Relevance: The missing ingredient of cyber threat intelligence

Alastair Paterson | 9 February 2016

Today we’ve announced the closing of our Series B investment round, led by Trinity Ventures. This $14 million will give us the support to grow our team, further invest in development, and empower more clients with cyber situational awareness.

 

Since our Series A investment round in 2015, we’ve made huge strides; more than doubling our team, and achieving more than 300% growth as more businesses understand the significance of risks beyond the boundary.

 

So, what sets Digital Shadows apart? For the past several years, security teams have been encouraged to invest in cyber threat intelligence (CTI) feeds to help them to strengthen their security controls.  But there’s now a growing realization that these feeds are overwhelming their security controls and security teams – teams that are already under-resourced and busy trying to keep everything operational.  

 

CTI means a lot of things to a lot of people. While at Forrester, Rick Holland defined three tiers of threat intelligence. The most common and cheapest is the generic, commoditized information that is in no way tailored to an organization. Secondly, there is the information specific to your geography or your industry’s threat model. This is a bit more relevant and helps to understand what is going on around you.  The final level they describe is specific to your organization and your organization’s threat model. As you move down the cost increases, but so does the relevance.

 

Cyber situational awareness is about more than just the threats you face. It’s also about how you appear to others online, what you’re exposing and how big your attack surface is.  Armed with information about the threats you face and your attack surface, organizations can make better decisions.

 

A second problem that market must overcome is the “bucket of bad” approach that many IOC feeds follow. The providers of this style of feed employ a broad range of techniques to collect and pull together a big list of “bad” events, entities or identifiers for things that go bump in the night.  All these objects are then placed into a large bucket.  The bucket is handed to a customer whereupon they have to empty the bucket carefully sifting and filtering until they get the items that are relevant to them. To do something meaningful with this bucket is time-consuming and resource-intensive. As Holland points out, this is less about Indicators of Compromise and more "Indictors of Exhaustion.”

 

Incident pipeline 

With cyber situational awareness, the customer is placed at the center and everything is collected from their perspective and tailored to their needs. Our approach to this problem places our team of intelligence operations analysts who tailor collection to our clients’ requirements.  In the example above we’re able to filter down 384 000 mentions to just 11 incidents. This approach provides organizations with the most relevant incidents that require their immediate attention, freeing up the time and resources to address them and also get on with other important tasks.  As we work with our clients over time, the information we provide becomes even more relevant.

 

Organizations are demonstrating that they are fed up and exhausted with the ‘one-size-fits-all’ approaches. They demand relevant, specific information that can be easily digested and acted upon. Threat intelligence is not unimportant, there is still useful information that can mitigate harmful events; it’s useful still when it is tailored and considered alongside an organization’s online presence and attack surface. That’s the heart of cyber situational awareness.