Share Blog Post
Cyber Threat Intelligence (CTI) History and Evolution
CTI has emerged as one of the most powerful predictive tools in the CISO's arsenal in recent times.
In physical warfare, too, threat intelligence has always been critical to effective strategy building. Countries and regions at war have relied on high-confidence intelligence to get ahead of the enemy and win battles since ancient times. One of the major reasons for countries to build and maintain alliances has been to exchange information with trusted allies to predict the adversary’s next move. The key to effective sharing, especially where national security is concerned, is trust. While accurate intelligence received from trusted partners can help countries win battles, false information can do the opposite, or worse. Additionally, countries have had to make significant investments in creating secure channels of communication that cannot be intercepted, to prevent the enemy from listening in.
Just as the nature of intelligence in physical warfare has undergone massive change over the course of history, threat intelligence in cybersecurity, too, has evolved over time. With the threat landscape changing rapidly and digital transformation propelling organizations into uncharted territory, security collaboration is set to become a much bigger part of cybersecurity programs.
Most cybersecurity technologies being used by security teams today fit into the prevent, detect or respond buckets. The value of actionable threat intelligence is well-understood by security leaders, but tools and collaboration platforms that enhance organizations’ collective intelligence and predictive capabilities are slow to emerge. Traditional threat intelligence platforms lack features and capabilities to enhance security collaboration among cross-functional teams and trusted external sharing communities. To fight organized, well-funded adversaries, organizations need to collaborate both internally - within and across teams, and externally - with trusted third parties and government agencies.
Threat Intelligence types and lifecycle
Cyber threat intelligence is aggregated, analyzed and enriched data about adversaries’ motivations, tactics, techniques, and capabilities, that help drive both short-term and long-term cybersecurity decisions. It is most commonly classified as strategic, tactical, operational, and technical intelligence based on the nature of the data and how it is used.
For a broader classification, CTI is also sometimes divided into macro intelligence, which caters to the needs of the human in the security ecosystem and comprises strategic and operational threat intelligence; and micro intelligence, which is machine-readable tactical and technical threat data that is continually fed into detection and response tools for real-time threat actioning.
The threat intelligence lifecycle consists of all the steps involved in turning threat data into relevant, consumable intelligence that can be used by security teams for effective decision-making. It starts with establishing requirements, followed by data collection, processing, and analysis, and finally disseminating finished intel to both humans and machines for actioning.
Why is Security Collaboration Needed?
To successfully predict and mitigate cyber threats before they become business-disrupting events, security teams need to share threat intel and collaborate in real-time with (a) other teams in their organizations, and (b) external entities that are a part of trusted sharing networks.
Internal collaboration
One of the major obstacles to positive security outcomes today is the lack of effective collaboration between all the teams involved in preparing for, detecting, and responding to cyber threats in an organization. Different functional units within the security ecosystem often work in silos, leading to communication gaps, costly delays in threat detection, and slow, disjointed response processes.
An effective defense requires continuous, real-time intel sharing between security analysts, engineers, vulnerability management teams, incident responders, fraud management teams, and other stakeholders, so they all have a shared view of the organization’s attack surface, vulnerabilities, and ongoing events.
With real-time visibility into high-priority, contextual threat information and a platform for organization-wide collaboration on threat mitigation, organizations can stop known threats before they enter the enterprise environment, and detect and respond to unknown threats before they cause damage.
External collaboration
Security vulnerabilities in software and hardware systems are not tailor-made for individual organizations. They are found in products used across sectors, which means that all organizations, or at least a large number of them, are dealing with common threats at any given time. By collaborating with other organizations in their sectors, interest groups, and extended third-party ecosystems, organizations get access to a common knowledge base of threats, vulnerabilities, and mitigation methods.
Additionally, with the increase in systemic cyber risk and greater interdependencies between IT and operational technology (OT), organizations responsible for the maintenance of critical infrastructure and essential services cannot afford to operate in isolation. Individual organizations can save time and resources and put up a stronger defense against adversaries if they have a platform to collaborate with and learn from the collective experience, capabilities, and risk reduction strategies of trusted community members.
How to Collaborate
Internal or micro-level security collaboration
- Breaking barriers between siloed security teams: To enable effective security collaboration within an organization, security leaders need a platform for real-time intel sharing and seamless, secure communication between traditionally siloed teams and security practitioners like SOC teams, incident responders, threat intel teams, threat research units, and threat hunters.
- Standardizing workflows for unified operations: A vendor-agnostic orchestration module can enable security teams to build bidirectional integrations between existing IT, security, and DevOps tools and design workflows to standardize processes across cloud and on-prem environments. Playbooks to standardize workflows can also be used to automatically trigger detection, investigation, and response actions.
- Operationalizing threat intelligence: Organizations can significantly improve security outcomes like the mean time to detect, remediate, and respond by operationalizing threat intelligence at every level - prevention, detection, analysis, and response. A modern threat intelligence platform enables this by automating the threat intelligence lifecycle and leveraging orchestration for real-time actioning of high-confidence intel.
