What is Cyber Threat Intelligence?

• February 27, 2023
• By SECNORA

Cyber Threat Intelligence (CTI) is still in its nascent stage. The maximum potential of this threat-led approach hasn’t been explored yet. However, it is fast emerging as a powerful cybersecurity solution given the historical and commercial viability of intelligence practice.

Before moving any further, it is important to understand what cyber threat intelligence is. There are scores of definitions, opinions and understanding of threat intelligence available in books and the online world. 

In the simplest of forms, threat intelligence is the understanding of something that can help in making a decision. In the context of cybersecurity, cyber threat intelligence can be defined as the process of collecting, processing and analysing threats in the online world to take actionable threat intelligence measures. 

CTI encourages security professionals to understand the threat actor’s motivation and capabilities along with tactics, procedures and techniques. This helps in anticipating possible threats and to develop mitigation mechanisms accordingly. Plus, it can play an important role in the investigation, reaction and incident response process in the event of a breach.

 Who Needs Cyber Threat Intelligence

Cyber Threat Intelligence as a standalone service cannot contribute to cybersecurity. Businesses with a strong cybersecurity posture can get high value from CTI. Also, it is important to note that cybersecurity teams need to have an agile team who can take the CTI information and put it to good use without wasting time. 

For example, if the security programs are such developed that security teams need approvals from leaders to act on the CTI report, it might not be helpful or valuable in the end. 

Businesses with an interest in the following use cases should opt for cyber threat intelligence:

• Validation of Events
• Automated Response
• Risk Management with the help of Contextual Content
• Prioritization of Vulnerabilities
• Threat Hunting
• Containing and Remediating Attacks
• Anti-phishing

 Threat Intelligence Cycle

The threat intelligence cycle is the process in which the data is identified, collected, processed and converted into valuable intelligence to be used by security teams. Although this model is integral to military intelligence, the principles are relevant for cybersecurity intelligence too. Find more about the cycle below.

• Direction

Direction is the first phase of the threat intelligence cycle. It is used to develop strategies and directions of CTI functions according to the needs and requirements of the customer, referred to as Intelligent Requirements (IRs). Thus, it involves interaction between the developer and the consumer. Based on IRs the type of data required and the action plan on how it can be collected are established. 

• Collection

The second phase of the intelligence cycle is the collection, which mainly deals with the types, resources and mechanisms to collect required data that meets customer requirements. In this phase, CTI professionals assess the most reliable and helpful sources likely to provide valuable data. In addition, the resources which can give timely data are searched and identified. 

• Processing

In the third phase of the intelligence cycle, the raw data collected is collated, matched with other possible sources and processed as intelligence. Men and machines need to supply the demands of the IRs and at the same time adhere to intelligence principles. 

• Analysis

The analysis phase will see the analysts applying a wide range of techniques and using tools at their disposal to ascertain the credibility, value and usefulness of the intelligence data gathered. This phase makes sure that data is accurate and unbiased and actionable intelligence is finally created. 

• Dissemination

The last phase dissemination ensures the conveyance or delivery of completed intelligence data to the customer in relevant formats. The intervals at which intelligence data is disseminated can vary depending on the objectives and IRs such as operations and strategy. The intelligence cycle can restart once new IRs are required. 

To make sure that CTI functions are adding value to the customer or an organisation, continuous assessment and examination of the intelligence data delivered are necessary. This can be achieved by setting deliverable metrics, Key Performance Indicators (KPIs) and suggesting changes in the manner in which threat intelligence is used. 

Cyber Threat Intelligence Sources

Cyber threat intelligence suppliers need to tap into different sources to provide a comprehensive understanding of the threats and challenges organisations face. Some of the common sources used are discussed.

• Deep Web and Dark Web

Member-only hacking groups and forums running on the deep web provide great insights into the latest happenings in the cybercrime world. Tools, technology, services and innovations can be identified and intelligence can be shared accordingly. 

The dark web is another source to identify and find if any personal data, login credentials and intellectual property is hacked and leaked online for monetary gains. 

• Social Media Channels and Messaging Platforms

Social media channels can be used by cybercriminals to attack potential targets. This is prevalent at locations where the chances of arrest are less. Social media can help suppliers of CTI to find data leaks and give evidence of the intent to target specific users. 

Messaging platforms are now being used by cybercriminals to directly engage with potential customers and sell their products and services. Some also spill the beans about impending cyber attack operations and other insights which can prove to be valuable CTI for organisations. 

• Human Intelligence

Human intelligence works when CTI suppliers directly interact and engage with individuals using the above-discussed sources. Experts, however, always advise professionals to work under a well-defined framework and pursue intelligence gathering using legal and ethical means. In addition, all the information-gathering processes from human intelligence and social media shouldn’t break rules as laid down under GDPR.

• Malware Analysis

Analysis of the latest malware can help in understanding the indicators of compromise such as domain names and IP addresses, latest techniques, tactics and motivations of the threat actor. The information can be further analysed and processed to develop intelligence that can help security professionals.

• Other Sources

Several other possible sources that can be explored include the latest geo-political developments, code repositories, paste sites, and information-sharing platforms available in different countries like Asia, the UK and the US. Many governments also provide sufficient data regarding certain sectors and projects.

Instead of depending on any one of the above-discussed sources, cyber threat intelligence suppliers utilize all these sources to gather, corroborate and develop effective information as per customer’s IRs. The best practice is to assess and attest the information from at least two reliable sources. 

Opting for cyber threat intelligence services is a great investment for organisations worldwide. It can provide huge value to existing cybersecurity programs. 

Organisations and Cyber Threat Intelligence

Organisations can use cyber threat intelligence for the following:

• Predicting cyber threat possibilities and taking advanced measures to counter and combat them
• Preventing cyber attack incidents from disrupting organisations in the first place
• Detecting already existing threats within a network or system and hunting them 
• Responding to cyber threats or breaches in an effective manner and reducing the impact 

Partnering with third-party professionals for cyber threat intelligence is an effective way to strengthen the security initiatives of the organisation.