Top 10 cyber threat intelligence data services

As mentioned, threat intelligence needs to be relevant, punctual and actionable. One of the ways organizations manage that is by incorporating cyber threat intelligence feeds into their already existing security solutions.

Cyber threat intelligence feeds are real-time constant streams of threat data coming from different sources outside your network. They give you intel on potential global threats, which can be suspicious domains or IP addresses linked to suspicious activity, information from pastebin, and more.

We’ve talked about the best cybersecurity APIs, and now let’s explore our favorite cyber threat intelligence data services:

1. SecurityTrails Feeds

While ranking ourselves as #1 might sound like shameless self-promotion, we really do think that we offer the best Threat intelligence feeds around. When it comes to passive intelligence collection for your OSINT needs, SecurityTrails offers full IP, domain, subdomain, SPF, DMARC, open ports, and company enrichment feeds like no other. Need custom feeds? We can get those for you, too.

2. Recorded Future

Recorded Future offers their Threat Intelligence Feeds solution with more than 65 threat data streams, and they’re always adding new ones. They also allow you to integrate it with other threat feeds you’re already using, and they correlate and analyze the data for you. This way, you’ill focusing on intelligence that actually matters, to make quicker, better-informed security decisions.

3. IBM X-Force Exchange

One of the industry’s favorites, IBM X-Force Exchange is a threat intelligence sharing platform for security analysts that allows you to quickly access intel on current cyber threats and share your findings with other users. With it, you can search IP addresses, URLs, CVEs and web applications and gives you insight into their risk scores, historical records, locations and much more.

4. FireEye iSIGHT Threat Intelligence

FireEye iSIGHT Threat Intelligence is a unique platform that combines adversary, victim and machine-based intelligence. Its team of intelligence researchers from all over the world delivers the latest intel on attackers’ tactics, techniques and procedures 24 hours after they have been observed. The team works to eliminate false positives and prioritize threats so you can know when and how to respond.

5. AlienVault Unified Security Management (USM)

AlienVault Unified Security Management (USM) features a community that researches the global threat landscape and contributes over 19 million threat indicators daily. Their unified platform provides data on endpoint detection, vulnerability assessment and asset discovery so you can investigate and mitigate threats faster and more efficiently.

6. ThreatConnect

ThreatConnect is another industry favorite. You can automate your security tools to send intel to ThreatConnect, get intelligence data from them to provide context to threats and speed up your incident response time. It also allows you to manage your team’s workflow and export reports to see the true business impact your security program has. It features analytics, automation and workflow all in one.

7. Anomali ThreatStream

Here’s another great platform that works to remove false positives and alert fatigue by applying machine learning intelligence. Anomali ThreatStream collects data from many sources, which you can then purchase and use to identify and prioritize critical threats to your organization for faster incident response prior, during and after an attack. It’s also a sharing platform where you can collaborate with the community and work together the mitigate threats.

8. LookingGlass Cyber Solutions

LookingGlass Cyber Solutions is an open-source framework for threat intelligence that shows you why your organization can be targeted and allows you to proactively avoid potential threats. It gives threats context and priority so you can address your security vulnerabilities based on highest risk score.

9. Symantec DeepSight Intelligence

Symantec DeepSight Intelligence is the largest civilian threat collection platform available that gives you access to the most relevant global threat intelligence and technical details. With it, you can discover techniques of posing threat actors, active campaigns and much more, informing you of cyber risks and enabling your timeliest responses to them.

10. Palo Alto Networks AutoFocus

Palo Alto Networks AutoFocus is a hosted service that contextualizes threat investigation so you can improve the accuracy and speed of your threat analysis and incident response. It allows you to correlate and discover the causes of threats, all in one unified product. It also features automated protection that helps you use intelligence for better defense.

Common Types of Cybersecurity Attacks

If you've ever studied famous battles in history, you'll know that no two are exactly alike. Still, there are similar strategies and tactics often used in battle because they are time-proven to be effective.

Similarly, when a criminal is trying to hack an organization, they won't re-invent the wheel unless they absolutely have to: They'll draw upon common types of hacking techniques that are known to be highly effective, such as malware, phishing, or cross-site scripting (XSS). Whether you're trying to make sense of the latest data breach headline in the news or analyzing an incident in your own the organization, it helps to understand the different attack vectors a malicious actor might try to cause harm. Here’s an overview of some of the most common types of attacks seen nowadays.

Malware 

If you've ever seen an antivirus alert pop up on your screen, or if you've mistakenly clicked a malicious email attachment, then you've had a close call with malware. Attackers love to use malware to gain a foothold in users' computers—and, consequently, the offices they work in—because it can be so effective.

“Malware” refers to various forms of harmful software, such as viruses and ransomware. Once malware is in your computer, it can wreak all sorts of havoc, from taking control of your machine, to monitoring your actions and keystrokes, to silently sending all sorts of confidential data from your computer or network to the attacker's home base.

