Making sense of cyber threat intelligence and its application

However, this tool is not a silver bullet against all cyber-attacks. 
So what exactly is cyber threat intelligence? Gartner defines it as “evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.” 
In essence, it refers to data with context that security professionals can utilise within their cyber security capability, to prevent, detect and recover from security incidents. This comes in the form of threat data and threat information. 
1. Threat data can come in the form of IP addresses, domain names, email addresses, etc. and because of its abundance, it is susceptible to false positives. 
2. Threat information comes in the form of reports, and describe specific campaigns or attacks and how malicious attack are carried out. This is done through developing an understanding of the adversary’s Tactics, Techniques and Procedures (TTPs). Threat information are less common than threat data.
Both threat intelligence data |and information need to be actionable in order for cyber threat intelligence to be effective as a solution or tool.
Effective cyber threat intelligence should fulfil the following qualities of completeness, accuracy, relativity (context) and timeliness. 
Completeness is the measure of information that cast additional light on an attack because most Open-source intelligence (OINST) would not have completeness. This is where a third party service provider would be able to help further enhance data for completeness;
Accuracy is the measure of the threat intelligence’s veracity. While accuracy may not be a component that many sources have, it can be fine-tuned with the frequent use of the intelligence; 
Relativity is the measure of whether intelligence collected is relevant to the organisation and its industry or sector. It is imperative that organisations are able to find a balance between deriving maximum visibility from a multitude of sources and achieving pin-point intelligence specific to the organisation’s geography, industry and risk profile;
Timeliness is the measure of how threat intelligence data and information remain current and valid. Most cyber-attack assets are short-lived especially once they have been discovered. By ensuring timely threat intelligence, the risk of false positives will significantly decrease during the detection process. 

To reiterate, cyber threat intelligence inserts an additional lens which helps organisations to achieve situational awareness regarding the current threat landscape, its trends and how it affects their business. With the availability of threat intelligence data in great abundance through threat exchanges and open-source intelligence, the chances of preventing an attack is much higher as an organisation if they can correlate the information to protect the organisation. 
Cyber intelligence can also help to detect on-going attacks, attempts to infiltrate the organisation based on indicators, and discover compromises that have happened in the past or are currently residing in the organisation. 
This is achieved as threat intelligence can be integrated into many services and products to collect the data for such purposes. 
A strong value proposition for cyber threat intelligence is how it |can be used to build out a threat landscape to depict emerging |trends in threats and cyber risks. This allows the organisation to make decisions around technology procurement to address the most urgent issues arising from the threat landscape. 
The future possibilities for cyber threat intelligence are being explored and one of those possibilities is how Red teams can use information to simulate an attack plan to assess the vulnerability of an organisation. 
Such an example can be applied for the likes of vulnerability assessments as part of an IT control audit, cyber war gaming or crisis simulations where the organisation’s crisis response teams undergo stress testing. 
However, it is key to note that cyber threat intelligence is only as good as the quality of data it receives. Thus, the collaboration to share threat intelligence is what will create a powerful tool. As organisations begin to overcome the stigma of information sharing, this will soon become a reality.

Contributed by PARICHART JIRAVACHARA, Partner, Risk Advisory, Deloitte