Anthony Perridge, VP International at ThreatQuotient, describes how cyber threat intelligence is playing an ever more important part in organisational cyber defences.
In the battle to protect businesses from relentless attempts at infiltration, theft and disruption by cybercriminals, knowledge is power. Over recent years, this fact has been formalised through the growing adoption of cyber threat intelligence (CTI).
With the creation of teams and implementation of CTI programmes, organisations aim to build a proactive defence posture and stay one step ahead of adversaries. The 2020 SANS Cyber Threat Intelligence survey (sponsored by ThreatQuotient) analyses the state of play in cyber threat intelligence worldwide, indicates that we are entering an exciting period.
CTI shows strong signs of maturing and cementing its place in the cybersecurity arsenal. In the survey, 82% of survey respondents say their CTI activities are delivering value. We are also seeing organisations become more strategic about how they implement the intelligence process and a growing recognition of the value of collaboration with the wider threat intelligence community.
Cyber threat intelligence is coming of age
Interest in CTI is growing. There were twice as many respondents to this year’s survey compared to 2019 and more respondents than ever before reported that they are operating a CTI programme in their organisation. 85% overall said that they had some form of CTI resource, with nearly half (49.5%) having a formal, dedicated team. A further 27% have shared responsibility with staff drawn from other teams, while 9% have a solo CTI analyst. This is a welcome sign that CTI is accelerating as a component of companies' cybersecurity strategies.
Also encouraging is the fact that the percentage with a dedicated team has risen steadily in the past three years. Investment in headcount is on the rise, indicating that businesses are committing to CTI for the long term.
In-house teams are not going it alone. 61% of respondents said CTI tasks are handled by a combination of in-house and third party service provider teams, an increase of 54% in 2019. This combination of external resources and internal expertise means organisations can better understand and address the threats they face.
A strategic approach to cyber threat intelligence
Organisations are becoming more strategic about CTI. At the heart of an effective CTI programme are clearly defined intelligence requirements. These identify the specific questions and concerns to be addressed by the programme to ensure the right data is collected and the appropriate focus is placed on the relevant threat areas by analysts. They are critical in providing the business-specific context for CTI programmes so that they deliver the most valuable outcomes for that organisation.
So it is encouraging that this year’s survey found the percentage of respondents reporting that they have clearly defined intelligence requirements has jumped from 30% in 2019 to 44% in 2020. Another positive sign is the growth in the number of contributors to CTI requirements. There was more input from security operations teams, incident response teams and C-Suite executives, showing that a diverse group of stakeholders is helping to drive both the tactical and strategic direction of the CTI programme.
The next stage in maturity will be to see more regular and structured reviews of intelligence requirements, as most still review intelligence requirements on an ad hoc or unknown basis.
Intelligence, automation and management
The sphere of CTI is benefiting from integrated intelligence sources, automation and management advances - but there is more to be done still.
When it comes to collecting data to answer the intelligence requirements, there has been a jump in the percentage consulting both open source feeds and those from CTI-specific vendors. There has also been an increase in organisations producing threat intelligence data in-house to complement externally sourced data – more than 40% of organisations said they both produce and consume threat intelligence data.
Organisations have a wealth of data at their disposal. When processing high volumes of intelligence to gain actionable insight, automation can be used to lift the burden from CTI teams. However, the survey shows that automation is still some way off, with the majority of processing tasks completed either manually or semi-automated. While basic tasks such as data de-duping are commonly automated, more complex activities, such as reverse-engineering samples, are a manual undertaking for 48% of respondents.
In CTI management, the picture is slightly better with more organisations reporting automation in SIEM platforms and CTI management platforms. As CTI continues to prove its value, more automation becomes likely, as does the tuning of tools to fit the context, priorities and specific threats that businesses face. This will help analysts focus their efforts where human evaluation is most effective and respond more proactively to threats.
The challenge of measurement
Another sign that an approach is maturing is when focus shifts from operational considerations around what tools and teams can do, to measuring the effectiveness of their actions. Here the survey found that there is still some way to go. While a resounding 82% of respondents find value in CTI, only 4% had processes in place to measure effectiveness.
However, the growing rigour in identifying clear intelligence requirements can offer a good starting point here. Once these are set, goals can be set based on answering the intelligence requirements through the CTI programme.
Collaboration is critical
Perhaps the most encouraging finding from the SANS Cyber Threat Intelligence survey is confirmation that collaboration is being embraced as a core component of security programmes. 45% reported membership of an Information Sharing and Analysis Centre (ISAC) which is a high percentage, given that they are not available in all verticals or territories. The main benefits noted are timely and relevant threat information and the ability to network with contacts at other member organisations.
Now, more than ever, the uncertain cyber and physical environment and new threats emerging out of the disruption of COVID-19 pandemic mean that intelligence analysts need to share best practice data and strategies to overcome threats.
Ultimately, the 2020 SANS Cyber Threat Intelligence survey offers robust evidence that CTI is increasing in adoption and is proving its worth to a greater number of organisations than ever before. When threat intelligence is effectively collected, integrated, automated, prioritised and shared between analysts and wider stakeholders, organisations become more agile and effective at addressing the threats they face. We are in an exciting period for the industry, where organisations can see real, measurable impact from their accelerating investment in CTI teams and tools and we look forward to seeing further evidence of success in next year’s survey
Anthony Perridge (@adperridge) is VP International at cyber threat intelligence platform ThreatQuotient. He leads all aspects of international sales, business development and marketing. Prior to joining ThreatQuotient, Anthony was Sales Director for Cisco Security.
"A client of ours has asked to only see candidates with their own laptops". Ian Donnelly, Principal Consultant (Cyber Security) at Brightwater discusses onboarding of new starters and business continuity planning …