Our definitive guide to threat intelligence provides everything you need to know about implementing and using threat intelligence within your organisation.
What is threat intelligence?
Threat intelligence is the information that an organisation uses to understand the threats they face now and threats that could face in the future. This information starts as data which is gathered through various means before it is processed and analysed (usually by specialist security analysts) in order to provide context such as the impact, capability or intent of the threat.
Threat intelligence helps you to make more informed decisions that will help you to prepare, prevent and mitigate the impact of threats. Ultimately, threat intelligence provides you with the insight you need to better protect your people, assets, reputation and bottom line.
“Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and action-oriented advice about an existing or emerging menace or hazard to assets. This intelligence can be used to inform decisions regarding the subject’s response to that menace or hazard.”
– Gartner
Why is threat intelligence important?
Across the world, threats are constantly evolving, and business security risks are increasing.
Whilst some businesses may not consider themselves to be operating in high-risk or dangerous areas of the world, profound social instability, failure in governance and deepening polarisation between opposing political and cultural views is constituting new threats, in new places.
This is why the need for high-quality threat intelligence in corporate security is growing rapidly. To keep abreast of the many dangers and risks that our international security landscape now presents, a constant stream of data and information can be the lifeline that keeps businesses, their people and their assets safe.
What’s the difference between information and intelligence?
Data is not the same as intelligence.
And with the overwhelming amount of data that can be found every day, a stream of raw information can be just that, overwhelming. To generate value from data, it should be subject to the intelligence cycle.
The intelligence cycle is a structured process, applied in both military and civilian environments, and is used to gather information, convert it into relevant intelligence, and pass it to those who can then decide on the appropriate course of action.
Implementing the intelligence cycle provides an order to the collection and information gathering process. It states exactly what needs to be collected, in what priority and when.
- Direction
The first stage of the cycle is to determine the intelligence requirements and plan the collection efforts, creating a clear focus and list of priorities for the intelligence team, and ensuring that all information gathered is geared towards a clear purpose.
- Collection
The process of gathering raw data that fulfils the requirements set out in the Direction stage of the cycle. You need to include a wide range of sources as part of your collection efforts.
- Processing and analysis
This phase of the intelligence cycle is key to turning information into intelligence and consists of the data being collated, evaluated, analysed and interpreted by an analyst (or team of if appropriate).
Information picked up as part of the collection process goes through several stages of collation, evaluation, analysis and interpretation to become actionable intelligence.
Collation groups related information together before being evaluated based on credibility and reliability of the original source. Information cannot simply be taken at face value, so it’s important to indicate how much confidence can be placed in each item of information.
- Dissemination
The final stage of the intelligence cycle is the timely delivery of intelligence to those who need it.
Intelligence must be disseminated in a way that’s appropriate for the user, highlighting the key facts and our interpretation, comment or assessment.
What are the different types of threat intelligence?
Threat intelligence is often broken down into three subcategories:
- Strategic
- Operational
- Tactical
Different information is required at different levels of the organisation, depending on the type of decisions they make. Ensuring that the right team has the right information can be key to protecting your organisation.
Strategic Threat Intelligence
Strategic intelligence focuses on broad issues which impact and direct strategy. It provides a high level of information on your organisation’s current security posture as well as the security landscape you operate in. It’ll explore the worst-case scenarios from potential threats and their possible impact on your business.
It’s typically used to make decisions at a high level and therefore should include evidence-based and informed projections regarding the security landscape of your industry. It should help you plan for the resources and tools you’ll need to mitigate future threats.
Operational Threat Intelligence
Operational intelligence requires real time, or near real-time data. This data is required at speed as it’s typically used to inform decisions that require a quick response. For example, operational intelligence in the military is used during combat by people on the battlefield, rather than in the planning phase.
For you, it may mean responding to an incident that has occurred close to where you have colleagues currently travelling. You’ll need timely information on what’s happening and the severity of the situation before making decisions that will ensure their safety. For an MSP, it could be monitoring a significant cyber campaign targeting the industry vertical your client base belongs to. You may need to assess the immediate danger to your clients and quickly understand how you could prevent the same fate occurring for them, or how you would detect and respond if prevention is not guaranteed.
Tactical Threat Intelligence
Tactical intelligence is intelligence that is required for planning and conducting tactical operations. It’s aimed at those making the day-to-day decisions, prioritising tasks and allocating resources in order to keep the business moving.
This means that they need regular updates, the latest in order to keep them on track and ensure that they’re achieving the objectives that are set with the help of strategic intelligence.
