What is Threat Intelligence?

Cyber threat intelligence surfaces the current and emergent threats to the organization. By understanding the tactics, techniques, and procedures of adversaries, organizations can more effectively counter threats before, during, and after a security event.

Threat intelligence programs help organizations make more effective decisions about how to address vulnerabilities, conduct testing strategies, develop incident response plans, and ensure business continuity in the case of an event. Threat intelligence teams work in collaboration with cyber risk teams and security teams.

The threat intelligence lifecycle is a continuous process that requires regular updates and reviews.

Here are the main stages of the threat intelligence lifecycle.

Environment scope

Before deploying a threat intelligence program, organizations must define their systems, data, networks, services, users, and other organizational assets. Organizations should classify organizational assets by operational criticality and data sensitivity. By understanding the scope of the organizational environment, it becomes possible to understand which threats will be relevant to the business and which assets may be a larger target.

Threat data collection

Once scoping is complete, the next step in the cyber threat intelligence lifecycle is to collate numerous data sources into a central source of truth. The threat intelligence system will ingest internal security data, system reports, and external sources like real-time open-source and vendor-distributed threat feeds, vulnerability databases, and social media and dark web monitoring.

This stage aims to capture as much threat data as possible to obtain a comprehensive range of information. Data ingestion at this stage is highly automated, constant, and not filtered for business scope.

Data processing

After data collation, the organization then filters, structures, standardizes, enriches, and transforms it to make it useful. Unstructured data is transformed into a machine-readable format, while structured data is cleaned to improve data quality and tagged with metadata. Redundant and out-of-scope data is removed. Processing should be as automated as possible.

Analysis

The analysis phase transforms threat intelligence data into actionable insights for the business. Automated systems will begin to identify patterns and relationships in any processed data, looking for anomalies, discrepancies, or results that cybersecurity teams investigate further.

At this stage, data analysts can use a range of advanced techniques, like applying machine learning and predictive modeling, to map specific threat indicators. These processes are both manual and automatic, designed to provide security teams with relevant and useful insights that inform cyber defense strategies.

Reporting

Reporting delivers the outcomes of threat intelligence analysis to business stakeholders and relevant teams. Reports are tailored to the audience and may include limited dashboards, text files, presentations, or other forms of communication.

The reporting stage is often automated, with threat intelligence systems generating a report and distributing it to any required personnel. When larger security threats surface, it may trigger the need for manual reporting.

Teams may also report new and unknown threats to the wider community, so that other organizations can integrate this information within their own systems.

Monitoring and adjusting

Threat intelligence systems monitor potential security issues, trace IOCs, and help support security teams. A threat intelligence system is a key software within a 24/7, staffed security operations center (SOC).

During analysis, teams can trace indicators of compromise (IOCs) related to potential security events to develop incident response plans and playbooks, deploy new or adjusted security controls, make system architectural changes, and update risks to the business. This informed response ensures a company’s security posture remains uncompromised.

Teams must learn from unexpected security events and new information to then iterate and improve on their previous performance. Security teams can review the performance of security tools, comment on responses, and flag inconsistencies to help threat intelligence software continuously improve.

There are four main types of cyber threat intelligence that security professionals will utilize.

Strategic threat intelligence

Strategic threat intelligence refers to broader threat landscape information that systems collect, including geopolitical data, economic data, and other non-technical intelligence that can be useful in building a contextual profile of a potential security event. This type of non-technical, strategic threat intelligence provides valuable insights that help in understanding wider security vulnerabilities and their development.

Tactical threat intelligence

Tactical threat intelligence refers to collecting information that relates to adversary tactics, techniques, and procedures (TTPs), including TTPs from advanced persistent threats (APTs). Industry-wide intel data is shared on public security feeds. This information provides security professionals with an understanding of the typical behavior of specific attacks, used vectors, and the sequence of actions that occur in any given security event.

Technical threat intelligence

Technical threat intelligence refers to any machine-identified signs of compromise. These IOCs, such as the presence of malicious IP addresses, unexpected security URLs, firewall responses, or the sudden change in expected operational values of a system, will all be flagged for teams to investigate further.

Operational threat intelligence

Operational threat intelligence is a composite form of intelligence between tactical and technical information. This form of operational intelligence will offer insight into industry-wide knowledge, like how a specific form of ransomware or malware is being seen increasingly in certain companies or regions. Operational threat intelligence allows companies to take steps to mitigate potential security events before they occur.