External or macro-level security collaboration
- Sector-specific security collaboration communities: Information Sharing and Analysis Centers (ISACs) are sector-specific threat intel sharing centers that collect and analyze information about threats, incidents, and vulnerabilities relevant to specific sectors and disseminate finished intel to member organizations. This can be done using a hub-and-spoke model where the central ISAC hub receives and processes threat information from external sources and all member organizations, and disseminates relevant, contextualized intel to all connected entities (member organizations).
- Cross-sectoral collaboration and intel sharing: Cross-sectoral security collaboration is enabled by ISAC-to-ISAC intelligence sharing where multiple industry-based communities and their members can share information about attack trends, cyber threats, and vulnerabilities in real-time. A collaboration platform that allows real-time alerting and secure information exchange between users can make this process easier and enhance all member organizations’ situational awareness.
- Sharing networks based on other affiliations and shared interests: Sharing networks and ISAC-style communities can also be built based on geography, supply chain ecosystems, job functions, shared interests, and a range of other common factors. For example, a large enterprise may want to build a sharing network with all its business units and subsidiaries across continents, or small and medium businesses within a certain city or region may want to come together to fight common threats. Organizations are also increasingly showing an interest in building sharing communities with supply chain partners for enhanced visibility and early detection of threats.
Benefits of Collaboration and Trusted Intel
?Benefits of Internal Collaboration
- Faster threat detection and response: Real-time cross-functional collaboration and a common view of active threats enables security teams to bring down detection, investigation, and response times significantly.
- Improved strategy decisions and resource allocation: Closer collaboration and a complete picture of organizational risk based on insights from across teams help business leaders and budget holders make better security-related strategy and resource allocation decisions.
- Improved predictive security capabilities: Intel sharing across teams enhances organizations’ understanding of the most serious risks to their environment and improves their predictive capabilities and proactive defense.
- More time to focus on longer-term objectives: Improved collaboration, streamlined workflows, and the smooth flow of threat information across teams leaves SecOps teams with more time to further fine-tune processes and better align the security program with the larger business mission.
Benefits of External Collaboration
- Shared knowledge to deal with common threats: Threat actors exploit vulnerabilities and security weaknesses in products and apps that are used across organizations and sectors to carry out attack campaigns. External collaboration helps individual organizations learn from the collective research, experience, and threat response strategies of other businesses that may be dealing with the same threats.
- Greater visibility into supply chain ecosystem: Real-time threat intel sharing with other entities in their supply-chain ecosystems can give organizations greater visibility into their extended attack surface and help them build more effective proactive defenses.
- Better protection against sector-specific threats: Threat actors often design campaigns to target specific sectors. With organizations in the same sector exchanging intel about threats and incidents in real-time, effective mitigation strategies developed by one organization can be replicated by others in the same sector without having to reinvent the wheel.
- Improved situational awareness and predictive security: External collaboration and intelligence sharing improve businesses’ situational awareness and help them understand the larger context around threats. This improves individual organizations’ predictive capabilities.
- Stronger defenses to protect critical infrastructure: Cross-sectoral intel sharing is essential for protecting critical infrastructure from state-sponsored and other well-funded attack campaigns. Organizations can build better defenses and reduce systemic cyber risk by drawing from the collective intelligence of a larger, trusted community.
- Support for small and medium enterprises: Small and medium businesses may lack the resources and security infrastructure needed for effective defense against sophisticated threats. By collaborating with other organizations in their industry sectors, regions, or third-party ecosystems, they can access a collective knowledge base of threat research and mitigation strategies to fight threats more effectively.
How Cyware’s Cyber Fusion solutions enable security collaboration
Cyware’s Cyber Fusion Center enables cross-functional collaboration between all the teams involved in threat prevention, detection, response, and remediation within an organization. Traditionally siloed teams and functions like the SOC team, engineers, incident responders, vulnerability management teams, and other stakeholders get a common operating picture of threats and vulnerabilities across the enterprise environment and can collaborate in real-time to mitigate and respond to threats quickly.
The Cyware Situational Awareness Platform (CSAP) is designed for real-time threat alert sharing for enterprises and trusted communities like ISACs and ISAOs. CSAP provides a secure communication platform for organizations across geographies and sectors to share strategic intelligence and collaborate on predictive security and threat mitigation.
The Cyware Threat Intelligence eXchange (CTIX) is an advanced threat intelligence platform (TIP) for automated ingestion, enrichment, and analysis of threat indicators (IOC) in a collaborative and bidirectional sharing ecosystem.
Avkash Kathiriya
Avkash is the SVP of Research and Innovation in Product at Cyware. He has 12+ years of experience in the information security domain, including SOC/CSIRT Management, Cyber Fusion, Red Team, Cyber Resilience, Threat Hunting, Threat Intelligence and research, Enterprise Security Architecture, and Cybersecurity Governance. Previously, he worked as Senior Manager of Information Security at HDFC Bank.
Tags
Posted on: July 20, 2022
Related Guides
More from Cyware
Stay updated on the security threat landscape and technology innovations at Cyware with our threat intelligence briefings and blogs.
The Virtual Cyber Fusion Suite
