Author: ⁨Enoch Agbu⁩ (Linkedin)

Intelligence is the process of transforming raw data into actionable insights. Threat Intelligence, therefore, refers to the ability to search, gather, analyse, and apply information about imminent or existing cyber threats to avert and respond to them. Simply gathering information from various sources does not constitute intelligence. The true value of 'intelligence' lies in the ability to analyse and map this information to potential threats or attack groups, leading to proactive, actionable insights and decisions.

Open Source Intelligence and Threat Intelligence

Open Source Intelligence (OSINT) involves searching, gathering, and analysing publicly available information from sources such as the dark web, online forums, databases, and social media to extract valuable information. As cyber threats have evolved, so too have the methods used by cybercriminals, including hacktivists, state-sponsored hackers, and insider threats, who now deploy increasingly advanced tactics, techniques, and procedures (TTPs).

To counter these evolving threats, cybersecurity professionals have introduced proactive countermeasures, such as Threat Intelligence (TI) and Domain Intelligence (DI), both of which rely heavily on OSINT. These measures have strengthened organisations' ability to proactively hunt, detect, and counter cyber threats before they occur. This is particularly critical in sectors such as oil and gas, the electric grid, and nuclear power, where a cyberattack could be catastrophic.

The Early Days of Threat Intelligence

In the past, cybersecurity was primarily reactive. Security professionals would respond to cyberattacks only after a breach had occurred, often when significant damage had already been done. While this was the norm in the early days, some organisations still rely on this outdated approach, leaving themselves vulnerable to undetected intrusions and attacks that may go unnoticed for extended periods.

Threat Intelligence in the 1990s

Manual Reporting: In the 1990s, threat intelligence gathering and knowledge sharing were predominantly done manually. Cybersecurity professionals relied on incident reports, government advisories, and traditional news sources like television, magazines, and newspapers. These sources provided intelligence in weekly or monthly reports, which were not real-time, limiting their usefulness in proactively responding to cyberattacks.

Security Logs: Cybersecurity experts would analyse logs from web servers, antivirus software, and firewalls to detect potential threats. While useful, these logs were restricted to an organisation's internal systems and lacked the broader context needed to prevent sophisticated attacks in real-time.

These early methods of gathering and analysing threat intelligence, though useful at the time, would be far too slow and limited to counter the rapidly evolving cyberattacks we see today. In cybersecurity, a lot can happen in just a few minutes or hours.

The Emergence of Automated Threat Intelligence

The development of more advanced cyberattacks, such as malware, Distributed Denial of Service (DDoS) attacks, and the "Ping of Death", underscored the need for more sophisticated methods of threat intelligence. As a result, automated Threat Intelligence Platforms (TIPs) were introduced to allow real-time gathering and sharing of threat data.

Automated Threat Intelligence:

Threat Intelligence Platforms (TIPs): The rise of advanced persistent threats (APTs), botnets, ransomware, and DDoS attacks required cybersecurity professionals to adopt automated tools like Anomali, Malware Information Sharing Platform (MISP), and ThreatConnect. These platforms enable the sharing of Indicators of Compromise (IOCs)—such as malicious IPs, domains, file hashes, and phishing URLs—in real-time, helping organisations stay ahead of emerging threats.

Indicators of Compromise (IOCs) are artefacts that signal a potential security breach or cyberattack within a system. For instance, incoming traffic from an IP address within an internal network range could be a sign of an attack.

STIX/TAXII: Structured Threat Information eXpression (STIX) and Trusted Automated eXchange of Indicator Information (TAXII) are frameworks that facilitate consistent sharing of threat intelligence. They serve as standards used by TIPs to collect, analyse, and share threat data in a uniform manner, enhancing collaboration among organisations.

Threat Hunting

Threat hunting is the proactive search for signs of potential threats before a cyber breach occurs. This process requires gathering threat intelligence and mapping it to specific attack types by analysing the TTPs used or linking it to known threat groups. Effective threat hunting relies heavily on Domain Intelligence and OSINT to gather key insights and stay ahead of attackers.

The Role of OSINT in Threat Intelligence

Publicly available information holds valuable intelligence, and OSINT plays a pivotal role in extracting this data to avert potential cyberattacks. For example:

• Leaked Credentials: Security professionals use OSINT tools to scour the dark and deep web for leaked organisational data being traded or sold. Detecting leaked credentials early can help organisations take steps to protect themselves and their customers before an attack occurs.
• Monitoring Social Media and the Dark Web: OSINT is also used to monitor social media, private forums, and the dark web for signs of pre-planned attacks. Tools such as CrowdTangle, Social Searcher (for social media), DarkOwl, and SpiderFoot (for the dark web) provide actionable threat intelligence to help detect and mitigate threats.

The Future of Threat and Domain Intelligence

As cyber threats continue to evolve, countermeasures must advance in tandem. The future of Threat Intelligence lies in the integration of Machine Learning (ML) and Artificial Intelligence (AI) for predictive threat detection and high-accuracy modelling. These technologies will enhance our ability to identify and neutralise threats before they result in a breach.

OSINT will also play a crucial role in the future of Threat Intelligence. With the vast amount of public data generated daily, OSINT offers invaluable insights that can be analysed for early signs of malicious activity. As this field grows, it will become an even more essential tool for cybersecurity professionals.