top of page
  • Phil Venables

Threat Intelligence

Threat intelligence seems, at least to me, to get maligned too much. For many years I’ve found it an immensely useful element of an enterprise security and risk program. So, some perspectives on this. Security is a game to win, not a state you’re in. You have adversaries and you have to therefore understand their motivations and their tactics, techniques and procedures (TTPs) in the context of their goals versus your assets and objectives. To understand that you, surely, need some information about that. Let’s call that threat intelligence. At the risk of oversimplifying, there are essentially 2 types of threat intelligence:

  1. Macro threat intelligence. Information on attacker goals, capabilities & evolving TTPs. Use this to adjust defenses to make life more difficult for the adversary & shape their economics (attackers have bosses & budgets too). Aim to eliminate whole classes of attacks.

  2. Micro threat intelligence. Information about specific attacks, signatures, indicators of compromise and other selectors/data. Aim to eliminate or detect/respond to specific attacks. Information about threats, itself, is necessary but not sufficient. In both cases you need to be capable of doing something with it. For macro you need to feed it into your risk decision making process as fast as possible & increase the speed of adjusting defenses.

For micro threat intelligence you need to feed this into your defensive operations as fast as possible - in as fully an automated way as you can. Work to improve the ingest speed and coverage of this into your preventive controls and your detective sensor grid.

Responding to macro has superior results, but is harder and so sometimes you can only handle and respond to micro. As with any intelligence process you will generate new/synthesized intelligence - feeding that into an appropriate information sharing organization is useful.

Where threat intelligence gets maligned is I think due to a lack of an organization’s capability to process it (perhaps fueled by over marketing of what it can do - by vendors or pundits). If you buy something or consume some capability you have to be equipped to use it.

There’s no point buying some feed if you can't do anything with it. Like supply & demand - different sources of intel. (shared/private/government) drives different demand pull. Handling capabilities (people, automation, frameworks) drive different supply needs.

Bottom line : threat intelligence is critical but you have to use it well and that means having the organizational capability to do that. Grow capability (tooling and people) in balance with what you need to consume - think supply/demand.

Move fast.

189 views0 comments

Recent Posts

See All

A Letter from the Future

A few weeks ago The White House published our PCAST report on cyber-physical resilience. Thank you for all the positive reactions to this. There is already much work going on behind the scenes in publ

InfoSec Hard Problems

We still have plenty of open problems in information and cybersecurity (InfoSec). Many of these problems are what could easily be classed as “hard” problems by any measure. Despite progress, more rese

DevOps and Security

Each year, DevOps Research and Assessment (DORA) within Google Cloud publishes the excellent State of DevOps report. The 2023 report published in Q4 was as good as ever and in particular documented so


Commenting has been turned off.
bottom of page