With cyber-attacks on the rise and organizations looking for more effective ways to fend off malicious actors, cyber threat intelligence has emerged as a buzzword in cybersecurity. Unfortunately, some of the information being marketed as cyber threat intelligence isn’t backed up by much actual intelligence; rather, it’s just another threat feed to be added to the already large pile of data that needs to be evaluated.
Part of the problem with good threat intelligence, I recently wrote, is that it’s time consuming. Effective cyber threat intelligence shouldn’t just add to the ever-growing list of concerns facing your organization, it should provide actionable insight into how to best focus security resources to achieve solutions. Evaluating those specific threats, determining their relevance and coming up with practical solutions unique to your organization is hard work.
There are many ways to evaluate threats, but I tend to revert to my Navy training when thinking about the cybersecurity of our customers. Our rules of engagement dictated evaluating threats from three avenues: the capability, intent and opportunity to cause harm.
Taken individually, each has seen an overall increase over the past few years. Taken together, the add up to what Europol recently characterized as the relentless growth of cybercrime.
Let’s briefly take a look at each pillar:
- Capability of Threat Actors: As SurfWatch Labs noted in its recent report, officials have estimated that the bulk of the cybercrime-as-a-service economy may be powered by as few as 200 individuals, yet those services can put sophisticated cybercrime tools at the fingertips of a vast pool of actors. Europol agreed, writing in its report that “the boundaries between cybercriminals, Advanced Persistent Threat (APT) style actors and other groups continue to blur.” Clearly the capability of threat actors continues to evolve, putting more organizations at higher risk.
- Intent of Threat Actors: Cybercrime tends to be driven by either profit or the desire to cause harm to an organization. The growth of dark web marketplaces, the widespread adoption of successful tactics such as ransomware, and the increased focus on cybercrime by the media, government officials and regulators has widened actors’ abilities to monetize cybercrime and directly impact an organization’s brand and bottom line.
- Opportunity for Threat Actors: A recent study found that 89 third-party vendors access a typical company’s IT system each week. In addition, the technology footprint of organizations continues to grow as more as-a-service solutions are implemented to increase productivity and more digital services are offered to customers. This provides threat actors with an expanding number of avenues that can be exploited — some of which are not directly under your control.
Despite this widely reported growth in the capability, intent and opportunity of threat actors, many individuals still feel as though they will never be targeted. A study released last month from the National Institute of Standards and Technology found that many people still hold the view that cybercrime will never happen to them and that data security is someone else’s responsibility. People feel overwhelmed by cyber threats, and as a result, they engage in risky behavior.
Simplifying Security, Control What You Can Control
The good news is that out of those three aspects used to evaluate cyber threats, organizations essentially have control over only one: opportunity. The capability and intent of threat actors are largely external to your organization; however, a real and measurable impact can be made when it comes to limiting the opportunities for cyber-attacks.
Unfortunately, many organizations have not done enough to close the opportunity window on cyber-attacks. That was a central theme of SurfWatch Labs mid-year report: despite claims of “sophisticated” attacks, the bulk of cybercrime observed has exploited well-known attack vectors. Europol’s September report also found that organizations were not helping themselves — in many cases providing ample opportunity for cybercriminals to exploit.
“A large part of the problem relates to poor digital security standards and practice by businesses and individuals,” Europol noted. “A significant proportion of cybercrime activity still involves the continuous recycling of relatively old techniques, security solutions for which are available but not widely adopted.”
This brings us back to the importance of evaluated cyber threat intelligence. Cyber threat intelligence should directly address that opportunity and provide solutions to close — or at least to severely limit — cybercriminal avenues of attack. What vulnerabilities are being actively exploited in your industry? What social engineering techniques are being leveraged in similar campaigns? How are threat actors monetizing the information and what is the potential impact if our organization faces a similar breach?
The answers to questions like these are a large part of the hard work that is the intelligence portion of cyber threat intelligence. Those answers can help to shine a light on paths that may significantly reduce your organization’s potential cyber risk.
Cyber threat intelligence, if done right, can help to limit the opportunity for threat actors to cause harm. This renders their capability less capable and their intent harder to pull off — at least against your organization.
Share this:
SurfWatch Labs, Inc. 
One thought on “Controlling What You Can Control: Using the Threat Triangle to Gain Focus”