Cyber Threat Intelligence Program
By Gideon T. Rasmussen, CISSP, CRISC, CISA, CISM, CIPP
Cyber threat intelligence provides visibility into the threat landscape. Threat intelligence
should feed implementation of security monitoring (looking forward) and threat hunting (looking
backward). Take action against new adversarial tactics to protect assets such as payments,
sensitive data and intellectual property.
I. Threat Intelligence Data Sources
Subscribe to cybersecurity advisories and integrate threat intelligence feeds into SIEM
security log monitoring at a minimum.
Consider establishing an e-mail distribution group so each team member receives alerts and
advisories. Configure an Outlook rule to save inbound messages to a folder.
- Mailing Lists - US-CERT
- Alerts: Timely information about current security issues, vulnerabilities, and exploits
- Analysis Reports: In-depth analysis on new or evolving cyber threats
- Bulletins: Weekly summaries of new vulnerabilities. Patch information is provided when available
- Tips: Advice about common security issues for the general public
- Current Activity: Up-to-date information about high-impact types of security activity affecting the community at large
- Known Exploited Vulnerabilities Catalog - CISA
- Reducing Significant Risk
- Subscribe to Email Updates
- Vendor Cybersecurity Advisories (e.g. Microsoft)
- InfraGard (Only available to US citizens)
- Information Sharing and Analysis Centers (ISACs)
- Create a Google E-mail Alert (e.g. Compromised OR breached OR hacked)
II. Intake Process
Receiving advisories is only the first step. Each team member may think someone else is
addressing an advisory or alert. Therefore, it is necessary to have an intake process to
ensure each message is addressed. Here are options:
Determine if the SIEM receives quality cyber threat intelligence feeds. Ask a member of the
SOC to screen share which feeds are integrated into the SIEM.
- When an advisory is received, assign a team member to process it
- Have a periodic meeting to analyze threat intelligence
- Enter each advisory into a log to ensure it is processed
III. Processing an Advisory
Critically evaluate each advisory, considering whether it makes sense to:
Create a help desk ticket to track each new task or work effort to closure. Assign
ticket categories to ensure employees and the team receive credit for their work. It's
also good to have data when requesting additional headcount and to defend the
value-add of the program.
- Implement a hardening security configuration as a preventive control
- Create a new security monitoring alert
- Create an analysis report when it is difficult to create an alert with low false positives/negatives
- Conduct threat hunting activity
IV. Take action!
Risk exists when controls are not deployed. Stack rank security issues in order of
risk priority. Be aggressive when it comes to closing them out. Measure performance of
the cyber threat intelligence program with quality assurance and metrics.
If you need cybersecurity program or assessment support, feel free to give me a call.
Click here for more professional development tips