Sage Advice - Cybersecurity Blog

With cyber-attacks increasing, the likelihood that many organizations are experiencing the same attack is also increasing.  When such an incident occurs, the intelligence gathered – including what happened, how it was dealt with, and lessons that were learned – can teach your organization what to do in the same situation.  In today’s dynamic threat environment, it’s impossible to single-handedly keep on top of everything.  Implementing a threat intelligence program can help you better protect your organization.

Approaching the development of a Threat Intelligence Program is akin to any other mission-critical function. It is best managed as an important component of organizational intelligence supporting a business strategy, rather than a “check-box” item. If the latter, this function becomes a dizzying array of dusty relics offering little value, while it consumes time and resources.

As discussed in previous posts, a threat intelligence program can help organizations more quickly understand and effectively respond to the evolving threat environment.  And with this new program, gathering, analyzing, distributing, and sharing threat intelligence has added a whole new list of tasks to the cybersecurity “to-do list.”  Therefore, it's no suprise that one of the top predictions in the McAfee Threat Prediction Report of 2016, was that this function is going to be maturing very rapidly in the coming year.

There is no question that threat intelligence is an essential part of your cybersecurity defense strategy. But it’s not just about monitoring feeds. Sharing the threat intelligence your gather is also a huge component.

Information sharing may be a new concept for many organizations, but hackers having been doing it for years. Their ability to share knowledge throughout the hacker community is one of the things that has made them so successful.  In today’s threat environment, we need to fight fire with fire.  We stand a far better chance of beating back the bad guys if we join forces to collaborate and share information.  

There is widespread acceptance that access to timely cyber threat intelligence is a critical defense strategy in our dynamic cyber threat landscape.  As such, there has been an explosion of potential sources delivering a staggering amount of information.  But the goal of a threat intelligence program is NOT to be able to manage a ton of data.  The goal is to create a program that is both manageable and effective for your organization.  That means you need to limit your sources of threat intelligence.  So which do you choose?

Cybersecurity technology and legislation are integral to building a large-scale defense against cyber-threats. But if industry and government don’t collaborate and share information on threats and breaches, even the best laws and technologies will fall short.