top of page
  • Phil Venables

Threat Intelligence

Threat intelligence seems, at least to me, to get maligned too much. For many years I’ve found it an immensely useful element of an enterprise security and risk program. So, some perspectives on this. Security is a game to win, not a state you’re in. You have adversaries and you have to therefore understand their motivations and their tactics, techniques and procedures (TTPs) in the context of their goals versus your assets and objectives. To understand that you, surely, need some information about that. Let’s call that threat intelligence. At the risk of oversimplifying, there are essentially 2 types of threat intelligence:

  1. Macro threat intelligence. Information on attacker goals, capabilities & evolving TTPs. Use this to adjust defenses to make life more difficult for the adversary & shape their economics (attackers have bosses & budgets too). Aim to eliminate whole classes of attacks.

  2. Micro threat intelligence. Information about specific attacks, signatures, indicators of compromise and other selectors/data. Aim to eliminate or detect/respond to specific attacks. Information about threats, itself, is necessary but not sufficient. In both cases you need to be capable of doing something with it. For macro you need to feed it into your risk decision making process as fast as possible & increase the speed of adjusting defenses.

For micro threat intelligence you need to feed this into your defensive operations as fast as possible - in as fully an automated way as you can. Work to improve the ingest speed and coverage of this into your preventive controls and your detective sensor grid.

Responding to macro has superior results, but is harder and so sometimes you can only handle and respond to micro. As with any intelligence process you will generate new/synthesized intelligence - feeding that into an appropriate information sharing organization is useful.

Where threat intelligence gets maligned is I think due to a lack of an organization’s capability to process it (perhaps fueled by over marketing of what it can do - by vendors or pundits). If you buy something or consume some capability you have to be equipped to use it.

There’s no point buying some feed if you can't do anything with it. Like supply & demand - different sources of intel. (shared/private/government) drives different demand pull. Handling capabilities (people, automation, frameworks) drive different supply needs.

Bottom line : threat intelligence is critical but you have to use it well and that means having the organizational capability to do that. Grow capability (tooling and people) in balance with what you need to consume - think supply/demand.

Move fast.

170 views0 comments

Recent Posts

See All

Since the last post about leverage points in managing complex systems I thought it would be good to revisit and update a post from a few years ago looking at the seemingly accepted wisdom that complex

Security is an emergent property of the complex systems we inhabit. In other words, security isn’t a thing that you do, rather it's a property that emerges from a set of activities and sustained condi

Unless you’re doing continuous or quarterly budgeting, which some organizations do, then you’ll no doubt be getting ready for the long haul of the annual budget process to seek the resources you need

bottom of page