Magazine menu Close Magazine menu

Threat Intelligence 2020

Kaspersky 2020 Threat Intelligence Campaign articles

Latest stories

Give your threat intelligence an intelligence test

  • min read
    • The saying "ask and you shall receive" seems to need a footnote or two these days. Make sure the furnishings you're ordering aren't meant for a doll's house. Remember that romantic poem, roses are red; spring onions are green? And quite who would be the happy recipient of this 'magical' Christmas mug, we'll never know. Threat intelligence can also be a case of 'wrong item delivered.' There are many products out there described as threat intelligence that aren't. And customers might not realize they're not getting what they asked for. So how do you give your threat intelligence an intelligence test? Threat intelligence is data analyzed Threat intelligence identifies and analyzes cyber threats aimed at your business. The keyword is 'analyze.' It means to sift through piles of data, spot real problems by looking at context and put in place a solution specific to the problem. It's most often confused with "threat data." Threat data is a list of possible threats, without analysis of context or tailored solutions. Threat intelligence should captivate your security team Once upon a time, there were IP and URL blacklists. Early security products would just refer to these blacklists to warn of a dangerous IP or URL. Over time, the amount of threat data grew exponentially. It became difficult to define what was a real threat and what wasn't. Security software wasn't designed to process so many indicators of compromise, like malicious file hash sums, domains or botnet server addresses. Some products marketed as threat intelligence include threat feeds and indicators of compromise, but without context – they're just vast amounts of raw data. This is a problem. Giving security operations such 'intelligence' will cause too many false security alerts. Alert fatigue has a serious impact on the overall security of your company. Research found 52 percent of security alerts are not investigated. And data, however relevant, is useless unless it has context and can be acted upon. With true threat intelligence, an InfoSec team can stop a breach early and protect a network, or realize they're just seeing everyday malware that doesn't pose a serious threat. Threat intelligence should tell your future Identifying yesterday's threat is history. Threat intelligence now focuses on the quality of data sources. It's not enough for data to bring insights but not give guidelines for decisions and actions. And when its quality is limited by lack of sources – such as not seeing into the darknet, or lack of global, multilingual reach – it can't be processed into effective threat intelligence. Intelligence must be able to predict how your business should prepare for and combat future threats. Threat intelligence should adapt to your organization A threat intelligence solution must be able to adapt to an organization's security needs. It must guide the organization to set up internal data collection points around critical assets. It then matches that data with external threat intelligence to identify threats. Without this targeted approach, it won't succeed in prioritizing information needed to defend key assets. As Helen Patton, Chief Information Security Officer (CISO) at Ohio State University said in a 2019 Forbes article, "Threats are only a threat in the context of the risk to the business itself." Threat intelligence can be acted on Threat intelligence is something you can act on. It must integrate multiple sources of information into an organization's security operations, through a single point of entry. To be effective, the organization must be able to use both machine-readable and human-readable threat intelligence. Its delivery methods and formats must allow it to be smoothly integrated into existing security workflows. It must give unique insights into emerging threats, so security teams can prioritize alerts, maximize resources and accelerate decision-making. Does your organization's threat intelligence pass? If not, it's time to get what you were promised. This article was published in April, 2020.
Threat intelligence drive SOCS

Use threat intelligence to find the needle in your cybersecurity data stack

  • min read
    • According to Benjamin Franklin, nothing is certain in life except death and taxes. And in our advanced technology age, we can add a new inevitability: cyber-threats. Before you even take your first sip of coffee on a Monday morning, a new threat that could have a severe impact on your infrastructure and data may already be in your system. You just haven't found it yet. Monitoring threats around the clock: powering your Security Operation Center So in a world where threats are everywhere, what are your options? Well, if business continuity and protection of data are a top priority for your enterprise, you've probably already invested, or are planning to launch, a Security Operation Center (SOC). Your SOC will monitor threats around the clock, so you can trust your security team to monitor and act to keep the most significant risks at bay. Rest easy. It's time to enjoy that delicious, hot coffee. Well, not quite. If data is the new oil, today we live in the aftermath of an oil spill. And data overload is as much a problem to your InfoSec team as it is to your marketing or customer operations. With the continued growth of more interconnected devices and the internet of things, having data on the many threats hitting your perimeter is all well and good. But understanding which are false positives and which need immediate action to quash is like finding a poisoned needle in your data stack. To find and immunize against that one-in-a-million alerts, you need threat intelligence. Why you need threat intelligence Threat intelligence is the overlay that turns seeing threats into knowing when and how to act. Gartner defines threat intelligence as: I'm not arguing with that. But no two battles against cyber-threats are quite the same. Using threat intelligence, you can join the dots between related attacks to pinpoint who your adversary is, then adjust your defense strategy to block them. Every day, we face more threats. Since Kaspersky was founded in 1997, we've added over 700 million new malicious files, a growth of 8,400 times. These range from everyday commodity threats – easily detected, known malware – to advanced threats and targeted attacks using known TTPs (tactics, techniques and procedures), and rare but deadly advanced persistent threats (APTs). The data paints an interesting picture, often referred to as a "threat pyramid." Mundane and known threats – common malware and so forth – make up 90 percent of all threats we see. Advanced threats and targeted attacks make up 9.9 percent. These hit small- and medium-sized businesses (SMBs) and enterprises hardest, with attacks like banking trojan malware Emotet, which is very active nowadays. A mere 0.1 percent of all threats are APTs, affecting few organizations but with the most devastating consequences. These are the most poisonous needles in our data stack. You need a strategy, not a platform Good threat intelligence is more than just buying a platform and hoping for the best. Like all effective cyber-prevention, it blends technology, strategy and effort. Good threat intelligence gives you the insight you can act on – from real-time alerts of a potential breach to helping paint a bigger picture that educates your senior stakeholders about the ongoing risks. This, in turn, indicates what software and investment you need to keep harm at bay. At the basic level, threat intelligence provides alerts and blocking for indicators of compromise (IOCs). Contextual alerts and e-signature management help determine the validity and severity of attacks to form your incident response approach. Another use case is fusion analysis – pulling together and evaluating disconnected data feeds to help identify which threats pose a danger. And threat intelligence can inform your cybersecurity strategy too. By using intelligence relevant to your risk posture, security planning informs architecture decisions and helps you refine your security processes to better defend against known threats. If you're working with a managed service provider (MSP) to run your security operations, ask how they'll install and run your threat intelligence service, and how much time and effort you're getting. Its round-the-clock nature means it's not the easiest service to outsource. Threat intelligence's big three When planning and buying your solution, you'll need three components: IOC (indicator of compromise) IOC is the basis of threat intelligence. It's evidence we can measure and recognize like a fever is the outward sign of disease in the body. There are many IOC services. To choose the right one, you'll need to know which threats you're most likely to face. Threat data feeds These provide integrated intelligence by analyzing adversaries and the wider threat landscape. There are many on the market, both free and paid. To choose the best one for you, ask: do we need an APT data feed if we're not a likely target for APT groups? Where is the best place in the IT infrastructure to add the feeds? Should we block threats or just alert the team? Your answers will depend on your organization's security posture and IT strategy. Threat intelligence platform A threat intelligence platform lets you manage a range of specialist software that supports the different components. What you choose and how you integrate services comes down to your budget and business needs. Although there are open-source data feeds out there, you can buy more sector-specific intelligence. It's essential to drill down when you purchase threat intelligence services to make sure the vendor provides a responsive service – both in the quality of data feeds and speed if they're providing incidence response. With careful planning, while choosing a vendor and a well-thought-out strategy, your SOC can benefit from the full protection and power of threat intelligence. The needles will still be in your data stack, but you'll have the tools to find and break them.
threat intelligence trends