Who is threat intelligence for?
Every security role can benefit from threat intelligence. In fact, it’s increasingly common for intelligence to be shared with, and utilised by, the wider organisation but it’s essential to security departments.
It’s a key component that can empower your team and support multiple different security functions by providing a clearer understanding of the current threat landscape.
Threat intelligence can feed into your duty of care and help you to protect your people as they conduct business across the globe. It can allow you to better advise them ahead of their trip, so they too have an understanding of the place they’re visiting, as well as ensure they’re safe throughout their travels. Timely threat intelligence enables you to constantly monitor the security situation, quickly identify a change and respond to emergencies where necessary.
It can also help you to mitigate risks to your other assets such as cargo, vessels and aircrafts, helping you to plan the safest and quickest route and notifying you of disruption so that you can divert your assets with minimal impact to your supply chain.
And it’s not just the assets that move either. You can better protect your static assets too by understanding what’s happening around them. The knowledge that threat intelligence provides you with will enable you to implement more stringent security measures following early identification of a string of commercial burglaries in your area, or justify an increase in security costs because the crime rate around one of your facilities is rising.
Beyond your security team, implementing a threat intelligence solution within your company can help to set investment priorities, understand your weaknesses and limit reputation damage.
What are some other threat intelligence use cases?
Some use cases for threat intelligence include:
Incident Response
We work with operations centres across the world and typically, their main aim is to receive information that may have an impact on their business as quickly as possible. They rely on our alerting functionality to inform them of breaking news and developments so that they can quickly implement the appropriate procedures to ensure people are safe, assets are protected and that any disruption to their operations is minimised.
Risk Analysis
Analysing risk means looking at the likelihood of something happening, and understanding the impact if it does.
To do this effectively, you need data. The data will firstly allow you to identify what the biggest threats to your organisation are, then how likely they are to happen. Having a database of historical information will not only allow you to quickly identify what risks you’ve been exposed to in the past, but how many times they’ve occurred and hopefully, what the negative consequences were.
And this doesn’t have to be threats that your business has been subject to directly. Your competitors may have been affected, directly or indirectly, or even risks that impact the entire industry you operate in. Political risks such as a change in government policy or even foreign influence, whilst not directly targeting your business, can significantly impact your operations.
Threat intelligence can help you answer questions such as:
- What types of threats exist?
- Which threats have occurred?
- How often do they occur?
- How is this changing over time?
- What threats affect my competitors?
- Which threats could affect us?
- Have we already been targeted?
- Who is targeting us?
- Why would they target us?
- What are their tactics?
Identifying and understanding the risks, enables you to make more informed decision-making, develop proactive mitigation strategies and justify associated budget and staffing requirements.
Automated Collection
The meteoric rise of artificial intelligence and machine learning tools has changed the way many industries operate, security and intelligence being one of them.
In order to increase the speed of gathering data, and reduce the overheads of hiring a team of expert analysts, many intelligence providers have introduced automated collection.
Algorithms are built to comb through news articles and social media feeds from around the world to monitor trends, geopolitical developments, and potential crises in real-time. Tools such as natural language processing are utilised to assist machines to compute the meaning of words and provide context in the same way that humans do. The end product is large volumes of very fast data being fed to the users.
Threat intelligence solutions that solely rely on automated collection are usually configured so that the algorithms identify key words or phrases on social media. Any tweet or post containing that trigger word will activate an alert.
It goes without saying that there are many benefits to this kind of threat intelligence software, however, a purely automated solution can also have its drawbacks too.
Without any human involvement in the collection process, there’s very little analysis or context. The data is in its most raw format, so unless you have a team of analysts on your team who can weed out the most relevant alerts, it can be overwhelming.
Analyst-led Collection
With an analyst-led intelligence solution, the data collection is manual. There will be a team of analysts identifying and processing the data they gather, which is then disseminated via a threat intelligence platform.
The best intelligence providers will hire analysts who will likely have built up years’ worth of expertise in the region or specialism that they cover. They’ll be able to provide unparalleled context to incidents and provide additional insight into the ‘so what’ factor of intelligence – essentially, why is this incident important and what does it mean to you?
By helping you to answer these questions, you can save time, effort and resources interpreting the data on your end. Analyst-led collection can be particularly beneficial if you have a small team or if risk analysis is the main use case for your business.
If you’re looking at threat intelligence for incident response, an analyst-led solution may not provide you with the timeliness required to meet your objectives, unless the provider is focused on one particular area.
Find out how our threat intelligence expertise could benefit your organisation here.
Comments are closed