Kaspersky
Threat Intelligence

Evaluating
threatintelligencesources
Learn more on kaspersky.com#bringonthefutureIntroduction
With the expanding attack surface and the growing sophisticationof threats, just reacting to an incident is not enough. Increasingly
complex environments provide multiple opportunities for attackers.
Each industry and each organization has its own unique data
to protect, and uses its own set of applications, technologies, etc.
All this introduces an enormous number of variables into possible
methods of executing an attack, with new methods emerging daily.
Over the last couple of years, we have observed the blurringof boundaries between different types of threat and different
types of threat actors. Methods and tools that were previously
a threat to a limited number of organizations have spread to thebroader market. One example of this is the dumping of code by theShadow Brokers group, which put advanced exploits at the disposalof criminal groups that would not otherwise have had access to thatkind of sophisticated code. Another example is the emergenceof advanced persistent threat (APT) campaigns focused not
on cyberespionage, but on theft — stealing money to finance otheractivities that the APT group is involved in. And the list goes on.

A new approach is needed
Methods and tools that werepreviously a threat to a limited
number of organizations havespread to the broader market.

With enterprises increasingly falling victim to advanced andtargeted attacks, it’s clear that a successful defense requires new
methods. To protect themselves, businesses need to take a proactive
approach, constantly adapting their security controls to theever‑changing threat environment. The only way to keep up withthese changes is to build an effective threat intelligence program.
Threat intelligence has already become a key component of security
operations established by companies of varying sizes acrossall industries and geographies. Provided in human-readable andmachine-readable formats, threat intelligence can support security
teams with meaningful information throughout the incident
management cycle and inform strategic decision-making (Figure 1).
However, the growing demand for external threat intelligence has
given rise to an abundance of threat intelligence vendors, eachoffering a host of different services. An extensive and competitivemarket with innumerable, complex options can make choosing theright solution for your organization highly confusing and extremely
frustrating.

Operations& maintenance,
management

Lessons
learnedMonitoring& detection
IOCs
TTPs

IOCs

Vulnerability
management

Kaspersky
ThreatIntelligence

Priority

Vulnerability
assessment reports

Figure 1
Threat Intelligence-driven Security Operations

Statistics,
detects

Incident Response
ContextTrends, threat landscape, etc.
Incident statistics
and KPIs

ReportingThreat intelligence that isn’t tailored to the specifics of yourbusiness can exacerbate the situation. In many companies today,
security analysts spend more than half their time sorting out false
positives instead of proactive threat hunting and response, leading
to a significant increase in detection times. Feeding your security
operations with irrelevant or inaccurate intelligence will drive thenumber of false alerts even higher and have a serious, negative
impact on your response capabilities — and the overall securityof your company.

Where the best intelligence lives…
So how do you evaluate the numerous threat intelligence sources,
identify the ones that are most relevant to your organization, andeffectively operationalize them? How do you navigate through theenormous amounts of meaningless marketing with almost every
vendor claiming that its intelligence is the best?

These questions, although valid, are definitely not the first ones
that you should be asking. Attracted by flashy messages and lofty
promises, many organizations believe that an external vendor canprovide them with some kind of superpower x-ray vision, completely
overlooking the fact that the most valuable intelligence resides
within the perimeter of their own corporate networks…
Data from intrusion detection and prevention systems, firewalls,
application logs and logs from other security controls can reveal a lot
about what’s going on inside a company’s network. It can identify
patterns of malicious activity specific to the organization. It candifferentiate between a normal user and network behavior and help
to maintain a trail of data-access activity.