How threat intelligence evolved, and where it will go next

  • min read
    • Cybersecurity has always been about the intelligence that powers the tools. It's this intelligence that battles the minds that make malware. The epicenter of the battle is identifying and analyzing threats, or threat intelligence. What makes it threat intelligence, rather than threat data, is analysis. To understand why threat intelligence will be so crucial in cybersecurity's future, we need to visit the museum of its evolution. More innocent times: The noughties Mulholland Drive was in cinemas; Shaggy and Destiny's Child sold CDs by the bucket. Email was standard for business, but less so for personal use. Anyone geeky enough to 'surf the net' for fun might visit an internet café to use a coveted, futurist desktop iMac. A revolution in attractive hardware, it looked like the candy-colored offspring of motorcycle helmet and refrigerator produce compartment. The precursors to threat intelligence started appearing at this time. First, there were IP and URL blacklists. Security software like Security Information and Event Management (SIEM) systems, and next-generation firewalls (NGFWs) used the blacklists to give alerts and reports. Security researchers manually searched for threats and sent daily updates to customers. The bright, new digital past: 2010 It was the year Iceland's Mount Eyjafjallajökull grounded flights across Europe with a cloud of ash. Everyone was talking about Wikileaks and the Arab spring. Facebook and Twitter had become household names, but were far less used by marketers and brands. The dark web and malign activities were exploding, showing the limits of the day's security software. It wasn't designed to process the number of Indicators of Compromise pelting down like a deluge of frogs. They couldn't identify and process the dust storms of malicious domains, IPs and other threats. The cybersecurity industry responded. Machine learning and artificial intelligence (AI) could automate and correlate data on a new scale. With millions of sensors, their data feeds netted oceans of information. They processed and analyzed it with big data tools. These systems began to be used to perform complex detection covering all attack surfaces. And the big data technology gave birth to the idea of threat intelligence. Machine meets human: 2015 It was the year of Je Suis Charlie, as many sided with French satirists against terrorism. 195 countries reached agreement over the Paris Climate Accord, but the color of a dress divided the world firmly into two camps. Security experts overseeing intelligence collection could reduce false positives and better see threats and attack methods specific to their organizations. It meant faster detection and response, and a change of emphasis to finding and prioritizing vulnerabilities. The world we now know From 2018, the threat intelligence industry ballooned. Hundreds of new companies popped up, offering targeted services focused on data quality. Their goal was to give guidelines for decisions and actions. The companies buying threat intelligence products and services started using them more effectively, for example, adapting their data collection for security needs. By 2019 the industry had adopted a shared understanding of what threat intelligence means. Bear with me – this chain has a few links. Threat intelligence means multiple sources giving relevant, targeted data. The data must be converted into information that can be immediately used. It must be integrated into an organization's security operations through a single entry point, and communicate seamlessly with their existing security controls. Its unique insights on emerging threats will let security teams prioritize alerts, maximize resources and make fast decisions. And what of 2020 onwards? The market is still growing. Research suggests threat intelligence could be worth 13 billion US dollars by 2023. Ever smaller organizations are starting to use threat intelligence. But in the main, this will be a new era of cooperation. To be more comprehensive, cybersecurity vendors are already integrating their products and services with others. Cybersecurity will move from reactive to proactive, while the role of security teams in organizations will grow. They'll interact more at all levels and with all business groups. They'll become responsible for delivering proactive threat intelligence that not only protects, but identifies risk and shapes business goals. Threat intelligence will effectively predict and prevent attacks at the earliest stage, and sooner or later, underpin the whole concept of proactive cybersecurity and organizational risk. This article was published in April, 2020.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries