Written by Zak Layton Elliott, Cyber Security Analyst

Introducing Threat Intelligence

Cyber Threat Intelligence or CTI for short, is a tool and process that can be utilised by organisations to understand what is happening around you in your industry and the wider threat landscape. CTI uses the intelligence cycle (that we’ve previously spoken about, find more here) to collect information, process it, and analyse the data from a variety of different sources to turn it into intelligence which can be used to understand the potential threats you could be facing and what adversaries that are at play.

Where does the Intelligence come from and what can it do?

CTI starts out as information that can be gathered from a huge variety of sources. The difference between the initially gathered information and the intelligence you get from processing it through the intelligence cycle is that it becomes actionable.

There are both free and premium feeds available that can provide the raw information as well as other free alternatives with Open Source Intelligence (OSINT) that can be utilised for a similar outcome but requiring more input.

This intelligence can be used to find Indicators of Compromise (IoC) which are tell tale signs that something is likely happening or about to happen. Examples of an IoC include: failed login attempts from strange locations or in large quantities, sudden influx of spam or phishing emails, spikes in endpoint device resources, unusual outbound traffic on your network, and so on. The idea is that they can vary from simple signs like failed login attempts to something more complex which needs context to be understood that something is even happening; these examples are based around events that could occur for a specific organisation but IoCs can also be found further out in the industry by looking at trends, reports, and breaches to see what is happening in the bigger picture that can be expected.

CTI can also help to provide context to a security team by providing crucial insight into what could seemingly be an inconspicuous activity going on, that is more complex than meets the eye.

How is CTI utilised with Incident Response?

CTI can be a critical tool to use when it comes to an organisations incident response process. It can be used to predict and prepare for an attack or breach before it occurs.  It can do this by finding and understanding suspicious activity that is going on both inside an organisation or in the industry amongst an organisations partners and competition.

Threat Intelligence can go on to assist an organisation following an attack as well by continually providing further context on what happened, such as how the attack or breach occurred, who was behind it, their motives and other targets, and if they are likely to be a target again soon. This can feed into the lessons learned process to strengthen defences, direct training needs, and improve the incident response process and management if needed.

As well as this, an organisation can feed back into these same intelligence cycles to help other organisations identify, endure, recover from attacks, and to improve future available intelligence.

Where can you start?

As we mentioned, there are several different ways that CTI can be utilised and how it can be sourced. A great initial free source of threat intelligence are as easy as setting up Google alerts that are tailored to specific threats, vulnerabilities, systems and software, industries, and current topics so that any mention of them online are alerted to you via email. Another source is a free feed from TLDR (https://tldr.tech/), there are loads of topics to choose from that you can get notified about and are definitely very useful in keeping up to date in what is going on at the moment that could be relevant to you.

Utilising OSINT is a great way to find information that you can look to understand more on as well, this is the process of doing your own research or utilising OSINT tools to find what information exists on the internet from open source platforms that could be an IoC or general information to provide context clues to what is occurring that can affect you.

Finally, there are loads of paid-for intelligence feeds out there that you can look into, they will all serve a slightly different purpose so do some research to find one that is right for you if that’s the path you want to go down but they can offer a more tailored and relevant approach to your intelligence requirements to save your organisation on some work in the collection and analysis steps of the intelligence cycle so they may be a worthwhile investment.

If you have any questions or would like to speak to us further around Threat Intelligence, Incident Response, or anything else, please contact us at info@principledefence.com