SOAPA Video with Arbor Networks (Part 2)

In the second part of my SOAPA video with Arabella Hallawell from Arbor Networks, we discuss:

  1. SOAPA technology integration. Arbor Networks partners with lots of network service providers, giving the company a bird’s eye view of Internet traffic. The company uses this position to monitor, collect, and curate threat intelligence through its ASERT team. As part of its network security analytics products and services, it adds CTI to give customers an understanding of malicious activities happening inside and outside of their networks. Of course, integrating internal network telemetry and CTI is one of the principles of SOAPA. 
Topics: Cybersecurity security operations cyber threat intelligence network security analytics SOAPA Arbor Networks Arabella Hallawell

Toward Strategic and Proactive Threat Intelligence Programs

In 2015, ESG did an in-depth research project on cyber threat intelligence usage at enterprise organizations (i.e., more than 1,000 employees). The goal of this project was to determine how large firms were using threat intelligence, what challenges they faced, how they were addressing these challenges, and what their strategies were moving forward.

  • The research revealed that many threat intelligence programs were relatively immature – 40% of threat intelligence programs had been in place less than 2 years at that time. Cybersecurity professionals were also asked to identify the top objectives for their organization’s threat intelligence program. The top results were as follows:
Topics: Cybersecurity threat intelligence TAXII STIX cyber threat intelligence ISAC

Confusion Persists around Cyber Threat Intelligence for Enterprises

Over the last few months, I’ve talked to a number of CISOs and security analytics professionals about threat intelligence as I’m about to dig into this topic with some primary research. 

One of the things I’ve learned is that large enterprises are consuming lots of open source and commercial threat intelligence feeds. In some cases, these feeds are discrete services from vendors like iSight Partners, Norse, or Vorstack. Alternatively, they also purchase threat intelligence along with products from security vendors like Blue Coat, Check Point, Cisco, FireEye, Fortinet, IBM, McAfee, Palo Alto Networks, Symantec, Trend Micro, Webroot, and a cast of a thousand others. 

Topics: Cybersecurity cyber threat intelligence CISA