Challenges security teams face. Scroll through below to catch up on any of the blogs in the series you might have missed.