logo

Enhancing detection efficacy with Cyber Threat intelligence (CTI)

Writent by

Published On

Enhancing detection efficacy with Cyber Threat intelligence (CTI)

What is Cyber Threat Intelligence?

Cyber Threat Intelligence is based on the collection of intelligence using open source intelligence (OSINT), social media intelligence (SOCMINT), human Intelligence (HUMINT),technical intelligence or intelligence from the deep and dark web.

Why is Cyber Threat Intelligence required?

While the security has been evolved over the last 2 decade’s, the attack surface as well as the attackers tactics has changed. We all have realized how the signature-based detections are diminishing or adding less value to security. Today’s attackers are more sophisticated and well-funded. They can easily alter and deliver the same attack by changing the malware / exploits. CTI focuses more on detecting the tactics, techniques and procedures (TTP’s) rather than the malware and helps to enhance the efficacy of detection

Our Experience with CTI:

We at SiteWALL, have deployed a multi-layer detection approach for our Intelligence Adaptive Web Application FireWall. We have a blend of detection technology which includes signature based detection, virtual patching for Zero day vulnerabilities and Cyber Threat Intelligence. Our last month’s stats clearly shows 74% of the attacks are blocked by the Threat Intel

While the commercial Threat intelligence provides you more accurate data feeds, there are plenty of free threat intelligence available. We have tested a few open source threat intelligence like Collective Intelligence network security , fireHOL, etc and were amazed by the efficacy of the detection. We also encountered a very acceptable false positive rate.

If you are interested in testing more then you should definitely start here

CTI provides you various data feeds such as IP address, domain names, URLs etc and TTP’s of the attacker. You should integrate CTI with all your major security solutions. Most / All security solutions including Firewall / SIEM supports integration with 3 rd party CTI’s. This can be easily achieved without the need of in-house security analysts.

Conclusion : You alone cannot defend the battle against cyber-attacks, CTI helps you proactively block the threats in the wild. It enhances the security efficacy of your security solution without causing any performance degradation as well as false positive with the proper selection of CTI.

Do share with us your experience with CTI.  Any specific use case you have solved?

Want to have a Demo?

Please register.

Post Tags

More Post

Article, News & Post

Recent Post

Read experts perspectives and industry news.

logo

Want to have a Demo?

Please register

Copyright © 2018-2024 PageNTRA Infosec Pvt Ltd. All Right Reserved.