What and why Cyber Threat Intelligence

What and why Cyber Threat Intelligence.

When we say intelligence, we are dealing with information while cyber threat is the possibility of a malicious attempt to damage or disrupt a computer network or system.

With the above definitions, we can say that in cyber threat intelligence is about gathering of information that could possibly harm computer network or system.

Similarly to Human Intelligence (HUMINT) and Open Source Intelligence (OSINT), a good source of information often comes from the community and just about 10 to 20% of it is from internal or from the agent himself. Although reliability of this information vary from source to source, it is still beneficial to include this information for processing and analysis.

So, why the need for CTI?

Know what’s coming and prepare for it. The capability to identify threats that may come to your organization is important for an efficient decision for enhanced security and threat response. Relevant and timely threat intelligence can help organization stays updated one step ahead of the threat as these threats are constantly evolving because of cyber criminal’s motivation that drives them to develop sophisticated attacks for their gains and cause.

Everyone is at risk on cyber attacks no matter the size of your organization is, but with a well CTI, it helps your security team to monitor and detect malicious activity on your network and be updated to the latest threats. CTI is not the only one and all solution but perhaps it can serve as the basis for making good decision to provide a quality cyber security.

The lack of utilization of intelligence can lead to a future crisis. Now that you have an idea of what is cyber threat intelligence and an overview of how it can help your organization, what will be your excuse for not implementing it. Cyber threat intelligence is the future of cyber security, and that future has already started in the past and keeps moving forward, don’t get left behind, catch up. Now!

For more info and references:

https://ics-cert.us-cert.gov/content/cyber-threat-source-descriptions

https://www.helpnetsecurity.com/2015/05/19/the-importance-of-good-threat-intelligence/

https://www.upwork.com/hiring/for-clients/what-is-cyber-threat-intelligence/

Comments

Install Snort IDS in Windows

Install Snort IDS in Windows In this article, we are going to install Snort on windows, perform basic configuration then add snort rules. Snort can also be configured as an intrusion prevention system, but in our case, we will just configure snort as an IDS. Carry out the following steps Download and install Snort and Winpcap Download snort rules Configure snort.conf file Run snort that displays alert on console Run snort that saves alert to a file ============================================================= Step 1: Note: Install snort and winpcap as an administrator. Download winpcap https://www.winpcap.org/ and install it as an administrator, just let it install with default settings. Restart your computer. Download snort installer exe at https://www.snort.org/downloads and install it as an administrator, just choose defaults configuration where you only have to click “I Agree”, “Next” , “Next” , “Next”, “Close” and “Ok”. ==============...

Mapping the cyber security world with GIS

Using GIS software to develop a cyber map for analysis of cyber attacks globally helps IT security understand cyber world and to identify vulnerabilities in cyber networks which allow security teams to prioritize their work and solve areas with the potential to do the most damage first. Below are some cyber map images develop with GIS software. The accuracy of the data is not guaranteed and mostly referenced to the work of Cyber Security Insides on the following link. https://www.cybersecurity-insiders.com/list-of-countries-which-are-most-vulnerable-to-cyber-attacks/ http://gis.usc.edu/blog/gis-and-cybersecurity/

Analyzing windows event log for malicious activity

What is windows event log? Windows event log is a record of a computer's alerts and notifications such as errors, warning and other information. There are a lot of System Information and Event Management (SIEM) tools out there that collects and analyzes logs and monitors for security threats, these softwares offers many advance and somewhat features. In this article, we are going to explore windows event viewer to perform a simple security analysis and create a simple custom view for monitoring. We are going to use the following event ID 4672 - Special privileges assigned to new logon. This event lets you know whenever an account assigned any "administrator equivalent" user rights logs on. There are reasons why we need to monitor for such event, we usually give our employees a standard user rights and hackers can perform privilege escalation (e.i. Metaspoit’s meterpreter script getsystem that will use a number of different techniques to attempt to...

intelsecuretech

Search This Blog