You’re looking for a threat intelligence platform. What are the most important features to consider?

Determine what % of the data is from public feeds and which % is actually T.I. made by the vendor. T.I. is more than just aggregating feeds from the web.

Diversity of sources from global to local threat actors. It is important to use different providers that offer different unique sources e.g darkweb research vs jurisdiction threat actors vs industry intel from incidents disclosure. Attackers repeat the same techniques.

A comprehensive threat intelligence platform should prioritize integration with diverse data sources, including open-source feeds and dark web monitoring, while supporting seamless integration with security tools. Advanced analytics, leveraging machine learning, is crucial for real-time threat detection, enhancing accuracy by correlating indicators of compromise and contextual information.

It's all about the sources. Without good sources, you won't have good TI. If the vendor won't tell you what their sources are... then avoid them. Lots of snake oil available...

When selecting a threat intelligence platform, prioritize features that align with your specific needs. Look for comprehensive data sources, including dark web monitoring and industry-specific feeds. Prioritize real-time threat detection capabilities and customizable alerts to stay ahead of emerging threats. Integration with existing security infrastructure is crucial for seamless collaboration. A user-friendly interface facilitates efficient analysis, while automation and machine learning enhance threat identification. Ensure scalability to consider platforms with robust reporting functionalities. Lastly, factor in the platform's reputation, support services, and the ability to adapt to evolving threat landscapes for a well-rounded choice.

The TIP should seamlessly integrate with existing security infrastructure, such as SIEMs, firewalls, and endpoint protection systems. Look for platforms that offer automation of routine tasks, such as data ingestion, correlation, and incident response. Automation helps in handling a large volume of data efficiently.

1) TIP is the cornerstone for securing the network/systems. It provides the intelligence and ensures that all mitigations/vulnerabilities are effectively managed 2) The integration of TIP with all systems - devices, public facing OS creates optimum alerting and response mechanisms. This ensures SOC team can respond to threats efficiently 3) TIP is what provides eyes to the business against threat actors across the Internet.

Integration and automation are absolutely crucial for security visibility. Sure. But why? Many tools integrate external feeds to identify IOCs and internal targets. This synergy (buzzword alert) allows for a more comprehensive understanding of threats, enabling automated, informed responses. Link with tools like SIEM and EDR/XDR to provide a (more) unified view of data and threat landscapes. Leverage insights from multiple sources to enable these platforms to facilitate rapid, accurate threat detection and response. The final outcome significantly improves an organization's cybersecurity posture and reduces reliance on manual processes.

In a process of evolving the security maturity of environments, it is important that solutions have the greatest amount of information possible, such as IoCs, TTPs and other metrics that can support visibility of an incident or possible incident as quickly as possible. In this type of visibility, integrating and taking automatic actions, as long as the client's architecture is known, will minimize many impacts and ensure that attacks are contained proactively.

It should work fast, having a good looking interface which is slow will just slow down the analyst. The focus should be on getting the needed info directly to the analyst so action can be taken.

Selecting a commercial solution might be an advantage on customization as you can get not just IoCs from activities related to your industry but also threat landscape reports. These are gold as you can use them to identify possible gaps in your environment such as preventive and detective controls. I used those reports to get a sense of common attacks happening within my industry, then reviewing my SIEM rules and identifying gaps on my SOC, either by not having specific log sources integrated or by identifying new rules to detect those possible threats.

Feature requests should be possible. Cyber security is a journey and when choosing a vendor or service, you need to be sure that they will join the fight against cybercrime with you. Not just sales, but actual impact.

The ability to request features should be available. Cybersecurity is an ongoing process, and when selecting a provider or service, it is important to ensure that they actively stand by your side in the fight against cybercrime. It's not just about sales, but about real effectiveness. Choose a partner like Sophos, who is characterized by continuous innovation and adaptability to new threats, thus offering real impact in the fight against cybercrime.

While competitive pricing and tiered options are attractive, remember, the costliest platform won't be valuable if it's not a perfect fit for your security needs. Prioritize features that align with your threat landscape, industry, and team size. Consider the cost savings a TIP can unlock: faster incident response, reduced remediation time, and better resource allocation. Analyze if the platform's data sources, threat analysis capabilities, and automation potential outweigh the price tag. Choose a TIP that empowers your team to make informed decisions and stay ahead of adversaries, because real value lies in a safer, more resilient organization.

An assessment on a TIP provides might be as easy as you can think. Create a matrix to compare vendors and rate from your requirements what the vendor offer (for example 0 as "not met" to 3 as "exceeded expectations"). By the end of this analysis, you should get final scores and definition of first, second and third places. Then, compare prices and check differences; if for example price difference from second place is below 10%, than you might consider going with second place unless they are not able to deliver a key requirement.

When selecting a threat intelligence platform, prioritize one that offers comprehensive, real-time data collection from a wide range of sources, ensuring a broad view of potential threats. Look for advanced analytics capabilities that can process and correlate large volumes of data to identify trends and provide actionable insights. Ensure the platform integrates well with your existing security infrastructure and offers user-friendly interfaces and customizable alerting systems to facilitate efficient threat response and management.

it's crucial to evaluate the platform's accuracy and relevance of threat intelligence, the quality of analytics and machine learning capabilities, support for regulatory compliance requirements, and the provider's reputation and track record in the cybersecurity industry. Integration with threat intelligence sharing communities and the platform's ability to adapt to evolving threat landscapes are also essential considerations.

For a CISO, I think effective operationalisation of integrated Threat-Intel Platform is crucial for proactively steering strategic initiatives. The selection of suitable TI becomes imperative, depending on the organisation's risk tolerance and attack surface, in order to safeguard the status-quo. While ELINT & OSINT may suffice for many, adept hunters necessitate SIGINT & HUMINT based on tactical requirements. Furthermore, placing a strong emphasis on the quality of actionable intel during the search for the proverbial needle in the haystack is paramount. This not only involves scouring DarkWeb forums but also monitoring IRC rooms and gaining entry to exclusive forums and auction halls.