Welcome!

Cloud Security Authors: Elizabeth White, Zakia Bouachraoui, Pat Romanski, Yeshim Deniz, Liz McMillan

Related Topics: @CloudExpo, Cloud Security, @DXWorldExpo

@CloudExpo: Blog Feed Post

Context (& Quality) Is King with Threat Intelligence By @AdamDVincent [#Cloud]

As an industry, we need to work together to understand threat data better

Recently, Forrester analyst Rick Holland brought up the point of quality vs. quantity when it comes to threat indicators. We agree, the focus should never be on the quantity of data, it should be on the quality of data. So the question becomes, where and how can you gather or make sense of this quality threat intelligence?

tweet

As an industry, we need to work together to understand threat data better. Everyone needs quality data to make decisions. Just like marketing departments need quality data to determine who to market (and sell) to; the SOC, IR, threat, and network defense teams need quality data to make decisions to better protect their infrastructure. People don’t need more data, they need more quality data. This data can come from a variety of places: internal, partners, industry groups and affiliations, open source, and premium paid. In all these cases, the goal is to aggregate them to better understand risk to the organization. Understanding the data is key, and that is where a Threat Intelligence Platform (TIP) comes in. While data providers sell data, platforms organize and make sense of the data, while interfacing with solutions to take action once the data is properly analyzed.

Indicators are core to both threat intelligence data and Threat Intelligence Platforms. ThreatConnect is not a Threat Intelligence provider, in that we do not sell data to our customers. Instead, our software uses open and premium data from some of the best Threat Intelligence providers in the market. Our priority is creating a Threat Intelligence Platform that allows users to make sense of the data and what it means for a specific organization. There is no corporate interest in “one upping” anyone in an old school “my Threat Intel can beat up your Threat Intel” footrace. We focus on delivering quality software that simplifies the production and usage of threat intelligence within the enterprise.

Organizations that are making investments in threat intelligence should not get distracted by numbers of indicators provided within the solution they are evaluating. Without quality indicators, and more importantly, some way of making sense of them, adding more is not going to help. The most valuable indicators are those that are most relevant to your organization. The ability to determine relevance of indicators comes from understanding the data from within your own network. As a matter of fact, often the most valuable indicators come from intelligence gleaned from your own network’s activity and past incidents. Another typically highly relevant source of intelligence comes from collaboration with others – both internal and external through industry communities and other trusted groups. Combine this with the use of external sources that can enrich your understanding of the how, why, and who of an attack pattern, and you have a much clearer picture of the threat and a more sophisticated level of understanding threat intelligence. Although some organizations can do this by hand, it is an arduous process. The best approach is to use a Threat Intelligence Platform to aggregate, analyze, and act in support of threat intelligence driven security operations.

We look forward to discussing the value of a Threat Intelligence Platform, and the benefits of having a platform to understand and work with quality data during the SANS CTI Summit next week. See you there!

Read the original blog entry...

More Stories By Adam Vincent

Adam is an internationally renowned information security expert and is currently the CEO and a founder at Cyber Squared Inc. He possesses over a decade of experience in programming, network security, penetration testing, cryptography design & cryptanalysis, identity and access control, and a detailed expertise in information security. The culmination of this knowledge has led to the company’s creation of ThreatConnect™, the first-of-its-kind threat intelligence platform. He currently serves as an advisor to multiple security-focused organizations and has provided consultation to numerous businesses ranging from start-ups to governments, Fortune 500 organizations, and top financial institutions. Adam holds an MS in computer science with graduate certifications in computer security and information assurance from George Washington University. Vincent lives in Arlington, VA with his wife, two children, and dog.

IoT & Smart Cities Stories
Charles Araujo is an industry analyst, internationally recognized authority on the Digital Enterprise and author of The Quantum Age of IT: Why Everything You Know About IT is About to Change. As Principal Analyst with Intellyx, he writes, speaks and advises organizations on how to navigate through this time of disruption. He is also the founder of The Institute for Digital Transformation and a sought after keynote speaker. He has been a regular contributor to both InformationWeek and CIO Insight...
Bill Schmarzo, Tech Chair of "Big Data | Analytics" of upcoming CloudEXPO | DXWorldEXPO New York (November 12-13, 2018, New York City) today announced the outline and schedule of the track. "The track has been designed in experience/degree order," said Schmarzo. "So, that folks who attend the entire track can leave the conference with some of the skills necessary to get their work done when they get back to their offices. It actually ties back to some work that I'm doing at the University of ...
DXWorldEXPO LLC, the producer of the world's most influential technology conferences and trade shows has announced the 22nd International CloudEXPO | DXWorldEXPO "Early Bird Registration" is now open. Register for Full Conference "Gold Pass" ▸ Here (Expo Hall ▸ Here)
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
The best way to leverage your Cloud Expo presence as a sponsor and exhibitor is to plan your news announcements around our events. The press covering Cloud Expo and @ThingsExpo will have access to these releases and will amplify your news announcements. More than two dozen Cloud companies either set deals at our shows or have announced their mergers and acquisitions at Cloud Expo. Product announcements during our show provide your company with the most reach through our targeted audiences.
The Internet of Things will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform and how we integrate our thinking to solve complicated problems. In his session at 19th Cloud Expo, Craig Sproule, CEO of Metavine, demonstrated how to move beyond today's coding paradigm and sh...
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time t...
What are the new priorities for the connected business? First: businesses need to think differently about the types of connections they will need to make – these span well beyond the traditional app to app into more modern forms of integration including SaaS integrations, mobile integrations, APIs, device integration and Big Data integration. It’s important these are unified together vs. doing them all piecemeal. Second, these types of connections need to be simple to design, adapt and configure...
Cell networks have the advantage of long-range communications, reaching an estimated 90% of the world. But cell networks such as 2G, 3G and LTE consume lots of power and were designed for connecting people. They are not optimized for low- or battery-powered devices or for IoT applications with infrequently transmitted data. Cell IoT modules that support narrow-band IoT and 4G cell networks will enable cell connectivity, device management, and app enablement for low-power wide-area network IoT. B...
Contextual Analytics of various threat data provides a deeper understanding of a given threat and enables identification of unknown threat vectors. In his session at @ThingsExpo, David Dufour, Head of Security Architecture, IoT, Webroot, Inc., discussed how through the use of Big Data analytics and deep data correlation across different threat types, it is possible to gain a better understanding of where, how and to what level of danger a malicious actor poses to an organization, and to determin...