Elements of Optimized Security: Global Threat Intelligence

I recently gave a brief overview of McAfee’s maturity model for enterprise security and the path to achieving optimized security. Over the next few posts, I’ll take you through the fundamental elements of optimized security, starting with something we take very seriously here at McAfee – Global Threat Intelligence.

Generally speaking, threat intelligence provides dynamic, frequently updated threat detection information to be utilized by all any and all of your deployed security solutions. Global Threat Intelligence, however, takes reactive threat intelligence and makes it predictive.

Here we take a look at the 6 Tenets of Global Threat Intelligence (GTI):

• Multiple sensors spanning the Internet: To truly have ‘Global’ Threat Intelligence, you must have sensors spanning the Internet across the globe. This enables you to have a complete, real-time, threat view of the entire Internet. Because content enters the Internet from transit points around the world, early detection makes it critical to be as close to all of these entry points as possible. A global footprint means you can see what is happening everywhere, not just in pockets, a single geography, or a limited set of languages.
• Covers all key threat vectors (file, web, email, network): ‘Global’ also means that your intelligence is coming from and correlated across all key threat vectors, or channels over which threats can be delivered – file, web, email, and network. By combining content analysis from these primary threat vectors, you can mirror the multi-dimensional nature of today’s threats, better protecting yourself against attack.  We’ve all seen phishing emails with embedded malicious files – think about what value that could provide to outbound web and anti-malware protection.
• Real-time, cloud-based threat intelligence & distribution: Attacks are happening all the time. We know this without a doubt. Real-time, in-the-cloud threat intelligence means data collection is constant and intelligence is delivered non-stop. If you can’t get and return information in real-time, you can’t deliver the protection required by today’s threats. Period. This is also very important for providing protection to mobile and remote users outside the security of the enterprise networks.
• Integrated content & reputation analysis: This is really where threat intelligence goes from reactive to predictive. Reactive threat intelligence often relies on a blacklist or white list approach, where samples are “known good” or “known bad.” Reputation, however, adds a probabilistic score that specifies the ever-changing risk posed by an Internet identity. With a reputation score, products can enforce policy decisions instantly. Since reputation is perpetually changing, it helps content assessments keep pace with threats.
• Dedicated research team: People are fundamentally important to overall threat intelligence. Attacks originate everywhere – not just at your corporate HQ. Its important to have a distributed, dedicated team of professionals who can address and respond to threats and who are constantly learning about the latest technologies and techniques. Most companies can house their own dedicated research team, so at the very least, you should expect your vendor to.
• Integration with all security products: What good is threat intelligence if it only serves one product? Threat intelligence needs to be shared across your entire security program, so that each solution can be effective in its own context, but also in concert with your other tools. Multiple touch points must update simultaneously to counter multi-pronged threats.

In today’s fast moving and highly dynamic threat environment, the quality of threat intelligence and insight is critical to a successful security program. You need to not only be able to see what is happening across your organization, but also to act on that intelligence quickly and effectively. Gaining Global Threat Intelligence like what I’ve outlined above is just one step in creating an optimized security architecture.

In my next post, I’ll talk about the role of multi-layered defenses in building an optimized security program.

Tags: Data Protection, global threat intelligence, Risk and Compliance, security