Cyber Defense eMagazine May 2019

More than a Buzzword: Survey Reveals Cyber Threat
Intelligence Trends
By Corin Imai, Senior Security Advisor, DomainTools
Cyber Threat Intelligence (CTI), the collection and analysis of information about current and potential
cyber-attacks and attempts, has evolved significantly in recent years. The accumulation and research of
cyber threat data across human insights, open source information and technical intelligence from
cybersecurity tools, has reached mainstream adoption, according to according a 2019 Ponemon Report:
The Value of Threat Intelligence from Anomali. Now viewed as a critical resource for enterprise security,
CTI is widely relied upon to inform and develop proactive cybersecurity measures.
With new challenges emerging, improvements in CTI best practices have come at an opportune time. An
ever-changing matrix across commoditized malware, nation-state actors, cyber cold warfare activities,
and a broadening landscape of connected devices that need to be secured, is pulling cybersecurity teams
in a myriad of directions. As cybersecurity technology has advanced, practitioners and experts have
deepened their knowledge on how CTI is collected, shared and used. However, practitioners with relevant
and appropriate expertise, leaves organizations lacking the resources needed to effectively stay ahead
of threat actors. The shortage of skilled cybersecurity practitioners around the globe has never had more
of an impact, according to research from (ISC)2 which discovered 63% of participating organizations are
suffering through a shortage of IT staff dedicated to cybersecurity. Moreover, nearly 60% of respondents
said their companies are at “moderate” or “extreme” risk of cybersecurity attacks as a result of the
shortage.
Given these challenges, strategic use of CTI is critically important. Enterprises are beginning to recognize
this and prioritize threat intelligence. The 2019 EMA Megatrends in Cybersecurity report found that threat
intelligence is an important area of focus for security practitioners in the coming year. In the study, when
asked “which of the following broad security initiatives are driving current priorities in your overall security
program?,” respondents ranked improving threat intelligence among the highest in the ‘expanding’
bucket, at 57 percent, with only 8 percent of companies not prioritizing threat intelligence in some way.
To better understand trends around CTI best practices and how they have changed, the SANS Institute
recently conducted its fifth consecutive Cyber Threat Intelligence Survey. The 2019 results revealed
insights into CTI as a mechanism for cybersecurity detection, prevention and response, and how its use
has evolved alongside the cybersecurity ecosystem.
Strategic Improvements
The survey results were clear that CTI is on an upward trajectory both in the number of organizations
using it and the extent to which it is applied. Seventy two percent of respondents said they are utilizing
76