Threat Intelligence Feeds Can Help in Unexpected Ways

Now that threat intelligence feeds are more available than ever, it’s time to rehash the possibilities for protecting data for all scale of organization. Using open source threat intelligence does more than aggregate your firewall and SIEM. It will alert you to the other manner of conditions which precede a cyber-security incident.

Ransomware attacks can seemingly come out of nowhere. One moment you’re all working and the next thing you know the screen is demanding payment amidst jarring graphics. Malware attacks like ransomware scandals don’t just happen all of a sudden. To take over your network and its data, hackers must first get inside. If you can discover a hacker before the encryption has taken place, there is still time to respond.

Your cyber-threat intelligence platform works best when customized to expect threats relevant to your industry. You can trade information with partners to enhance your platform’s basis of comparison. In this process of gathering information about online threats, you may identify new players in the real world. Corporate and government espionage is not just the stuff of movies; campaigns to steal, sabotage, or destroy data can come from anywhere. Identifying parties who are sending phishing messages or locating the source of account credentialing hacks can reveal enemies who had before gone unidentified.

Staff retention is a major component of management. Hiring and training employees come with an inherent cost of labor and lost productivity. Employees take your training with them when they leave to work for the competition or themselves. Hopefully the experience is all they take, although employee data leaks are occurring at a high rate. Losing proprietary info is lost income at the least; at worst it can result in a scandal that shakes consumer confidence forever. Signs of discontent can be detected digitally. Ideally, you can turn an insider situation around before the employee is recruited to be a mole or takes it upon itself to find the goodies and walk. If not, you may have an opportunity to revoke access to important files before it’s too late.

Threat intelligence feeds can help detect insider threats. Hapless mistakes result in catastrophic hacking crises. This could mean everything for companies at risk of experiencing advanced persistent threats. 91% of hackers creating APTs used a spear phishing campaign to get an initial foothold. Phishing relies on successful social engineering. Data about email vulnerabilities are of use to both IT security and risk management. Why not discover the weak links before it becomes an HR issue, too?

Some hacks occur as a result of exploitable login credentials. This job becomes easier when employees use company email addresses to sign up for social media, forums, fantasy sports, etc. If you configure your threat intelligence feed to notify you of accounts created with company email addresses, you can discover careless broadcasting of that particular vulnerability.

Honeypots can feed valuable data into your threat intelligence feeds which can yield interesting intelligence. All honeypots capture the source of traffic and any exploit tools used. Giving hackers options of which fake elements to pry into will reveal their motives. Realistic and varied deception traps can capture activity of unwelcome visitors and provide them an environment in which to exhibit “tells”. Is the hacker after email correspondence, salary data, or data pertaining only to one person? Seeing the specifics gives you so much more useful context.

The overall theme is that there’s no reason your IT security configuration cannot be creative. Convincing honeypots and well-configured threat analysis tools will make for better threat intelligence feeds. Every network is different and hackers certainly aren’t following any rules. View Now!