By Garrett Carstens, SVP-Intelligence Operations at Intel 471
Research released this year reveals new findings about familiar security issues: There’s too much information to sort through, and a lack of skilled professionals to do it.
Google Cloud’s Threat Intelligence Benchmark surveyed more than 1,500 global IT and cybersecurity leaders, with 61 percent of them indicating there were too many threat-intelligence data feeds, and 60 percent saying they didn’t have enough skilled threat analysts to process and respond to those feeds. Nearly three of five admit their teams struggle to make the data actionable, and they encounter difficulties in verifying the validity and relevancy of threats.
Given the circumstances, 82 percent of these leaders express concerns about missing real threats due to the sheer volume of alerts and data. Yet, even with the issues, they value threat-intelligence programs, with 80 percent either already deploying them or planning to do so.
It’s a classic case of “do more with less.” To further complicate the situation, our own research has found that cyber actors are increasingly employing more sophisticated and stealthier techniques, including launching living off the land (LOTL) attacks, which account for three-quarters of nation-state adversary cyber incidents. LOTL tactics also drive nearly one-half of ransomware and industrial-espionage incidents.
Security leaders and their teams can rise to such challenges more effectively and align their threat intelligence program efforts by using the “intelligence cycle,” a concept that government and military communities have used for decades. At its core, this cycle is about understanding an organization’s most valuable assets and then defining and prioritizing intelligence requirements that will enable their protection.
To help security leaders and their teams achieve this capability, we created the Cyber Underground General Intelligence Requirements (CU-GIRs) framework- a baseline tool designed to organize, prioritize, produce and measure the production of reporting that aligns with priority intelligence requirements, as well as gauge an intelligence team’s value to its organization and stakeholders.
Our CU-GIR approach is inspired by a U.S. Marine Corps (USMC) framework and an Intelligence Community (IC) process. The USMC leverages GIRs to assist human-intelligence collectors in spotting and assessing collection opportunities against common observables they might encounter in the field – whether in an urban environment or mountainous terrain. The IC “prioritization process” involves collating, weighting, scoring and prioritizing intelligence requirements to produce guidance for collectors and analysts in the field, so every requirement is mapped directly to the stakeholder asking for it.
In other words, through the systematic approach of using GIRs and requirement prioritization, everyone knows and can agree with what success looks like, but the next natural question is: how is this all achieved? To meet this industry gap, Intel 471 designed, developed and delivers on a quarterly basis a half-day Intelligence Planning Workshop for cybersecurity professionals. Attendees who are eager to operationalize the General Intelligence Requirements framework and a corresponding process for prioritizing requirements individually and at scale can attend at no cost.
In addition to the training, two resources provided and utilized throughout these workshops include the Cybercrime Underground General Requirements Handbook (CU-GIRH) and the Intelligence Planning Workbook (IPW).
The CU-GIRH, which aligns with the CU-GIR framework, is the baseline tool for enumerating stakeholder requirements; requirements that are eventually used to influence intelligence products. The GIR Handbook has multiple sections including an intelligence planning checklist, a robust cybercrime glossary and hundreds of general intelligence requirements organized within the following seven “parent” requirement categories:
- GIR 1: Malware
- GIR 2: Vulnerabilities & Exploits
- GIR 3: Malicious Infrastructure
- GIR 4: Fraud Identity Theft & Unauthorized Access
- GIR 5: Adversary Tactics & Activities
- GIR 6: Threats Impacting Industry or Region
- GIR 7: Geopolitical Intelligence
The IPW operationalizes the CU-GIR framework by providing an interactive tool that helps with requirement prioritization and resource need assessment through an intuitive user interface.
Given increasing cyber demands, tight budgets and limited skilled resources, cybersecurity professionals can leverage methodologies and frameworks such as the intelligence cycle and CU-GIRs, to help their teams more efficiently and effectively organize and prioritize the onslaught of data. With these tools and a little practice, teams can take command of the seemingly bottomless sea of information, data and feeds- instead of drowning in them.
##
ABOUT THE AUTHOR
Garrett Carstens as the Senior Vice President of Intel Operations at Intel 471 coordinates internal and cross-departmental initiatives focused on optimizing timely and relevant intelligence production and delivery. Prior to joining Intel 471, Garrett spent over 15 years in various roles within the U.S. Department of Defense and the financial sector� always with a primary mission of identifying, analyzing and mitigating cyber threats.
