2 Popular Cyber Threat Intelligence Feeds and Sources

Threat intelligence feeds are an actionable threat data associated with indicators or artifacts gathered from third-party vendors to learn from the access and visibility of other organizations to improve your own cybersecurity threat awareness and response. Threat intelligence feeds and sources must be applied alongside your technical controls, so you can prevent cyberattacks.

What is threat intelligence in cybersecurity?

Cyber threat intelligence is the information applied by organizations to understand future, past, and current threats more fully. Threat intelligence provides the context necessary for cybersecurity experts to make informed decisions regarding your network security, particularly after an attack.

Although cyber threat intelligence is not a panacea for cyberattacks, however, creating one is critical. Having a working knowledge of cybersecurity threats will make you better equipped to design and implement an efficient plan for securing your systems and networks.

In the evolving world of technology and the ever-increasing specter of cybersecurity threats, an organization’s defense mechanisms are incompetent and insufficient to prevent these attacks. Thus, demands a structured approach and a skilled team of analysist for building a successful threat intelligence program.

What are cyber threat intelligence feeds and sources?

Threat intelligence feeds cover incessant streams of real-life threat data, including IoCs (the Indicators of Compromise). However, they are more than just continuously updated feeds that offer data or external information on potential or existing threats, vulnerabilities, and risks.

As stated earlier, threat intelligence feeds often consist of simple indicators or artifacts. There are practical differences that differentiate feeds from each other. Usually, individual feeds focus on an aspect. A feed might portray a stream of code shared on pastebins, suspicious domains, IP addresses connected to malicious processes, or lists of known malware hashes.

While data, information, and intelligence are often used interchangeably, they form the difference between threat intelligence feeds. Even though these feeds are referred to as “intelligence” feeds, the majority is made up of data or information, instead of just a curated intelligence. Additionally, while feeds can be obtained, an organization must first recognize its threat intelligence feeds requirements before proceeding.

Why is a cyber threat intelligence feed important?

There is no doubt that cyber threat intelligence is a valuable investment for any organization. It is extremely important to tackle malware and cybersecurity threats as speedily as possible because the longer these threats are left unattended, the easier they can lead to an issue, and the greater their impacts.

Having access to the correct security information that you can feed into your security systems such as SIEMS and UEBA (user and entity behavior analytics) helps you apply automated security controls, analyze the data in real-time, and automate comparison of feed entries with internal telemetrics, including DNS logs and firewalls. This will save you time and eliminate the hazard of human failure.

A solid threat intelligence framework merges massive feeds into a single feed, instead of looking into each feed individually. However, one of the most important aspects of threat intelligence feed for an organization is the maintenance of a database consisting of past incidents and threats, alongside the competence to realize better counter-threat recognition and prevention.

What are the sources of security threats?

Different sources of a threat intelligence feed each has its individual advantages and disadvantages. With almost every security vendor website offering information and data on the newest threats, organizations need to be thorough in selecting the sources of their security threats.

Nevertheless, there are two broad categories of threat intelligence feeds, which include private intelligence feed and public threat intelligence feeds.

Private threat intelligence feeds

These feeds are usually paid for and obtained from third-party security vendors. They are usually generated from the internal team of an organization. Most of the significant sources for governmental cyber threat analysis are obtained from here.

Public threat intelligence feeds

These feeds are usually made available to the public over the internet. Examples of public sources for threat intelligence feeds are:

◉ Open source threat intelligence feeds

◉ Commercial source feeds

◉ Government source feeds

◉ Social listening

◉ Further monitoring using Pastebin

◉ Internal Sensors

Open-Source Intelligence (OSINT)

OSINT feeds and intelligence sources are widely used frameworks by cyber intelligence analysts, penetration testers, or bug bounty hunters for performing cybersecurity reconnaissance. Open source threat intelligence projects collect data from IT sources and the open-source community to deliver available and continuously updated feeds.

Likewise, some of the feeds made available by the government and other independent research institutions, typically fall under the open-source feeds. Although not every feed offered are frequently updated. Neither are they suitable when it comes to actively feeding your SIEM.

Pastebins

These are referred to as an information repository and mostly used by coders and developers. Pastebins are repertories where text can be copied and pasted. The information posted can be viewed by anyone except those flagged as private.

Social Listening

This feed gathers information from social media platforms such as LinkedIn, Twitter, and Facebook. When it comes to sharing live feeds, Twitter has been the go-to site for most people. In fact, you can follow twitter profiles for revised information regarding certain feeds.

Source: eccouncil.org