How to Implement an Effective Threat Intelligence Program

Implementing an effective threat intelligence program is a topic that keeps CISOs up at night. There's so much content regarding this subject that it is extremely hard to separate the wheat from the chaff. So instead of “X tips to implementing an effective threat intelligence program”, we’d like to propose a different way of looking at threat intelligence, risk, and the steps needed towards a great program.

Requirements: knowledge, awareness, and time

Implementing and maintaining an effective TI program won’t happen overnight: It takes careful planning and preparation as well as significant investment and support from executive leadership in order for it to be truly effective in the long run. By being aware of the key pitfalls and embracing best practices, organizations can maximize their success in achieving not only their cybersecurity goals, but also their business objectives.

The risk of not doing it is greater

Here’s some of the common challenges organizations are facing today:

• Cybercrime will continue to increase in sophistication, volume, AND impact
• Threats are a critical national security problem for EVERY country
• Our rapidly growing digital footprint means greater attack surface, hence greater risk
• There’s a global workforce gap - not enough working hands (or brains for that matter)
• SOC is overwhelmed, especially with alert fatigue due to an overwhelming amount of data

5 core recommendations

So, cyber risk is growing bigger and faster than us humans can manually handle. The time required to reduce risk is more critical than ever. Here’s 5 Key recommendations on how to implement an effective CTI program - brought to you by some of the top experts and thought leaders in cybersecurity:

1. Prioritize your specific use cases first and foremost; account for variable change over time

A gaming company faces different challenges than a telecommunication company. The former might be struggling with piracy, cheating, cracking, DDoS and more, while the latter can potentially face privacy attacks, leaked credentials, insider threats, and ransomware. Every industry is different, every company is different. First understand what lies on the deep and dark web and how it might impact your organization. Then prioritize your specific use cases first, use it as a guide but account for variable change over time.

2. Select vendors and solutions that contextualize CTI for your specific business priorities

“I'm sorry” and “my bad” can mean the same thing - unless you're at a funeral. This is by far the best (and funniest) example that illustrates the importance of context. Select vendors and/or solutions that can contextualize threat intelligence for your specific business priorities. This will make your vendor qualification process infinitely easier, faster, and effective.

3. A CTI program must be authoritative, actionable and applicable

Check your totemEven though you’re (probably) not in Christopher Nolan’s movie masterpiece “Inception”, always take a reality check. Avoid pseudo-scientific promises, stay away from buzzwords. Ask yourself if or how the solution/vendor/process answers your use-cases and priorities. If you can’t explain this to yourself - walk away and start fresh. A CTI program must be authoritative, actionable, and applicable.

4. Embed a policy-driven approach to security that's automated to start.

This includes playbooks in security analytics, SIEM, SOAR, and TIPS. Never send a human to do a computer’s job - and vice versaAutomate what can be automated, free your people to focus on what’s not. An automation-centric approach to security can liberate a human’s time to focus on the important stuff. This includes, but is not limited to, playbooks in Security Analytics, SIEM, SOAR, and TIPs. It’s especially true in intelligence collection and vulnerability assessment.

5. Continuously improve.

CTI is a process and not an event. The power of tiny gains“Aggregation of marginal gains” is a concept that enabled its creator, cycling coach Dave Brailsford, to lead the British cycling team to 10 gold medals at the 2008 Beijing Olympics after a long past of shockingly underwhelming performance. Brailsford believed by focusing on a 1% margin for improvement in every aspect of cycling, the team could achieve greatness. He and his team focused on improving every aspect of performance - and these aggregations totaled 10 gold medals.

This story is depicted in detail in the book “Atomic Habits” by James Clear (if you haven’t read it, you definitely should) illustrated above. Being more effective is a process and not a destination. Or as best said by Depeche Mode in the 1983 iconic song - “everything counts in large amounts”.

So to recap, know what you’re using TI for and why, seek context, stay true to your priorities, and leverage automation as much as you can. And the most important thing - keep getting better even if by a small margin. Outperforming ourselves is a journey worth taking, and so does creating an effective threat intelligence program - only to perfect it even more over time.