Security News

In May 2019, Flashpoint CEO Josh Lefkowitz shared in SecurityWeek tips for evaluating threat intelligence vendors that cover the deep and dark web. I wanted to look at the entire threat intelligence space and provide some thoughts on how to evaluate the best vendors for you.

The advantages of having decent threat intelligence in place are many and various, as the threat landscape continues to widen year-on-year. The problem, as with any complex big-data project, is cutting through the inevitable data deluge to correctly identify the bits you need - the people, places, technology, and other moving parts to build the picture.

"You may collect information on an ongoing or future threat to your organization to include who the threat actor is, what are they going after, what is the tactic they will utilize to get in your network, how are they going to move laterally, how are they going to exfil information and when will the activity take place. You can collect all the relevant threat information but without the infrastructure in place to analyze the large amount of data coming in, the organization will not succeed in successfully orienting themselves and acting upon the threat information," Santiago Holley, Global Threat Intelligence Lead at Thermo Fisher Scientific, told Help Net Security. Holley has worked in multiple threat intelligence and cyber positions over the past ten years, including a stint as a Threat Intelligence Lead with the FBI, and this allows him to offer some advice to security leaders that have been tasked with setting up a robust threat intelligence program for their organization.

By Light Professional IT Services and the intelligence-led security company, FireEye announced the integration of Mandiant Threat Intelligence within By Light's Cyberoperations Enhanced Network and Training Simulators. As today's cyberspace landscape features an increasing number of well-funded, highly organized, and complex adversaries, the use of real-world threat intelligence in training and exercises has become crucial to defending effectively against cyberspace attacks.

Microsoft this week announced that it has made some of its COVID-19 threat intelligence available to the public. The number of attacks targeting organizations and individuals worldwide using coronavirus lures has increased dramatically over the past several months, and Microsoft says it wants to help even those who do not use its threat protection solutions.

Recorded Future this week announced the availability of Express, a free web browser extension designed to help security teams prioritize vulnerability patching and alerts from security information and event management tools. The extension is currently available for Chrome and Firefox, and once it's installed an icon with the Recorded Future logo will be added to the browser's toolbar.

King & Union launched a suite of new service offerings to augment its Avalon Cyber Analysis Platform and help customers address the human aspect of threat intelligence operations, bridging common gaps that many security teams face. "With the introduction of new services, King & Union is recognizing the critical human component of efficient threat intelligence operations. Threat intelligence analysts are hard to find and even harder to keep."

Sixgill, a leading cyber threat intelligence company, announced that as part of its partnership with Anomali, its new Darkfeed automated threat intelligence is available in the Anomali Preferred Partner Store. With access to this new intelligence stream, joint customers can integrate a real-time, automated feed of deep and dark web indicators into their existing security infrastructure and operations via Anomali ThreatStream.

Sixgill, a leading cyber threat intelligence company, announced that its Deep and Dark Web Threat Intelligence Solution, an automated and contextual cyber threat intelligence solution, will integrate with Palo Alto Networks Cortex XSOAR, the industry's first extended security, orchestration, automation and response platform with native threat intel management that empowers security leaders with instant capabilities against threats across their entire enterprise. "Malicious actors continue to develop sophisticated new attacks with increased frequency," said Rishi Bhargava, vice president of product strategy, Cortex XSOAR at Palo Alto Networks.

It's a topic I never tire of because not only do I believe that there is no "Silver bullet" technology, I believe it's the humans who really lead the way to greater security efficiency and effectiveness. Relevant - As security professionals, we need to change how we look at the threat landscape.