To wrap up our series on Building a Threat Intelligence Program (Introduction; Gathering TI; Using TI), we need to jump back to the beginning for a bit. How do you define success of the program? More importantly, how can you kickstart the program with a fairly high-profile success to show the value of integrating external data into your defenses, and improve your security posture? That involves getting a quick win and then publicizing it.

Quick Win

The lowest-hanging fruit in threat intel is using it to find an adversary already in your environment who you didn’t know about. Of course it would be better if you didn’t have an active adversary within your defenses, but that is frankly an unlikely scenario. The reality is that some devices in your environment are already compromised – it’s a question of whether you know about them.

You are already doing security monitoring (you can thank compliance for that), so it’s just a matter of searching your existing repository of security data for indicators from your threat feeds. Any log aggregation or SIEM platform will perform a search like this. Of course it’s a manual process, and that’s fine for right now – you’re just looking for a quick win.

Once you complete the search one of two things happens. Perhaps you found an active adversary you didn’t know about. You can drop the proverbial mic at this point – you have proven the value of external threat intel clearly. But before you spend a lot of time congratulating yourself, you have an incident response to get moving. Obviously you’ll document it, and be able to tell a compelling story of how TI was instrumental in identifying the attack earlier than you would have discovered it otherwise.

If you don’t find a smoking gun you’ll need to be a little more creative. We suggest loading up a list of known bad IP addresses into your egress firewall and looking for the inevitable traffic to those sites, which may indicate C&C nodes or other malicious activity. The value isn’t as pronounced as finding an active adversary, but it illustrates your new ability to find malicious traffic sooner using a TI feed.

Keep in mind that the Quick Win is just that. It’s shows short-term value for an investment in threat intel. This can (and should) take place within any proof of concept you run with TI vendors during procurement. If you aren’t getting immediate value, either you are using the wrong data source and/or tool, or you already had a strong security posture and will likely get better short-term value from another project.

Sustained Success

We didn’t call this series “Getting a Quick Win with TI”, so we need to expand our aperture a bit and focus on turning the quick win into sustainable success. Of course you accomplish this by examining your process from a process-centric perspective. There are three main aspects of building out the program from the success of a quick win:

1. Operationalizing TI: We covered this in depth in our last post on Using TI. We suggest starting by integrating the TI into your security monitoring environment. Once that is operational you can add additional use cases, such as integrating into your perimeter gateways and egress filters for proactive blocking, as well as leveraging the data within your incident response process.
2. Evaluating TI Sources: This is a key aspect of optimizing your program. You cannot just assume the data source(s) you selected now will provide the same impact over time. Things change, including adversaries and TI providers. You are under constant scrutiny for how your security program is performing, so your TI vendors (actually all your vendors) will be under similar scrutiny. You should be able to close the loop by tracking TI, to alerts, to blocked or identified attacks, by instrumenting your security environment to track this data. Some commercial TI platforms offer this information directly, but alternately you could build it into your SIEM or other controls.
3. Selling the Value: Senior executives, including your CIO, have a lot of things to deal with every day. You cannot count on them remembering much beyond the latest fire to appear in the inbox today. So you need to systematically produce reports that show the value of TI. This should be straightforward, usings your instrumentation for evaluating TI sources. This is another topic to cover in your periodic meetings with senior management. Especially when the renewal is coming up and you need to keep the funding.

Executing on a successful security program requires significant planning and consistent execution. You cannot afford to focus only on the latest attack or incident (although you also need to do some of that), but must also also think and act strategically; here a programmatic approach offers huge dividends. If you really want to magnify your impact, you’ll need to move beyond tactical day-to-day security battles, and implement a program for both TI and security activities in general.

Sharing

The success of threat intelligence hinges upon organizations sharing information about adversaries and tactics, so everyone can benefit from surviving attacks. For years this information sharing seemed like an unnatural act to enterprises. A number of threat intelligence vendors emerged to fill the gap, gathering data from a variety of open and proprietary sources. But we see a gradual growth in willingness of organizations to share information with other organizations of similar size or within an industry. Of course threat information can be sensitive, so sharing with care and diligence are critical aspects of a threat intelligence program.

The first decision point for sharing is to define the constituency to share information with. This can be a variety of organizations, including:

1. ISAC: Many the larger industries are standing up their own Information Sharing and Analysis Centers (ISAC), either as part of an industry association or funded by the larger companies in the industry. These ISACs are objective and exist to provide a safe place to collect and share industry threat information, and also offer value-added data analysis. If there is an ISAC for your industry, we recommend you participate.
2. Commercial vendors: We increasingly see vendors of threat detection products and services asking customers to share information about what they see, which makes their service more accurate and appealing. This is usually opt-in (though you should ask if it is not specifically mentioned) and we see very little risk in sharing data with vendors. Not because we actually enjoy the idea of a vendor monetizing your data without compensation, but it helps make their product or service better, and you benefit from others doing the same.
3. Trading partners: If your industry doesn’t have a formal ISAC, or you cannot afford to participate, you will likely need some kind of semi-formal means of sharing information. This can be challenging due to both the technology platform requirements (threat information must be shared securely) and legal agreements required to establish a sharing partnership (lawyers are fun!). That doesn’t mean you won’t do it, but understand that it’s not easy and requires a 1:1 set of agreements between all your trading partners.
4. Informal contacts: (water cooler TI) Many security practitioners share information informally with friends and colleagues. If you are plugged into your local community, you probably send a note to a buddy when you find something interesting and vice-versa. It’s a bit like hanging out at the water cooler and sharing indicators with your pals. As long as there isn’t anything proprietary or possibly damaging to your organization, sharing with these contacts can provide excellent value on both sides. But this requires a lot more manual processing because you don’t get a machine-readable feed. Unless your pals talk STIX and TAXXI, and yes, that was a TI joke.

Sharing Securely

Once you figure out who you will share threat intelligence with, you need to figure out how you’ll do it securely. Each of the various types of TI can be useful when shared, so there are plenty of data types in play. You will likely want some kind of platform you can use to aggregate threat intel and provide secure access. Perhaps it will be handled through a secure web service that ensures only authorized partners have access. Or you might be able to host a subset of your threat intelligence where a trading partner can access it directly from your TI platform.

Either way there are a couple key aspects to this kind of sharing, and below are a few questions to answer before embarking on a sharing initiative. Yes, they do read like Security 101.

1. Authentication: Who will access the system? How will you manage entitlements? Is this something you need to use your existing identity and access management systems to provide? Will you require multi-factor authentication? What about machine to machine sharing, via APIs and/or standard protocols? What is the process to deprovision a trading partner and remove access?
2. Authorization: What types of data/TI sources can each partner access? How will you manage entitlements, including new partners and changes in authorization?
3. Data protection: How is your data anonymized and/or protected? Is it encrypted so unauthenticated or unauthorized users cannot access it?
4. Logging activity: How will you keep track of which partner looked at what information? You want to be able to track which partners contributed content to make sure you have some balance – especially in an informal situation.

As you see, sharing information securely between trading partners can be complicated, so make sure you ask the right questions before starting to share information. As with the rest of developing a TI program, it is critical to develop feedback loops and a mechanism for evaluating the value of the sharing partnerships. You should have objective criteria for deciding whether sharing threat intelligence makes sense for your organization over time, regardless of whether you are paying for it or not.

And with that we wrap up our Building a Threat Intelligence Program blog series. If you have comments or believe we missed something, please let us know in the comments below or via social media (@securosis on Twitter).