This is an update from a thread that became a post last year.
Threat intelligence seems, at least to me, to get maligned too much. For many years I’ve found it an immensely useful element of an enterprise security and risk program. So, some perspectives on this. Security is a game to win, not a state you’re in. You have adversaries and you have to therefore understand their motivations and their tactics, techniques and procedures (TTPs) in the context of their goals versus your assets and objectives. To understand that you, surely, need some information about that. Let’s call that threat intelligence. At the risk of oversimplifying, there are essentially 2 types of threat intelligence:
Macro threat intelligence. Information on attacker goals, capabilities & evolving TTPs. Use this to adjust defenses to make life more difficult for the adversary & shape their economics (attackers have bosses & budgets too). Aim to eliminate whole classes of attacks. For macro you need to feed it into your risk decision making process as fast as possible & increase the speed of adjusting defenses.
Micro threat intelligence. Information about specific attacks, signatures, indicators of compromise and other selectors/data. Aim to eliminate or detect/respond to specific attacks. Information about threats, itself, is necessary but not sufficient. In both cases you need to be capable of doing something with it. For micro threat intelligence you need to feed this into your defensive operations as fast as possible - in as fully an automated way as you can. Work to improve the ingest speed and coverage of this into your preventive controls and your detective sensor grid.
Responding to macro has superior results, but is harder and so sometimes you can only handle and respond to micro. As with any intelligence process you will generate new/synthesized intelligence - feeding that into an appropriate information sharing organization is useful.
I think threat intelligence gets maligned due to a lack of an organization’s capability to process it (perhaps fueled by over marketing of what it can do - by vendors or pundits). If you buy something or consume some capability you have to be equipped to use it. There’s no point buying some feed if you can't do anything with it. Like supply & demand - different sources of intelligence (shared/private/government) drives different demand pull, and handling capabilities (people, automation, frameworks) drive different supply needs.
Many critical infrastructure organizations (energy, telecommunications, health, finance, defense etc.) need to or are obliged to partner with domestic government agencies to mutually share timely threat intelligence (macro and micro). The challenge with such public/private partnerships from what I've observed around the world are that they are often artisanal and relationship driven - and so are brittle and don't scale. This is despite the best efforts of many dedicated professionals on all sides of this. There is, however, a lot of progress happening behind the scenes to make this industrialized and impersonal. Specifically to make intelligence sharing systematized and to create a concept of operations to ensure those processes continue and survive changes of key personnel on the private and public side. Some of this steady progress has been epitomized by organizations like the FS-ARC in finance, an outcrop of the widely admired FS-ISAC.
Bottom line : threat intelligence is critical but you have to use it well and that means having the organizational capability to do that. Grow capability (tooling and people) in balance with what you need to consume - think supply/demand.
Move fast.