Take Action with CTI

Preventing Your TIP from Becoming a Trash Dump

Product Marketing Team — Tue, 27 Sep 2022 13:12:11 GMT

In our last post, we outlined three steps to jumpstart the CTI lifecycle and align it with your threat intelligence platform (TIP) by focusing on people, process, and technology. We highlighted that high-performing CTI teams have a dedicated TIP and follow a disciplined CTI lifecycle. Their success rests on properly aligning their TIP, the CTI lifecycle, and threat feeds. Get this alignment right, and you're set for high-performing operations. If you get this wrong, you risk loading your TIP with trash data, causing analyst burnout and developing and disseminating low-confidence and inaccurate threat intelligence. In this blog, we explain why getting the correct feed alignment requires rethinking your feed selection and curation process.

How to Jumpstart High-performance CTI Operations

Product Marketing Team — Tue, 27 Sep 2022 13:08:13 GMT

Introduction

To paraphrase a classic war protest song, "CTI? Huh! What is it good for? Huh! Absolutely nothing! Say it again, y'all!"

Three Steps to Early Warning

Product Marketing Team — Fri, 08 Jul 2022 15:02:01 GMT

In our previous post we highlighted the importance of early warning to cyber resilience. Early warning is all about anticipating attacks. The better your organization can anticipate, the better positioned you will be to respond, withstand, and recover from an attack. Given early enough warning, you can even prevent attacks.

Achieving Early Warning for Cyber Resilience

Product Marketing Team — Fri, 08 Jul 2022 15:00:46 GMT

It's time to be resilient, not just secure

The days of putting all your cyber resources into prevention are over. The expanding attack surface, driven by digital transformation, and accelerated by work from home (WFH), provides an increasingly target-rich environment. It's no longer a question of if, but rather when an adversary will breach your organization's defenses. That's why it's time to shift your focus from cyber security to cyber resilience.

Three Steps to Aligning CTI, SOC, and IR for Action

Product Marketing Team — Fri, 08 Jul 2022 14:32:13 GMT

Most security operations center (SOC) and incident response (IR) teams are overwhelmed and understaffed, often scrambling to reactively chase threats with firewall blocklists in a futile game of cat-and-mouse. Fortunately, by leveraging higher-level cyber threat intelligence (CTI) that maps out specific tactics, techniques, and procedures (TTPs) in alignment with the kill chain, your SOC can intelligently and proactively block these threats and even prevent future threats.

Shifting from What to How with TTPs

Product Marketing Team — Fri, 08 Jul 2022 10:38:16 GMT

Driven mainly by a defense-in-depth mentality, most organizations protect the network by blocking adversaries at the network edge. This means that the security operations center (SOC) must continually update its firewall blocklists to stop adversaries in their tracks. Blocklists rely on a continual flow of low-level indicators of compromise (IOC). Of course, Zero Trust security is shifting this model to a never-trust-always-verify model, but most day-to-day security operations revolve around blocklists.

How to Use MITRE ATT&CK to Map and Track Adversary TTPs

Product Marketing Team — Fri, 08 Jul 2022 10:35:26 GMT

Our post, “Three Strategic Steps to a Threat Informed Defense,” highlights the reasons for and merits of moving to a threat-informed defense (TiD) approach. A TiD centers on the use of MITRE ATT&CK®, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base forms a foundation for developing specific threat models and methodologies in the private sector, government, and cybersecurity product and service community.¹

Three Strategic Steps to a Threat-informed Defense (TiD)

Product Marketing Team — Fri, 08 Jul 2022 10:31:11 GMT

It’s 8:00 on a Sunday night and you’ve just finished reading our post on APT35 and AQUATIC PANDA, describing how these threat actors are actively exploiting the Log4j vulnerability. If only you could close all vulnerabilities, right? After all, regardless of your role (e.g., SOC, CTI, IR, management), you've spent the bulk of your career dealing with vulnerabilities in some way.

Smarten Up, Open Up, Tighten Up, and Power Up to Make Threat Intelligence Actionable

Product Marketing Team — Fri, 08 Jul 2022 10:27:37 GMT

In our last post, we outlined challenges to operationalizing CTI and making it actionable, including threat adversaries are becoming cleverer, the rapidly expanding attack surface increases your vulnerability, siloed operations are driving gaps in coverage, and information overload is making detecting advanced threats harder.

Operationalize Your Threat Intelligence in Four Moves

Product Marketing Team — Fri, 08 Jul 2022 10:18:00 GMT

Cyber threat intelligence (CTI) as a formal practice is gaining traction. In fact, 47 percent of participants in a recent SANS survey state that they have dedicated, in-house CTI teams.¹ The holy grail for these teams is operationalizing their CTI to benefit peer groups and organizational leadership. Operationalized CTI helps executives define and shore up the organization’s cyber posture. It helps Security Operations Center (SOC), Incident Response (IR), and other front-line teams to hunt down, identify, and respond to threats faster.