Attackers will use a variety of methods to get malware into your computer, but at some stage it often requires the user to take an action to install the malware. This can include clicking a link to download a file, or opening an attachment that may look harmless (like a Word document or PDF attachment), but actually has a malware installer hidden within. 

Phishing 

Of course, chances are you wouldn't just open a random attachment or click on a link in any email that comes your way—there has to be a compelling reason for you to take action. Attackers know this, too. When an attacker wants you to install malware or divulge sensitive information, they often turn to phishing tactics, or pretending to be someone or something else to get you to take an action you normally wouldn’t. Since they rely on human curiosity and impulses, phishing attacks can be difficult to stop. 

In a phishing attack, an attacker may send you an email that appears to be from someone you trust, like your boss or a company you do business with. The email will seem legitimate, and it will have some urgency to it (e.g. fraudulent activity has been detected on your account). In the email, there will be an attachment to open or a link to click. Upon opening the malicious attachment, you’ll thereby install malware in your computer. If you click the link, it may send you to a legitimate-looking website that asks for you to log in to access an important file—except the website is actually a trap used to capture your credentials when you try to log in.

In order to combat phishing attempts, understanding the importance of verifying email senders and attachments/links is essential. 

SQL Injection Attack 

SQL (pronounced “sequel”) stands for structured query language; it’s a programming language used to communicate with databases. Many of the servers that store critical data for websites and services use SQL to manage the data in their databases. A SQL injection attack specifically targets this kind of server, using malicious code to get the server to divulge information it normally wouldn’t. This is especially problematic if the server stores private customer information from the website, such as credit card numbers, usernames and passwords (credentials), or other personally identifiable information, which are tempting and lucrative targets for an attacker.

An SQL injection attack works by exploiting any one of the known SQL vulnerabilities that allow the SQL server to run malicious code. For example, if a SQL server is vulnerable to an injection attack, it may be possible for an attacker to go to a website's search box and type in code that would force the site's SQL server to dump all of its stored usernames and passwords for the site. For more about cybersecurity threat intelligence

Threat Intelligence Use Cases

The diverse use cases of threat intelligence make it an essential resource for cross-functional teams in any organization. Although it’s perhaps the most immediately valuable when it helps you prevent an attack, threat intelligence is also a useful part of triage, risk analysis, vulnerability management, and wide-scope decision making.

Incident Response

Security analysts in charge of incident response report some of the highest levels of stress in the industry, and it’s no wonder why — the rate of cyber incidents has steadily climbed over the last two decades, and a high proportion of daily alerts turn out to false positives. When dealing with real incidents, analysts must often spend time painstakingly sorting through data manually to assess the problem.

Threat intelligence reduces the pressure in multiple ways:

·      Automatically identifying and dismissing false positives

·      Enriching alerts with real-time context, like custom risk scores

·      Comparing information from internal and external sources

Recorded Future users identify risks 10 times faster than they did before integrating threat intelligence into their security solutions, giving them days more time on average to respond to threats in an industry where even seconds can matter.

Security Operations

Most security operations center (SOC) teams must deal with huge volumes of alerts generated by the networks they monitor. Triaging these alerts takes too long, and many are never investigated at all. “Alert fatigue” leads analysts to take alerts less seriously than they should. Threat intelligence solves many of these problems — helping gather information about threats more quickly and accurately, filter out false alarms, speed up triage, and simplify incident analysis. With it, analysts can stop wasting time pursuing alerts based on:

·      Actions that are more likely to be innocuous rather than malicious

·      Attacks that are not relevant to that enterprise

·      Attacks for which defenses and controls are already in place

As well as accelerating triage, threat intelligence can help SOC teams simplify incident analysis and containment. Recorded Future users resolve threats 63 percent faster, cutting the critical hours they spend on remediation by more than half.

Vulnerability Management

Effective vulnerability management means shifting from taking a “patch everything, all the time” approach — one that nobody can realistically ever achieve — to prioritizing vulnerabilities based on actual risk.

Although the number of vulnerabilities and threats has increased every year, research shows that most threats target the same, small proportion of vulnerabilities. Threat actors are also quicker — it now only takes fifteen days on average between a new vulnerability being announced and an exploit targeting it appearing.

This has two implications:

·      You have two weeks to patch or remediate your systems against a new exploit. If you can’t patch in that timeframe, have a plan to mitigate the damage.

·      If a new vulnerability is not exploited within two weeks to three months, it’s unlikely to ever be — patching it can take lower priority.

Threat intelligence helps you identify the vulnerabilities that pose an actual risk to your organization, going beyond CVE scoring by combining internal vulnerability scanning data, external data, and additional context about the TTPs of threat actors. With Recorded Future, users identify 22 percent more real threats before they have a serious impact.

