Making Sense of Cyber Threat Intelligence

Posted by on in Prevention
  • Font size: Larger Smaller
  • Hits: 6160
  • Comments
  • Print

The security industry, more than any other industry, feeds on buzzwords to sell. As security breaches make the daily news hitting every industry and organizations of any size, information security managers are continuously looking for the latest silver bullet and solutions to stay ahead of the game. Threat Intelligence is being promoted as the latest silver bullet. Yet many organizations still don't have a gun to fire that bullet, nor the skills to operate one. Threat intelligence is a great thing to pursue and have but like anything in life, it is important to understand what it is and how it can help an organization before jumping to buy the latest trend in the industry.

What is Cyber Threat Intelligence (CTI)

Over the years, intelligence has been defined in many different ways, mostly studied in humans but also is animals and plants. When it comes to cyber security, Forrester Research defines cyber threat intelligence as:

"Details of the motivations, intent, and capabilities of internal and external threat actors. Threat intelligence includes specifics on the tactics, techniques, and procedures of these adversaries. Threat intelligence's primary purpose is to inform business decisions regarding the risks and implications associated with threats"

Other definitions exist from the likes of Gartner and whichever definition we use it is clear that there is a strong distinction between information and intelligence with the latter implying some level of analysis to make the information more useable to the recipient. Raw information itself can be processed intelligently or remain unprocessed and unused. Intelligence is the ability to process raw information in order to make decisions and it requires analysis. Better analysis means better intelligence. CTI is about providing context, i.e. providing meaning to information so that it can be acted upon.

The fundamental assumption of CTI is that the planning, resourcing and execution of an attack is not instantaneous, it does require human intervention and it can take up to years in case of the advanced persistent threats. Organizations can use this time to analyse information and gather intelligence that can be used to understand the tools and techniques used by the attackers and try to interfere with each of the attack phases, overall referred to as the kill chain.
Actionable Intelligence

Threat Intelligence must be actionable, which means it must be possible to use it to affect the various phases of an attack. In order to be actionable, the intelligence has to have the following properties:

  • Timely – It needs to be available in time for it to transformed into actions
  • Accurate – Accuracy is based on the number of false positive alerts or actions obtained from the threat intelligence. The lower the number of false positive, the more accurate the intelligence is
  • Relevant – Relevance is measured in terms of how the intelligence is organized and delivered to ensure it addresses the industry the organizations belongs to and the relevant threats. If you are a telecommunication company, "actionable intelligence" targeting financial institutions will not be so actionable!
  • Tailored – This property refers to the fact that each organization has different security roles with associated responsibilities and different intelligence must be provided to different people to enable them to make the decisions relevant to their role. Three levels of CTI are usually identified, which are Strategic, Tactical and Operational. Providing tactical intelligence to the company board members will not help them make useful strategic decisions!


Unfortunately, along with cloud and advanced persistent threat, the term threat intelligence is currently the most ambiguous and overused term in the security industry, which means different things to different people. Most vendors offer Threat Intelligence feeds from a wide range of sources. However little of such intelligence is actionable primarily failing on the relevance and on not being tailored. Threat intelligence is definitely not a product that companies can buy but rather a process, which turns raw information into actionable information (intelligence) through the use of competent professionals and of course technology. Not every company possesses competent people to develop such process and some may opt to "buy" threat intelligence. Ultimately, threat intelligence must be translated into actions for it to be effective and that requires competence. In short, there is no intelligence without human intervention and simply buying intelligence feeds will not by itself provide you with improved security!

Last modified on
Rate this blog entry:

Silensec CEO, Almerindo Graziano (aka Al) holds an MSc in Electronic Engineering and a PhD in mobile computer security, both from the University of Naples, Italy. For five years he also been the founder and course Leader for the MSc in Information Systems Security at Sheffield Hallam University, in collaboration with the British Standard Institution (BSI). He has personally authored a number of training courses from ethical hacking to intrusion detection, along with the first ISO27001 Lead Implementer certification course offered by BSI worldwide. He has consulted in formation security for private and government organizations across Europe, Africa and Middle East. Al is passionate about information security at 360 degrees but his heart beats a little faster when talking about IDS, WAFs, SIEM and Log Management technologies incident management and corporate security defence. When he is not working he can be found riding on two wheels either on his mountain bike or motorobike.

blog comments powered by Disqus







  • Address: Eldama Park, Tsavo Wing, 2nd floor, Eldama Ravine Road, Westlands, Nairobi
  • Email:
  • Tel.: +254 (0) 20 8071814