Security Is Information Warfare — Accelerating Response With Threat Intelligence
One of the most mentioned words today is intelligence. Many think of artificial intelligence in connection with this. However, in the field of information security, intelligence is also often used to mean threat intelligence (TI).
In information security, intelligence refers to the process of collecting and analyzing information and the resulting 'information' itself. This is intelligence used to predict, detect, and defend against cyber threats, and it is not just raw data but information that organizations can use to make practical security decisions. On the other hand, intelligence in AI refers to the ability of machines to learn and reason like humans. These two are different concepts, but over time, they are gradually merging.
What is Threat Intelligence?
Threat intelligence is information derived from the collection and analysis of continuously emerging external cyber threat data, refined for actionable use. Through this, companies can predict and defend against cyber threats in advance. Its effectiveness can be explained through the following three key concepts:
- Learning from others' mistakes: Strengthening security and blocking similar threats by learning from past breach cases and lessons learned
- Heinrich's Law: Identifying minor or potential patterns that repeat before major incidents to detect early warning signals
- Kill Chain Strategy: Preventing damage by breaking the attack chain before an attack occurs
By effectively utilizing threat intelligence, companies can quickly detect security incidents both internally and externally and neutralize attacks before impact based on the collected information. However, manually collecting vast amounts of data, analyzing whether it poses a threat to the company, and applying it to security policies is difficult for an internal security team to handle alone. What is needed at this time is a Threat Intelligence Platform (TIP).
So, what difficulties do security professionals face in the field, and how can threat intelligence solve these issues? Let's explore the concerns of field security personnel and the solutions offered by AhnLab's Threat Intelligence Platform, AhnLab TIP, in a Q&A format.
Q1. It's hard searching for cybersecurity news every morning.
Tracking the daily influx of cybersecurity news in real time to determine if it is from a reliable source and analyzing whether it actually affects the company is a time-consuming task. The constantly repetitive tasks also cause great fatigue for security personnel. AhnLab TIP monitors reliable sources such as security vendors, reports from research institutions, and major media outlets to address this issue, selects important news, and organizes them for easy viewing. All of this information is provided via email and on the AhnLab TIP platform.
Figure 1. News Clippings and Related IoC Information
In addition to news, AhnLab TIP also provides relevant Indicators of Compromise (IoCs). From the customer's perspective, by checking the IoCs related to the news and analysis details, they can assess the impact on the organization. Security personnel can reduce the time spent searching news daily and focus only on threats that require immediate response.
Q2. My work involves a lot of organizing and reporting threat trends every week/month.
Another concern for security personnel is not just collecting threat information but organizing it by type and period and the need to report it in an easily understandable way. Especially in the process of refining it so that even non-experts can easily understand, they feel a significant burden. AhnLab TIP provides threat statistics on malware, network intrusions, and industry-specific situations on a dashboard so that users can grasp trends at a glance. Additionally, threat trend reports are published on a weekly, monthly, and yearly basis. Based on this, security personnel can quickly grasp the latest threat trends and significantly reduce the burden of internal report writing tasks.
Figure 2. Threat Statistics Dashboard
Q3. I need a reliable source for IoCs.
Verified IoCs are essential for utilizing the collected breach incident intelligence and related news to strengthen the company's security. Due to the nature of security, there are many cases where quickly identifying the latest IoCs is necessary, but finding IoCs itself is not easy, and using unverified IoCs can lead to issues like false positives or false negatives. Because of this, quickly obtaining reliable IoCs is extremely important.
AhnLab TIP provides reliable IoCs in real-time, based on over 30 years of accumulated threat analysis expertise, including hash values related to incident reports, malware detection names, behavior information, related regions, files, URLs, and IPs. Among these are AhnLab's unique IoCs that cannot be found elsewhere, including specialized intelligence on Chinese and North Korean threat groups. Through this, security personnel can understand threats more comprehensively and respond proactively.
Figure 3. IoCs and Analysis Details
Additionally, AhnLab TIP supports API integration, allowing customers to quickly incorporate IoCs into the blocklists of internal security equipment like IPS, IDS, and firewalls. Through this, the speed of actual threat response can be greatly enhanced.
Q4. I want to be informed immediately about any new vulnerabilities.
To maintain continuous security within an organization, it is essential to quickly identify new vulnerabilities in all assets in use and prioritize and address them according to their severity. AhnLab TIP compiles and provides publicly available Common Vulnerabilities and Exposures (CVE) information for customers to easily check such vulnerability information and scores.
Figure 4. CVE Information
AhnLab TIP provides vulnerabilities with high severity and impact as security advisories, so users can quickly check them. Vulnerabilities exploited in actual breaches are separately categorized and shared in the form of 'Notes.' Even if they are not the latest vulnerabilities, those that are continuously exploited and can affect specific customers are provided in a separate report. Security personnel can quickly identify the necessary CVE information and use it to patch systems in a timely manner, enhancing security.
Q5. The company next to ours was hacked, and I want to know if we're also at risk.
When a security breach occurs, many companies wonder, "Could we also be exposed to a similar attack?" However, immediately after an attack occurs, access to detailed information is restricted, making it difficult to quickly gather the necessary information. Even if the information is verified, there are many cases where it cannot be practically utilized due to a lack of attack simulation capability. For these reasons, companies struggle to determine if the attack occurred in an environment similar to their own and to establish effective response strategies.
