by clicking on the page. A slider will appear, allowing you to adjust your zoom level. Return to the original size by clicking on the page again.
the page around when zoomed in by dragging it.
the zoom using the slider on the top right.
by clicking on the zoomed-in page.
by entering text in the search field and click on "In This Issue" or "All Issues" to search the current issue or the archive of back issues respectively.
by clicking on thumbnails to select pages, and then press the print button.
this publication and page.
displays a table of sections with thumbnails and descriptions.
displays thumbnails of every page in the issue. Click on a page to jump.
allows you to browse through every available issue.
GCN : April 2015
IN TODAY’S WORLD of ongoing data breach cycles, federal agencies struggle to keep up with the threats that loom over systems that hold sensitive data – everything from personally identifiable information and protected health information to design plans for the latest stealth aircraft. The problem is now receiv- ing attention at the highest levels of government. For some time now, the White House has considered the idea of a federal government-led fusion center for coordinating threat intelligence, but it only recently became official when the White House announced the formation of the Cyber Threat Intelligence Integra- tion Center. So how can organizations provide actionable threat intelligence in an effective and efficient manner? First, it’s important to accu- rately understanding the term “threat intelligence.” Threat (as defined by NIST) is any circumstance with the potential to adversely affect organizational operations and assets, individuals, other organizations or the nation through an information system via unauthorized ac- cess, destruction, disclosure, modification of information and/or denial of service. Intelligence (as defined by the FBI) is information that has been analyzed and refined so that it is useful to policy- makers in making decisions – specifically, decisions about potential threats to national security. Taking these definitions into account, it’s clear that sources of threat information are found in a variety of places both internal and external to an organization – and cer- tainly not limited to technical sources such as network moni- toring logs, firewalls, intru- sion detection and prevention systems, malware analysis tools, honeypots, phishing traps and so on. The phrase “any circum- stance or event” could also mean heightened activity on a Dark Web forum (the deepest, darkest parts of the Internet where underground cyber criminals discuss and conduct illegal activity), a post on so- cial media or an attack against a government ally in a differ- ent part of the world. Just these few examples show how much work is required to sift through all of these data sources. So where should agency personnel begin in identifying data sources that will result in actionable threat intelligence? Some potential sources exist in the existing IT environ- ment: Local data logs: Review system logs, packet captures, malware, incident data, local honeypots, IP addresses that “phone home” to command and control servers operated by the criminals. Hard drives: Perform forensic analysis on infected machines, looking for attack patterns, targeted files and data. Logical/physical access system logs: Analyze login attempts, check swipe access logs into the datacenter or server room – wherever the most sensitive data resides. Look for odd or unusual pat- terns in both. Performing analysis on this magnitude of data is no small task. As a result, IT managers need to develop a solid data analysis strategy that incorpo- rates people, processes and, most definitely, technology. Automation is absolutely para- mount when dealing with this volume of data. The following high-level outline provides a simple starting point: • Conduct a risk assess- ment based upon the agency mission. • Identify the threats that pose the most danger to the mission. Who wants the data? Why? Consider both insider and outsider threats. • After compiling a good list of potential threats, assess their capability and intent. A disgruntled user who was just fired may want to exact revenge but may be limited in capability. A system adminis- trator in the same scenario has both capability and intent. • Take inventory of the data sources of threat information needed to help identify the biggest threats to the agency. • Go one step further and determine how many of those data sources can be compiled by individual staff members and which others require additional effort in order to collect data. For example, does the current service- level agreement (SLA) with the agency’s cloud service provider allow the IT manager access to logs that may hold data critical to help track down attackers? Finally, the key to identify- ing threats is to start planning now. Time is the most valuable asset in the event of an attack. Once a system is breached, there’s no turning back the clock. Agencies must rely on thorough preparation and analysis of threats in order to stay one step ahead of the attackers. • — Dan Waddell is (ISC)2 Di- rector of Government Affairs and EWB member and lead author of this peer-reviewed article. The key to identifying threats is to start planning now. Once a system is breached, there’s no turning back the clock. JUNIT BY (ISC)2 ADVISORY BOARD EXECUTIVE WRITERS BUREAU, DAN WADDELL INDUSTRY INSIGHT Where to find actionable threat intelligence GCN APRIL 2015 • GCN.COM 19 0415gcn_019.indd 19 4/1/15 9:38 AM