KNOWLEDGE IS POWER

THREAT INTELLIGENCE HAS INCREASINGLY GAINED POPULARITY AS THREAT PREDICTION AND PROACTIVE CYBER DEFENCES HAVE PROVEN EFFECTIVE IN MITIGATING CYBER-ATTACKS. THREATQUOTIENT SENIOR VICE PRESIDENT OF STRATEGY JONATHAN COUCH DISCUSSES HOW ENTERPRISES CAN PULL STRATEGIC VALUE FROM THREAT INTELLIGENCE.

Give a brief overview of ThreatQuotient’s operations.

ThreatQuotient provides a security operations platform which enables collaboration and efficiency to security teams by connecting people, process, and technology and focusing on the threats to your organisation.

How is threat intelligence developed? How can organisations translate this data into actionable defence against cyber-attacks?

Threat Intelligence has moved into the commercial world from governments and militaries over the past 15 or so years. It is typically developed by collecting information on what the bad guys (often called ‘adversaries’) are doing and then sending that information to organisations that may be affected by those attacks. Intelligence follows a lifecycle and the differences in intelligence are typically due to variations in the lifecycle.

A simplified threat intelligence lifecycle entails collection, analysis, and dissemination. Collection can occur in underground forums, monitoring of botnets and adversary infrastructure, from victims of attacks, from social media, or your internal security sensors. Meanwhile, analysis is the process of validating and verifying a threat and adding context to the technical information (e.g. Is it cybercrime or espionage or hacktivism? Is it ransomware or an exploit kit?). Finally, dissemination is how that information or intelligence is delivered to a consumer whether it is via a published report, machine-to-machine API, web portal, email and so on. Dissemination is the format, frequency, and content of the information. Without going through this lifecycle, it is just data/information, not ‘intelligence.’