How to make use of Cyber Threat Intellegence?

Cyber Threat Intelligence (CTI) is about understanding and dealing with online threats. It's different from just collecting data about these threats. CTI takes this data, analyzes it, and uses it to answer specific questions or meet certain goals. This helps a company defend itself better against online attacks. Here are some of the things that CTI can include:

• Signs of a compromise, like patterns in harmful files.
• Details about how an attacker operates, like their goals, methods, tools, and strategies.
• Alerts about security risks and vulnerabilities.
• Suggestions for how to detect and stop an attack.
• Findings from analyzing attacks or vulnerabilities.

Sharing CTI is a great way for cybersecurity pros to pool their knowledge. It can help with decision-making in different areas of cybersecurity. When companies share their CTI, they can learn about new threats and prepare for them. It's hard for one company to know about all the threats out there on its own, so sharing info with others really helps. Plus, by sharing what they know, companies can help make the whole community safer. Sharing CTI can also help everyone understand an attacker's methods better, which can lead to stronger defenses and detection methods. Lastly, shared CTI can help with deciding how to use technology, controls, and resources.

So, how do we share CTI?

There are two main ways: the traditional way (like email or messaging), or through automated platforms and security systems. Sharing needs to be timely, include context, and come from a trusted source. Companies can choose which groups to join based on what info they need. There are lots of CTI-sharing groups out there, each with a different focus.

Some groups, like the Advanced Cyber Security Center, share across many sectors. They often have a broad membership and distribute info through trainings, discussions, papers, news, and alerts. These groups can be more casual, with members mostly just taking in info.

Others, like the CTA, focus on one industry. These groups often have more in common and sometimes even use each other's data. Joining can be more selective and may require members to share their own info and keep up certain technical capabilities.

Then there are platforms run by software vendors, like IBM X-Force Exchange. These groups charge a fee and collect info from their users and other open sources. They mainly focus on signs of compromise.

Lastly, there are government-led groups, like CISCP and InfraGard. These groups aim to boost cybersecurity in certain areas or promote cooperation between public and private sectors. They often have more resources and rules, but they can also be heavily influenced by government interests.