What Is a Cyber Fusion Center?

Drive Organization-Wide Visibility, Reduce Time to Detection, and Protect Critical Assets With a Cyber Fusion Center

The continual and evolving threats to information systems are a constant battle that prompted the creation of cyber intelligence analysts who provide contextualized data, information, and intelligence to those tasked with detecting and defending against attacks. Cyber defense systems need to become more responsive to internal vulnerabilities and adapt to external threats as attack methods evolve more quickly. It is this intelligence that enables them to do so.

The cyber fusion center is the hub for actionable threat intelligence. Structurally, it pulls together information and coordinates efforts across security teams; SOC, IT, physical security, fraud, etc. It also integrates multiple automation tools, collecting data from internal and external sources, curating data, and providing actionable intelligence to stakeholders to make informed decisions.

Designing a Cyber Fusion Center

Organizational Considerations When Creating Your Cyber Fusion Center

The primary goal and advantage of having a cyber fusion center is making cybersecurity an integral part of your organization. It allows you to manage risk holistically. Keeping this in mind, processes that produce actionable intel should be modeled first before creating organizational and system structures. Acknowledging that existing systems are managed by different groups and integrating competing priorities is essential. Systems will also need to be integrated, with redundancies identified and streamlined. Finally, each organization will have its own culture that should be taken into consideration throughout this process.

Teams: Is Your Cyber Fusion Center Communicating Cross-Functionally?

Resilient cyber fusion centers start with a circular flow of communication with priority intelligence requirement (PIR)-driven inputs. This cyber intelligence provides the most timely and comprehensive intelligence on external threats to the security operations center (SOC) for detection, monitoring, threat hunting, and, when needed, incident response. In return, those acting on the threats can recommend adjustments to PIRs that continually improve the necessary intelligence to inform proactive threat detection and respond better. That feedback ensures that the threat intelligence team remains focused on collecting and delivering threat intelligence aligned to organizational PIRs. In addition, this flow of intelligence should be infused with relevant information from functional areas with high-risk vulnerabilities (e.g., Human Resources, Finance, Fraud, etc.).

For example, a cyber intelligence team might discover a new ransomware campaign utilizing a specific tool and architecture. That intelligence is reported to the SOC with additional context of the group most likely responsible for the campaign, their other known tactics, techniques, and procedures (TTPs), and indicators of compromise (IOCs). The likelihood that the newly discovered campaign could impact the organization is based on a deeper understanding of the culprits’ motives, objectives, and previous actions. This type of intelligence empowers the SOC to prioritize response actions proactively to improve the organization’s security posture against both the immediate threat posed by the indicators of compromise (IOCs) and future threats posed by the same actor and their campaigns.

Tools: Managing Your Security Stack With a Cyber Fusion Center

While organizational processes are the basis for creating an effective cyber fusion center, automation tools are also essential. The risks of not automating can include missed threats, dormant threats, siloed threat intel, and unaligned intel.

You can enrich global threat intelligence through associated intelligence, peer sharing, and local telemetry; this enrichment begins with automated feed management, gathering all available, relevant threat intelligence. The security orchestration, automation, and response (SOAR) and security information and event management (SIEM) platforms consume IOCs to create and employ threat models that drive high-order, proactive decisions.

With this information flowing back to the beginning of the process, attack detection can be improved with exploit code and signatures. Incident response teams can monitor real-time global threat trends to guide their response activities. Security operations can minimize the attack surface by prioritizing improvements based on a global threat's potential impact on the organization. SecOps can also use threat intel to simulate attacks that highlight suggested changes to prevent the subsequent breach.

The Keys to Your Cyber Fusion Center Success

The critical elements for a successful cyber fusion center are::

• Having the Right People – More significant than the technology used is employing people with the right technical and organizational expertise.
• Knowing Who You’re Serving – Create a system that addresses critical vulnerabilities of the organization. It is vital to understand the needs of all stakeholders (Security, HR, Fraud, etc.).
• Supporting Tactical, Operational, and Strategic Intelligence Needs – Understanding strategic intelligence, such as geopolitics, is most valuable when it informs actionable operational and tactical intelligence for improved defense.
• Constant Communication – Keeping the channels of communication open is key to cultivating an effective feedback loop that ensures continuous improvement
• Efficient Curation – Intelligence that is processed to eliminate false positives and rate the reliability of the content dramatically improves the efficiency of the systems and people dependent on it.
• Well-Orchestrated Flow – The flow of information through technology systems and functional teams should be fluid and coordinated to ensure success.

How Can Anomali Help You Establish a Cyber Fusion Center?

With a team of seasoned cyber threat intelligence analysts and world-class intelligence products, Anomali can help you create a successful cyber fusion center. The expertise of Anomali's analysts, partnerships that provide access to feeds, enrichments, and integrations, and support of some of the largest information sharing and analysis centers (ISACs), enable the curation of the world's most complete threat intelligence collection.

Anomali solutions automate routine tasks (collection, curation, and simple investigations) and identify dormant threats. We help you operationalize threat intelligence, enable reports relevant to specific stakeholders (CISO, SOC, analysts, etc.), contribute to and maximize your security position, and lay the foundation for your cyber fusion center.

Learn how to start leveraging the power of cyber fusion centers from Anomali’s Chief Product Officer by watching the Practical Cyber Fusion–Operationalizing Threat Intelligence webinar.