Getting ahead of the attackers is the holy grail to security folks. A few years back some vendors sold their customers a bill of goods, claiming they could “get ahead of the threat.” That didn’t work out so well, and most of the world appreciates that security is a reactive situation. The realistic objective is to reduce the time it takes to react. We call this React Faster and Better. The foundation of the philosophy is an effective incident response process. But you can shrink the window of exploitation by leveraging cutting-edge research to help focus your efforts more effectively. You need an early warning system for perspective on what’s coming at you.

Pragmatic Intelligence

Back in 2007 when the Pragmatic CSO was written, prioritization was a key part of the operational methodology espoused as part of the P-CSO process. Over the past 5 years we have kept focus on the importance of prioritizing your limited funding, resources, and expertise, on the highest-value activities. To get a feel for how this concept works, let’s excerpt a small section from the Pragmatic CSO:

[A key operational discipline is] figuring out the most likely exposure and working to eliminate it. This is particularly hard because many CSOs run from emergency to emergency without ever getting a chance to manage their security environment or even spend 10 minutes thinking about what is next. Unfortunately, what’s next has already happened. Clearly this situation must be addressed.

“A good hockey player plays where the puck is. A great hockey player plays where the puck is going to be.” – Wayne Gretzky

The great ones, in whatever pursuit, figure out how to anticipate what is most likely to happen, so they are ready if it does. Some think it’s luck, others figure it’s a talent bestowed by a higher power. Actually, in most cases, it is the result of a tremendous amount of hard work. The ability to anticipate is especially critical in security because of the unlimited number of possible attacks across an infinite attack surface. You cannot cover all the bases, so you need to be focused and choose correctly. What is the best way to choose correctly? You need an “inside man” working on your behalf to figure out what the bad guys are working on.

Thus, security research plays a critical role in the life of a Pragmatic CSO. It’s hard to believe, but Pragmatic CSOs read a lot. They are plugged into the underground networks of researchers that spend time penetrating the hacker networks and tracking down the bot masters to figure out what they are working on. If you know what the bad guys are focused on, you can get a real good idea about what they are planning to strike next. Even though you don’t have to spend money to get connected with the research folks, a number of services focus on reporting new exploits and figuring out what is most likely to be attacked on any given day.

Of course context is everything, so although third party research may give you a clue to what the next exploit or botnet looks like, it cannot tell you how it will be used against your defenses. You need to provide that context, which requires looking at the situation from two different perspectives:

1. In Here: This is the internal perspective gleaned from what’s happening on your network. Whether the platform to aggregate and analyze the data is a SIEM or a Vulnerability Management platform or any other technology, the point is the same. The foundation for context is a clear understanding of what’s going on within your environment. Then you can move on to the next view for an idea of what’s exposed and what needs to be fixed right now.
2. Out There: The reverse perspective looks at the macro environment, understanding attacker tactics and exploits, and then figuring out how they will affect you. If you know about attacks you can preemptively implement protections. Obviously you need to walk before you run, so getting a handle on your internal security data is a necessary first step. But once you are there, factoring in the external view can really help narrow down your attack surface.

None of this is new. Law enforcement has been doing this, well, forever. The goal is to penetrate the adversary, learn their methods, and take action before an attack. Even in security there is a lot of precedent for this kind of approach. Back at TruSecure over a decade ago, the security program was based on performing external threat research, and using it to prioritize the controls to be implemented to address imminent attacks. Amazingly enough it worked. But this approach fell out of favor over the past 5-7 years as the entire industry got weighed down by the compliance albatross.

Now that the pendulum is swinging back toward actually securing stuff, we see a resurgence of threat intelligence as a way to make our defenses more effective and efficient. Let’s run through the history of security research, now typically called threat intelligence.

The Evolution of Threat Intelligence

Back in the day, security research really meant anti-virus research. The AV companies would look at viruses, build signatures, and move on to the next one. It was a fairly collegial environment, and AV companies shared the malware they discovered, making sure everyone was protected within a couple hours. The next wave of research resulted from the avalanche of spam, which required security companies to build global networks of honeypots to capture bad email directly, create signatures to identify it, and distribute the signatures to their gateways.

Of course, that lasted only until the spammers became more effective at evading signatures, which drove heavier reliance on behavioral indicators to infer which files were malware and which messages were spam. This required security vendors to spend time evaluating behavior and tuning their detection cocktails to maintain efficiency. At about this time, IP and file reputation started to be more widely used. An IP address that sends out spam is likely to continue sending spam and likely to launch other attacks, so give it a bad reputation score and block future messages from that IP.

Then we reached another inflection point, where attackers started using networks of compromised devices (botnets) to defeat reputation and evade detection. They made increasing use of polymorphic malware, making traditional signature-based detection largely useless. Attackers also got very sophisticated about masking communications between bots and their controllers.

So security research evolved as well, investigating all these techniques and data sources, aggregating and analyzing attackers, to get a better handle on the threat landscape. The main issue is that this research is proprietary and unavailable to most people. It is usually under the umbrella of a security product or service, and increasingly used by vendors as a competitive differentiator.

These days proprietary security research is table stakes for any security vendor, and the industry has gotten a lot better at publicizing their findings via researcher blogs and other media. Much more information is available than ever before, but what does this mean for you? How can you leverage the threat intelligence out there to provide that elusive “early warning system”?

So that’s what this series is all about. We will continue by defining a process for integrating threat intelligence into your security program, then dig into each aspect of that process. They include baselining your internal data sources, leveraging external threat feeds, doing the analysis to put all this information into the context of your business, and finally building a scenario so you can see how the early warning system works in practice.

Thanks to our friends at Lookingglass Cyber Solutions, who plan to license this research when it’s completed. As with all our research projects, we write for an end user community without corporate influence, using our Totally Transparent Research methodology.