Internal data

External intelligence

Hybrid Cloud

NGFW

IoT

IPS / IDS

SIEM

OSINT

Commercial providersIndustry-led communities

Apps

CERTs

Private communities
Incident
Response

Figure 2
Operationalizing External Threat Intelligence

Think like an attacker
To build an effective threat intelligence program, companies,including those with established Security Operations Centers,
must think like an attacker, identifying and protecting the most
likely targets. Deriving real value from a threat intelligence program
requires a very clear understanding of what the key assets are, andwhat data sets and business processes are critical to accomplishing
the organization’s objectives. Identifying these ‘crown jewels’
allows companies to establish data collection points around themto further map the collected data with externally available threat
information. Considering the limited resources that information
security departments usually have, profiling an entire organization
is a massive undertaking. The solution is to take a risk-based
approach, focusing on the most susceptible targets first.
Once internal threat intelligence sources are defined andoperationalized, the company can start thinking about adding
external information into its existing workflows.

It’s a question of trust

External threat intelligence sources
vary in trust levels:

Open sources are available
for free, but they often lackcontext and return a significant
number of false positives

Commercial threat intelligencesources are much more reliable,
although buying accessto them can be expensive

A good option to start withis accessing industry‑specificintelligence-sharing
communities, such as the
Financial Services Information
Sharing and Analysis Center(FS-ISAC). These communities
provide extremely valuable
information, although they areoften gated and membershipis required to gain access

The guiding principle for choosing external threat intelligencesources should be quality over quantity. Some organizations
may think that the more threat intelligence sources they canintegrate, the better visibility they will get. This may be true in someinstances — for example, when it comes to highly trusted sources,
including commercial ones, providing threat intelligence tailoredto the organization’s specific threat profile. Otherwise, there
is a significant risk of overwhelming your security operations withirrelevant information.
The overlap in information supplied by specialized threat intelligence
vendors can be very small. Because their intelligence sources andcollection methods vary, the insights they provide will be uniquein some aspects. For example, one vendor, due to being a majorpresence in a specific region, provides more details about threatsemanating from that region, while another provides more details on
specific types of threat. So gaining access to both sources may bebeneficial — when used together, they may help to reveal a bigger
picture and guide more effective threat hunting and incident
response missions. Bear in mind, though, that these kinds of trusted
sources also require careful prior evaluation to ensure that thesupplied intelligence is appropriate for your organization’s specificneeds and use cases, like security operations, incident response, riskmanagement, vulnerability management, red teaming, etc.

Issues to consider when evaluating
commercial threat intelligenceofferings
There are still no common criteria for evaluating
various commercial threat intelligence offerings,
but here are some things to bear in mind when
doing so:It’s assumed that yourcompany already hassome security controls
in place, with the associatedprocesses defined, and thatit’s important for you to use
threat intelligence with thetools you already use and know.
So look for delivery methods,integration mechanisms
and formats that support
smooth integration of threat
intelligence into your existing
security operations

Look for intelligence with
global reach. Attacks haveno borders — an attack
targeting a company in Latin
America can be initiated from
Europe and vice versa. Does
the vendor source information
globally and collate seeming
disjoined activities into
cohesive campaigns? This kindof intelligence will help youto take appropriate action

Context makes intelligencefrom data. Threat indicators
without context are of
no value — you should look
for providers that help you
to answer the important‘why does this matter?’questions. Relationship context(e.g. domains associated withthe detected IP addresses
or URLs where the specificfile was downloaded frometc.) provides additional value,
boosting incident investigationand supporting better incident‘scoping’ through uncovering
newly acquired related
Indicators of Compromisein the network

If you are looking for morestrategic content to informyour long-term security
planning, like:• High-level view of attack trends• Techniques and methods usedby attackers• Motivations• Attributions etc.,

then look for a threat
intelligence provider witha proven track record ofcontinuously uncovering andinvestigating complex threatsin your region or industry. Theability of the provider to tailor
its research capabilities to thespecifics of your company
is also critical

Conclusion
At Kaspersky we’ve been focusing on threat
research for over two decades. With petabytesof rich threat data to mine, advanced
machine‑learning technologies and a unique poolof global experts, we work to support you withthe latest threat intelligence from around theworld, helping to keep you immune from evenpreviously unseen cyberattacks.

Learn more

www.kaspersky.com© 2022 AO Kaspersky Lab.
Registered trademarks and service marks
are the property of their respective owners.