How to Train Your Team (and Organization) to Effectively Use Threat Intelligence

By Josue Ledesma

Threat intelligence has transformed the information security world for the better but it’s not always leveraged in the best way possible by organizations and departments. The sheer amount of information, providers, platforms, and types of threat intelligence and data available, make it difficult to confidently ensure an organization is making the most of their threat intelligence.

For this article, we spoke to Karl Sigler, threat intelligence manager at Trustwave, to get a sense of how organizations can maximize threat intelligence for their organization.

Why Threat Intelligence is Important for Information Security Departments

Threat intelligence is a relatively new area in the information security world brought by a shift in security philosophy and mindset among companies, and due to major changes in technological capabilities.

Sigler describes a previous world where companies held tight to their security research and information, seeing it as an advantage they had over their competitors. However, it was soon discovered that information-sharing vastly benefitted all companies, mitigated potential risk, and weakened attackers who preyed on a lack of knowledge.

These data and information partnerships have led to an exponential growth in available data and only somewhat recently has the technology been widely available to access and leverage this amount of data and information. Now, infosec should look towards leveraging threat intelligence as a key part of their department and function.

How threat intelligence benefits an organization varies wildly and should vary by that organization’s objectives and priorities. For example, threat intelligence can enhance a company’s auditing capabilities, it may help in defining, identifying and filtering incoming firewall data, or it may support your current Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS).

However, using threat intelligence effectively is where the challenge lies.

Making the most of threat intelligence

Using threat intelligence effectively is largely about using data effectively. This means your company needs to have the right organizational and departmental set up before being able to properly leverage any threat intelligence for its benefit. According to Sigler, there are three major areas of consideration - infrastructure, team skill-sets, and training.

Having the Right Infrastructure 

Simply put, if an organization doesn’t have the right infrastructure to handle the amount of data coming from a new threat intel feed, then the threat intelligence information is of no use to the company. Or worse, it may even slow an organization down, making it less capable of preventing potential attacks or mitigating damage in the case of a compromise.

As Sigler puts it, “When dealing with threat intel data, you could be looking at PBs (petabytes) of data. To be able to handle, query, clean, analyze, and sort that data, your company needs a lot of processing and storage power.”

Your organization’s data infrastructure should weigh into your decision-making when considering adopting a new threat intel source or figuring out how you will leverage threat intel in your organization.

If you don’t feel like your organization has the right infrastructure (yet), don’t worry. Sigler has some suggestions for smaller or newer companies later in this article.

Looking for the Right Team

Sigler stresses that without the right training, no amount of threat intelligence data or platform would make an effective impact in an organization. He outlines that the right individual and team should have the following areas of expertise.

We should stress that it would be difficult finding the right team, let alone individual, with high degrees of expertise in all of these areas. Which brings us to the next area.

Incorporating the Right Training for Your Team

Data science, information security, and programming all require intensive education and training. It’s up to you as the infosec leader to assess your team, identify the knowledge gaps, and train them in the respective fields so they can better make use of threat intelligence.

Sigler has some key advice.

“Focus the training on where the gaps are and to listen to your team. It’s gotten a lot easier and cheaper to ramp up your team than before. Logistics are easier and there are a lot of online classes, whether a one-week workshop or an intensive distance learning course.”

Getting Started with Threat Intelligence

If threat intelligence is a new consideration for your organization, it may seem intimidating, but there initial steps you can take as you onboard your team and organization. As with any major undertaking, you need to understand your business objectives from an organizational whole and then carry out your threat intelligence procurement accordingly.

For example, your threat intelligence needs now may differ from your needs in the next 2, 3 or even 5 years. Karl provides an example.

“If your company is going to expand globally or into new territories, then the kind of threat intel data you need to collect and scrutinize will be different.”

An infosec leader also needs to scope out priorities in conjunction with the team and get an understanding of what’s possible given the company’s current infrastructure and department set up. Communicating with your team is essential here so you understand what your team can do and what training is needed to make them as effective as possible.

Once your team is properly trained, you’re ready to look for threat intel sources. Sigler suggests starting with some free open-source threat intel feeds. They offer flexibility and provide a good observational baseline for what your team and department could handle at very little cost to your company’s resources. Sigler also suggests leveraging Elastic Stack or a similar data storage and analysis platform that has the flexibility of handling many different data sources and formats.

From there, you can see how much more your team can handle and what threat intelligence data you may be missing. As you build up your threat intel sources, make sure your team is equipped to handle the information and data processing with the right training and education.

As you and your team become acclimated to the use of threat intelligence, your department will be running much more efficient and secure, benefitting your entire organization.

Want more? InfoSec World is just around the corner, and it's the perfect setting for you to continue building your knowledge base and network with security leaders too!

 Headway