Risk Analysis

Risk modeling can be a useful way for organizations to set investment priorities. But many risk models suffer from vague, non-quantified output that is hastily compiled, based on partial information, based on unfounded assumptions, or is difficult to take action on.

Threat intelligence provides context that helps risk models make defined risk measurements and be more transparent about their assumptions, variables, and outcomes. It can help answer questions such as:

·      Which threat actors are using this attack, and do they target our industry?

·      How often has this specific attack been observed recently by enterprises like ours?

·      Is the trend up or down?

·      Which vulnerabilities does this attack exploit, and are those vulnerabilities present in our enterprise?

·      What kind of damage, technical and financial, has this attack caused in enterprises like ours?

Asking the right questions with Recorded Future’s threat intelligence is one of the ways users see an 86 percent reduction in unplanned downtime — a huge difference when even a minute of downtime can cost some organizations up to $9,000 in lost productivity and other damages.

Fraud Prevention

To keep your organization safe, it isn’t enough to only detect and respond to threats already exploiting your systems. You also need to prevent fraudulent uses of your data or brand.

Threat intelligence gathered from underground criminal communities provides a window into the motivations, methods, and tactics of threat actors, especially when this intelligence is correlated with information from the surface web, including technical feeds and indicators.

Use threat intelligence to prevent:

·      Payment fraud — Monitoring sources like criminal communities, paste sites, and other forums for relevant payment card numbers, bank identifier numbers, or specific references to financial institutions can provide early warning of upcoming attacks that might affect your organization.

·      Compromised data — Cybercriminals regularly upload massive caches of usernames and passwords to paste sites and the dark web, or make them available for sale on underground marketplaces. Monitor these sources with threat intelligence to watch out for leaked credentials, corporate data, or proprietary code.

·      Typosquatting — Get real-time alerts on newly registered phishing and typosquatting domains to prevent cybercriminals from impersonating your brand and defrauding unsuspecting users.

By avoiding more breaches with threat intelligence, Recorded Future users are able to save over $1 million per potential breach through damaging fines, penalties, and lost consumer trust.

Security Leadership

CISOs and other security leaders must manage risk by balancing limited available resources against the need to secure their organizations from ever-evolving threats. Threat intelligence can help map the threat landscape, calculate risk, and give security personnel the intelligence and context to make better, faster decisions.

Today, security leaders must:

·      Assess business and technical risks, including emerging threats and “known unknowns” that might impact the business

·      Identify the right strategies and technologies to mitigate the risks

·      Communicate the nature of the risks to top management, and justify investments in defensive measures

Threat intelligence can be a critical resource for all these activities, providing information on general trends, such as:

·      Which types of attacks are becoming more (or less) frequent

·      Which types of attacks are most costly to the victims

·      What new kinds of threat actors are coming forward, and the assets and enterprises they are targeting

·      The security practices and technologies that have proven the most (or least) successful in stopping or mitigating these attacks

It can also enable security groups to assess whether an emerging threat is likely to affect their specific enterprise based on factors such as:

·      Industry — Is the threat affecting other businesses in our vertical?

·      Technology — Does the threat involve compromising software, hardware, or other technologies used in our enterprise?

·      Geography — Does the threat target facilities in regions where we have operations?

·      Attack method — Have methods used in the attack, including social engineering and technical methods, been used successfully against our company or similar ones?

With these types of intelligence, gathered from a broad set of external data sources, security decision makers gain a holistic view of the cyber risk landscape and the greatest risks to their enterprise.

Here are four key areas where threat intelligence helps security leaders make decisions:

·      Mitigation — Threat intelligence helps security leaders prioritize the vulnerabilities and weaknesses that threat actors are most likely to target, giving context on the TTPs those threat actors use, and therefore the weaknesses they tend to exploit.

·      Communication — CISOs are often challenged by the need to describe threats and justify countermeasures in terms that will motivate non-technical business leaders, such as cost, impact on customers, new technologies. Threat intelligence provides powerful ammunition for these discussions, such as the impact of similar cyber attacks on companies of the same size in other industries or trends and intelligence from the dark web indicating that the enterprise is likely to be targeted.

·      Supporting leaders — Threat intelligence can provide security leaders with a real-time picture of the latest threats, trends, and events, helping security leaders respond to a threat or communicate the potential impact of a new threat type to business leaders and board members in a timely and efficient manner.

·      The security skills gap — CISOs must make sure the IT organization has the human resources to carry out its mission. But cybersecurity’s skills shortage means existing security staff frequently cope with unmanageable workloads. Threat intelligence automates some of the most labor-intensive tasks, rapidly collecting data and correlating context from multiple intelligence sources, prioritizing risks, and reducing unnecessary alerts. Powerful threat intelligence also helps junior personnel quickly “upskill” and perform above their experience level.