Figure 5. Breach detection rules
AhnLab provides tactics, techniques, and procedures (TTP) analysis reports and detection rules for recent breaches so that customers can quickly respond to similar threats. In AhnLab TIP, customers can also check the status by type of newly registered rules, rule names, and YARA, Snort, Sigma rules. Security personnel can assess the impact of similar attacks and conveniently take action based on this information.
Q6. I'm always worried that our information might be on the dark web.
Leaked information from companies is actively traded on the dark web. However, companies with the specialized capability to access and continuously monitor the dark web are extremely rare. As a result, they experience difficulties in accurately verifying whether data has been leaked and identifying fraudulent or misleading postings. AhnLab TIP offers dark web monitoring as one of its core features to solve these problems.
Figure 6. Dark Web Monitoring
AhnLab TIP monitors dark web forums and ransomware's dedicated leak sites (DLS) in real-time to provide HTML content and screenshot evidence. Posts made by threat actors are analyzed and information on the intent, target, and credibility are also provided. If there is a possibility of actual damage, AhnLab TIP quickly informs the company to support rapid response.
Q7. What if our credentials have been leaked?
One of the types of information commonly traded on the dark web is corporate accounts. Threat actors buy leaked accounts for initial infiltration and use them in attack campaigns. It's important to quickly verify whether accounts have been exposed, but access to sources is limited. The more employees there are, the more difficult continuous monitoring becomes.
Figure 7. Search Window for Leaked Accounts
AhnLab TIP collects and displays leaked account information when you enter a company domain or email. Additionally, by monitoring Telegram, is increasingly used as a distribution channel for Infostealers and C2 operations, it helps customers to identify any leaks. The security officer monitors the status of corporate account leaks in real-time and can quickly take action to prevent damage if a leak is detected.
Q8. I want to be the first to be informed about threat actors' activities before the media outlets.
To minimize damage from hacking, you must monitor the threat actor's activities, collect related information, and be able to respond proactively. However, if identified through publicly available information like media, this may be already too late.
Figure 8. Attack Activity Monitoring
AhnLab TIP applies various detection rules to monitor attack activities originating from IPs associated with threat actors in real-time. The threat intelligence collected in this way is organized and provided along with the latest incidents, issues, trends, as well as security experts' opinions and advice. Companies can identify signs of attacks faster than the news and use this to proactively respond to cyber threats.
Q9. I need information on nation-based threat groups that target our country.
APT groups operating in places like China or North Korea target various countries. From the perspective of companies and institutions in each country, it is important to track the APT groups' activities and secure response information.
Figure 9. Threat Actor Analysis Screen
AhnLab monitors, analyzes, and tracks the activities of approximately 400 threat actors worldwide. Especially, it has industry-leading analytical capabilities regarding the attack groups actively operating behind China and North Korea. AhnLab manages each attack group by country according to the in-house classification system and provides users with analytical information such as an overview of attack groups, attack techniques, and main targets. Additionally, it provides attack group tracking reports regularly to enable users to effectively respond to state-sponsored attack groups.
Q10. I need a detailed analysis report on a threat.
Many companies need detailed analysis reports on threats, but often lack the specialized personnel to produce them. Especially in the report, tasks like attack chain visualization and mapping internal vulnerabilities and external threats require high-level analytical skills, making report creation highly demanding.
AhnLab TIP analyzes threats from multiple angles and systematically organizes them to provide various types of reports as shown in the table below. Through this, even companies lacking specialized personnel can obtain analysis reports with expertise and credibility.
|
Type |
Description |
Kind |
|
Threat Notes |
- Various security threat intelligence to deliver to customers - Focused on fast delivery |
- Threat actor activity - Security incident - Attack method |
|
Dark Web Notes |
- Corporate information identified on DLS, dark web forums related to ransomware - Focused on fast delivery - Verify information accuracy, extent of damage, etc. to supplement the information |
- Dark web exposure (information/account leaks) - Ransomware DLS |
|
Analysis Report |
- In-depth analysis of attack groups, techniques, vulnerabilities, malware, etc. - Focused on accurate and unique information rather than fast delivery |
- Attack group analysis report - Attack technique analysis report - Vulnerability analysis report - Malware analysis report - Forensic analysis report |
|
Trend Report |
- Statistics and trend information by each threat - Continuously identify threat change trends
|
- CERT Report - Ransomware trend report - Infostealer trend report - APT group trend report - Industry-specific threat report (Finance) - Regional/national threat report - Smishing trend report - Annual report |
Table 1. List of AhnLab TIP Analysis Reports
Conclusion
In this article, we examined ways to utilize threat intelligence, focusing on ten concerns that security personnel face in the field. Selecting meaningful data and analyzing context within the vast amount of threat information is not easy. However, in an increasingly complex threat environment, this process is no longer optional but essential.
Threat intelligence goes beyond merely responding after an incident occurs; it enables a shift to proactive security by preemptively blocking attacks and preventing the spread of damage. In particular, by understanding the background and context of attacks, rather than just blocking based on simple IoCs, companies can establish themselves as proactive responders instead of passive defenders.
Security cannot be achieved without cooperation. When the threat information collected by each company is combined with the expert analysis of security companies like AhnLab, a stronger defense network can be built. AhnLab TIP will continue to provide high-quality threat intelligence quickly, fulfilling its role as a reliable platform and partner in the evolving cyber threat environment.
Subscription inquiries and trial applications for AhnLab TIP can be done on the TIP portal.