Today’s threats are more complex than ever: Adversaries are working together to become smarter — and it’s time we did too. Leveraging threat intelligence is a big part of becoming more aware. Insufficient risk awareness, analysis and assessment are some of the top barriers to cyber resilience, according to the Ponemon Institute study, The 2016 Cyber Resilient Organization.

While it’s easy to say, it’s not as easy to implement. Navigating countless feeds of varying quality and managing the signal-to-noise problem can be especially challenging. In our on-demand webinar with Dr. Larry Ponemon of the Ponemon Institue, “Key Steps to Improving Your Cyber Resilience,” we discussed how security leaders could effectively leverage it to improve their cyber resilience using the following three approaches.

1. Anchor It in Incident Response Plans

One of our customers, a major media network, found their analysts spent way too much time investigating threat intelligence data — chasing issues that didn’t apply to them, which drained resources and seriously limited their effectiveness.

To fix this, the team grounded that data into their existing incident response processes. Analysts escalate indicators of compromise (IoCs) into incidents, and they can access vital information about potential threats when needed — using the available intel when relevant to the circumstances they face. It’s made a big difference.

2. Use Integrations and Correlation to Make It Actionable

By integrating threat intelligence with other data sources, such as security information and event management (SIEM) and endpoint detection and response (EDR) solutions, the information becomes more actionable for the analysts. They can refine and target the scope of the data by considering the context, severity and patterns. It gives them much more contextual awareness. This is better to understand what they’re contending with and what would be best to do about it.

3. Track and Measure the Usefulness of Your Sources

Many intel feeds are available, and none are one-size-fits-all. There’s open source, closed communities, commercial sources — and then there are threat intelligence platforms. Record how often individual feeds provide information: How critical is it? What quality is it? You’ll soon see if specific feeds are redundant or need to be adjusted.

We outline a few real-world examples of these three approaches in our on-demand webinar, “Key Steps to Improving Your Cyber Resilience.” You can also download a complete copy of the latest Ponemon report, The 2016 Cyber Resilient Organization.

More from Incident Response

How to Start a Career in Cyber Incident Response

Cyber incident response is one of cybersecurity's most interesting and rewarding careers. It’s an in-demand role, and it pays well. But how do you get started? First, let’s start with the basics. What is Cyber Incident Response? Cyber incident response is the preparation for and practice of identifying, containing and ending cyber attacks. A computer security incident response team (CSIRT) within an organization — ideally including the chief information security officer, security operations center staff, executives and representatives from the…

How the Mac OS X Trojan Flashback Changed Cybersecurity

Not so long ago, the Mac was thought to be impervious to viruses. In fact, Apple once stated on its website that "it doesn't get PC viruses". But that was before the Mac OS X Trojan Flashback malware appeared in 2012. Since then, Mac and iPhone security issues have changed dramatically — and so has the security of the entire world. In this post, we'll revisit how the Flashback incident unfolded and how it changed the security landscape forever. What…

What Hurricane Preparedness Can Teach Us About Ransomware

Each year between June and November, many parts of the U.S. become potential targets for hurricanes. In October 2022, we had Hurricane Ian devastate Florida. To prepare for natural disasters like hurricanes, organizations are encouraged to build out and test business continuity, disaster recovery, and crisis management plans to use in the response efforts. Millions of dollars each year are spent on natural disaster preparation, but natural disasters are not the only disruption businesses face. While we can’t equate the…

Charles Henderson’s Cybersecurity Awareness Month Content Roundup

In some parts of the world during October, we have Halloween, which conjures the specter of imagined monsters lurking in the dark. Simultaneously, October is Cybersecurity Awareness Month, which evokes the specter of threats lurking behind our screens. Bombarded with horror stories about data breaches, ransomware, and malware, everyone’s suddenly in the latest cybersecurity trends and data, and the intricacies of their organization’s incident response plan. What does all this fear and uncertainty stem from? It’s the unknowns. Who might…