Actionable Threat Intelligence: What Is It?

In recent months, much has been written about the acceleration of digital transformation initiatives as security teams took swift action to enable business operations and support a remote workforce in light of the COVID-19 pandemic. With this shift toward the new digital-first world, the volume of new and emerging threats has increased as adversaries become more opportunistic in their attempts to exploit and attack organizations’ critical digital assets. This creates the need for actionable threat intelligence.

What is Actionable Threat Intelligence?

To combat this, security teams must take steps to not only continuously monitor and identify potential threat data across their organizations’ digital attack surface, but also utilize real-time contextual analysis and automation to prioritize threats, along with remediation actions. Through various processes of distillation and personalization, raw data becomes actionable threat intelligence, and acts as a critical component for security teams to leverage in order to mitigate relevant risks and disrupt targeted malicious attack campaigns.  

Processing Raw Data into Actionable Intelligence

Before jumping into action to remove or disarm a potential threat, it’s important to consider the type of threat identified, its potential impact, and why it is identified in the first place.

The first step is to gather raw threat data, or the nonuniform, unevaluated data that may be considered as an indicator of compromise (IOC), a vulnerability, or present an immediate potential risk to the organization. This data is collected from a variety of sources (both internal and external) such as social networks, covert chat feeds, incident responses, network event logs, paste sites, domains, email server breaches, the dark web, and others.

What makes threat data into “actionable intelligence” is contingent on information security teams’ ability to quickly process and analyze it; cutting through the noise to identify relevancy and apply context to otherwise nascent information. This entire process is demonstrated in the graphic below.

The Need for Actionable Threat Intelligence

According to Forrester’s blog, “Understanding The Evolving DRP Market,” April 2019, 64% of organizations rate improving advanced threat intelligence capabilities as a high or critical priority. However, despite correctly identifying the need to fill an intelligence gap, many organizations run into challenges when planning or deploying their initiatives.

For starters, many CISOs are simply not prepared to work with the raw, unstructured threat data they may be receiving in their threat feeds. Due to the emerging nature of the market, there are often incompatibilities among threat intelligence solution offerings, leaving many SOC teams ill-equipped to work with the data they’re receiving. As a result, many teams find themselves spending excessive amounts of time and resources monitoring multiple threat feeds, and analyzing only partially-relevant data without the needed context and automation available to quickly take action when necessary.

In order to extend the value of their threat intelligence, organizations should consider implementing a more comprehensive Digital Risk Protection (DRP) solution. This better enables the effectiveness of security teams by automatically transforming raw threat intelligence data via contextual analysis into actionable intelligence that triggers an immediate action (such as performing a takedown of an impersonating social media account).

Integrate Humans and Automation to Build Intelligence

In addition to building out the core functions of a threat intelligence team, it’s recommended that security teams rely heavily on the in-depth analysis of managed services and the process efficiency of advanced AI/ML-based automation. This will help to enrich the data they’re bringing in as well as extract deeper context and meaning. By combining both human-based analysis and machine-driven automation, organizations can quickly scale their global security operations at less cost.

For example, let’s hypothesize that there has been a string of recent phishing attacks targeting financial service organizations as reported by a notable banking organization’s global threat research team (such as the ZeroFox Alpha Team). Taking proactive measures, the SOC of the organization configures its threat intelligence automation to curate and contextualize threat data that may indicate a phishing attack.

By using a machine learning model built to automatically detect malicious intent, the security teams are immediately alerted of any impersonating domains targeting their organization. After taking action to blacklist threat actor sites, the threat data is subsequently fed back to the research team for postmortem reporting and analysis.

Key Benefits of Actionable Threat Intelligence

As threat actors become more sophisticated and deviate from tactical norms, utilizing an actionable threat intelligence solution is critical for protecting organizations from new and unique attacks. The use case for implementing such a solution is clear, however many security teams find calculating an ROI to be a challenge. Here are a few ways that actionable threat intelligence proves value to the organization.

Delivers Enhanced Visibility and Context for Unique Attacks – Teams get more oversight and information so they can act quickly to dismantle an adversary’s attack infrastructure before it grows. 

Frees Up Precious Time and Resources – Since much of the legwork of gathering, processing, and contextualizing data is automated, organizations can maximize the efficiency of their security workforce at scale.

Integrates With Existing Tech Stack - Actionable threat intelligence fits seamlessly within the structure of organizations’ existing security technology stacks (TIP, SIEM, SOAR, etc.) via robust API integrations.

Provides Clear Path to Remediation - Actionable threat intelligence provides a clear path to remediation by offering security teams simple and efficient processes to immediately counteract threats, take down impersonating accounts and malicious domains, and notify incident response teams of urgent IOCs.

Conclusion

While we are rushing headlong into a digital-first world, the looming threat of emerging cyberattacks and malicious activity is always top of mind for organizations. Making optimal use of threat intelligence is the key to fighting back against adversarial threat actors, but intelligence without action is only fighting half the battle.

Learn more about how Digital Risk Protection makes threat intelligence actionable in our webinar, “The First Cyber Intelligence Capability You Should Invest In.”