Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuideOne of the main ways in which good threat intelligence can add value to cybersecurity monitoring is by providing additional context to help the security analysteffectively triage and investigate events to accurately identify genuine positives andunderstand the true nature and extent of the business risk posed.Segregating threat data, news and intelligenceWorkshop participants agreed that it was important to distinguish the difference between threat data, news andintelligence, when carrying out cyber security monitoring, as shown in the table below.Threat information type Examples Related phaseThreat data• Suspect IP addressesFUSION• Known bad endpointsThreat newsThreat intelligence• General awareness (eg. knowing there is anew attack type)• Analysis of impact of above on a business• So what if it happens?ANALYSISANALYSIS“Buyer beware – that’s news, not intelligence”A good supplier can help you move beyond ‘passive detection monitoring’ to includedetermining how to obtain intelligence, rather than just news about events.Your organisation should therefore be asking itself:1. What is the intelligence being provided (and where did it come from)?2. What does it actually mean to our organisation?3. What should we do with this intelligence – how do we use it in our organisation?“Threat intelligence is only as good as the quality, relevance and completeness of the data provided”32