Kerri Shafer-Page, VP Digital Forensics at Arctic Wolf, explains how organisations can turn the sheer volume of threat intelligence data into meaningful, actionable insights to better defend against cyberattacks.
Threat intelligence data is critical to the early detection of, and defence against, cyberattacks. Yet, although it is a fundamental aspect of cybersecurity, the sheer volume of information the data provides can lead to alert fatigue and make it difficult for organisations to identify and thwart legitimate threats targeting their infrastructure.
However, there are ways to overcome these challenges. By automating patch management, implementing continuous network monitoring and utilising third parties for advanced cybersecurity like managed detection and response (MDR) and endpoint detection and response (EDR), organisations will be better placed to translate threat intelligence data into actionable insights.
The changing cyber landscape
It’s clear that the tactics, techniques, and procedures used by cybercriminals are evolving at a rapid rate – largely thanks to the emergence and implementation of technologies like AI. Against this backdrop, effective cybersecurity depends on real-time intelligence. Resources like threat reports, which are compiled based on threat, malware, digital forensics and incident response data, are indispensable in keeping up with the shifting cyber landscape.
Arctic Wolf’s most recent threat report, for example, revealed 96% of ransomware attacks now also include data theft. This enables attackers to double-extort victims who have to pay to achieve data suppression, recovering their data so it is not disclosed publicly. It also found that business email compromise is becoming more sophisticated due to advanced social engineering techniques and known vulnerabilities are going unpatched, providing easy gateways for cybercriminals to exploit. By understanding how these attacks are carried out, and which group is most likely to use it, puts organisations in a stronger position to repel attackers going forward.
The role threat intelligence can play
Threat intelligence is based on darknet analysis, indicators of compromise (IOCs) such as malicious IPs, security operations centre (SOC) findings, information on cybercriminals’ attack patterns and general threat trends. The data allows cyber defence teams to detect and respond to threats in their own environments, as well as prioritise and implement proactive security measures. Without it, it would be difficult for organisations to understand how tactics, groups and attack types are changing and what security measures are required.
While the vast amount of intelligence poses a challenge for IT teams to discern what is relevant and useful for their organisation’s cybersecurity, it is vital to effectively defend against attacks. This is where real-time monitoring, proactive and autonomous defence solutions and curated reporting can bridge the gap between vast threat intelligence and actionable insights.
Putting this into practice
Combining visibility and monitoring is critical when it comes to cybersecurity. Unfortunately, even if enterprises have good intelligence on what may affect them, many lack insight into their own environments. To address this, organisations need to establish an accurate inventory of all assets, and implement 24×7 monitoring for logs, endpoints, and user behaviour to detect deviations from normal activity. AI is a key tool in this fight as it can help security teams process large amounts of data and detect anomalies quickly and suggest a course of action to remedy the situation.
Beyond this, there are also several key steps security teams should take to protect their digital environments. Automated patch management, for instance, integrates with vulnerability scanning tools and intelligence databases to continuously monitor known vulnerabilities. Every unpatched system is an open door for attackers, yet many organisations are reluctant to apply patches promptly – whether due to a lack of clear processes or staff shortages. Even organisations which do patch vulnerabilities often don’t track it properly.
For smaller security teams it is a challenge to simply analyse and manage the mass of information efficiently. External security partners can help relieve the burden on already overly-stretched IT teams. Third parties can help support in identifying and prioritising security gaps according to urgency, supply relevant information instead of an overwhelming volume of data and give real-time updates on critical threats. Another advantage of working with external partners is their broad access to data. They analyse trends across numerous organisations and can therefore derive more precise, practical recommendations.
Putting better processes in place for effective vulnerability management after receiving threat intelligence, such as continuous network monitoring, automated patch processes and working with independent experts is essential to minimising the risk of successful attacks.
Threat intelligence must be curated
Threat intelligence is essential, but without structured analysis, clear processes, internal visibility, and guidance, valuable information can go unused and wasted. By implementing the right structure organisations can move from being overwhelmed with unnecessary data to proactively protecting themselves from threats.