Cybersecurity Monitoring Enhances Defense in Ddepth Strategies

Continuously monitoring controls effectiveness is the only way to ensure that your defense in depth strategies protect data security. Three of the primary controls that protect against a data breach - unused open ports, host-based firewalls, network-based firewalls - often require manual processes and review to ensure their continued effectiveness.

What does cybersecurity monitoring do?

Unused open ports often remain unnoticed because organizations lack the capability to continuously scan their networks. Digital transformation objectives leave you adding and removing services on a regular basis. Monitoring the ports that these services use can become overwhelming when done manually, ultimately creating a human error risk that can lead to a data breach.

How cybersecurity monitoring locates weaknesses

Meanwhile, firewalls require regular monitoring to ensure that you have updated them with the most recent security patches. Like every other service in your organization, attackers continuously look to exploit vulnerabilities in firewall code. If you fail to update the firewall in a timely manner, you place your data at risk.

Cybersecurity monitoring solutions enable you to continuously monitor your IT controls to ensure continuous data protection. These solutions look at the publicly available information on the internet, such as open ports or firewall updates, and alert you to new risks. Many provide alerts to new risks and offer remediation steps.

What is a Security Operations Center (SOC)?

A DEFINITION OF SECURITY OPERATIONS CENTER

A security operations center (SOC) is a facility that houses an information security team responsible for monitoring and analyzing an organization’s security posture on an ongoing basis. The SOC team’s goal is to detect, analyze, and respond to cybersecurity incidents using a combination of technology solutions and a strong set of processes. Security operations centers are typically staffed with security analysts and engineers as well as managers who oversee security operations. SOC staff work close with organizational incident response teams to ensure security issues are addressed quickly upon discovery.

 

Cyber security operations centers monitor and analyze activity on networks, servers, endpoints, databases, applications, websites, and other systems, looking for anomalous activity that could be indicative of a security incident or compromise. The SOC is responsible for ensuring that potential security incidents are correctly identified, analyzed, defended, investigated, and reported.

 

HOW A SECURITY OPERATIONS CENTER WORKS

Rather than being focused on developing security strategy, designing security architecture, or implementing protective measures, the SOC team is responsible for the ongoing, operational component of enterprise information security. Security operations center staff is comprised primarily of security analysts who work together to detect, analyze, respond to, report on, and prevent cybersecurity incidents. Additional capabilities of some SOCs can include advanced forensic analysis, cryptanalysis, and malware reverse engineering to analyze incidents.

The first step in establishing an organization’s SOC is to clearly define a strategy that incorporates business-specific goals from various departments as well as input and support from executives. Once the strategy has been developed, the infrastructure required to support that strategy must be implemented. Typical SOC infrastructure includes firewalls, IPS/IDS, breach detection solutions, probes, and a security information and event management (SIEM) system. Technology should be in place to collect data via data flows, telemetry, packet capture, syslog, and other methods so that data activity can be correlated and analyzed by SOC staff. The security operations center also monitors networks and endpoints for vulnerabilities in order to protect sensitive data and comply with industry or government regulations.

BENEFITS OF HAVING A SECURITY OPERATIONS CENTER

The key benefit of having a security operations center is the improvement of security incident detection through continuous monitoring and analysis of data activity. By analyzing this activity across an organization’s networks, endpoints, servers, and databases around the clock, SOC teams are critical to ensure timely detection and response of security incidents. The 24/7 monitoring provided by a SOC gives organizations an advantage to defend against incidents and intrusions, regardless of source, time of day, or attack type. The gap between attackers’ time to compromise and enterprises’ time to detection is well documented in Verizon’s annual Data Breach Investigations Report, and having a security operations center helps organizations close that gap and stay on top of the threats facing their environments.

BEST PRACTICES FOR RUNNING A SECURITY OPERATIONS CENTER

Many security leaders are shifting their focus more on the human element than the technology element to “assess and mitigate threats directly rather than rely on a script.” SOC operatives continuously manage known and existing threats while working to identify emerging risks. They also meet the company and customer’s needs and work within their risk tolerance level. While technology systems such as firewalls or IPS may prevent basic attacks, human analysis is required to put major incidents to rest.

 

For best results, the SOC must keep up with the latest threat intelligence and leverage this information to improve internal detection and defense mechanisms. As the InfoSec Institute points out, the SOC consumes data from within the organization and correlates it with information from a number of external sources that deliver insight into threats and vulnerabilities. This external cyber intelligence includes news feeds, signature updates, incident reports, threat briefs, and vulnerability alerts that aid the SOC in keeping up with evolving cyber threats. SOC staff must constantly feed threat intelligence into SOC monitoring tools to keep up to date with threats, and the SOC must have processes in place to discriminate between real threats and non-threats.