Effective Vulnerability Management

8Vulnerability Threat Intelligence

Threat intelligence is a domain within cybersecurity where teams leverage open source information to determine and prioritize threats to an organization. While commonly a separate practice in larger cybersecurity teams, smaller teams may leverage the same tactics to determine if there are known bad domains, IP addresses, types of files and file hashes, or specific vulnerabilities that are being exploited in the wild. All this technical information can be used to create alerts, detect possible ongoing attacks, or block unwanted network scanning from bad actors. Threat intelligence is also known as cyber threat intelligence (CTI) and is used by multiple organizations, one example being the Cybersecurity and Infrastructure Security Agency (CISA) (www.cisa.gov/resources-tools/services/cyber-threat-intelligence).

Why Is Threat Intel Important to VMPs?

Using this intelligence, organizations can create alerts or focus remediation activities on the given information. For example, if a threat actor is found to be using a specific type of ransomware or a list of file types and specific hashes, techniques will be found and distributed among proper threat intelligence communication channels to combat them. A threat intel team will learn that this specific threat actor is using this attack type and may choose to increase detection and tailor alerting for specific IP addresses or domains. The SANS Whitepaper on Threat Intelligence is an excellent resource ...