What Is Cyber Threat Intelligence?
Cyber Threat Intelligence, or CTI, is the constant gathering of data on emerging or existing attacks of threat actors from outside sources. The intelligence is delivered through a threat intelligence feed from information for security. IoCs enrich internal monitoring data with SIEM systems, IPS (Intrusion Prevention System), or IDS/NIDS/HIDS (Intrusion Detection System, Network, Host). The data are lists of IP addresses or domain names wherein a suspicious activity or network behavior has been detected. Cyber Threat Intelligence also contains reports about threat actors' activities. These can be used by Threat Hunters to identify the tools and processes they use to breach the network.
What Is Cyber Threat Hunting?
Now, Cyber Threat Intelligence is collecting data on the attack and the threat actors. On the other hand, Threat Hunting is the proactive process of looking at and detecting threat actors in the network. Because it is iterative, it prioritizes process over pattern matching, unlike Cyber Threat Intelligence. It consists of several models and frameworks to identify behavioral communication traits. Threat Hunting's main goal is to seek out potential breaches and threats to the network before they can execute an attack.
The process often starts with a hypothesis. This is developed through a security alert, risk assessment, penetration test, external intelligence, or some other discovery of anomalous activity, that a threat is present in your systems. Hunters explore and test these hypotheses to counter every possible attack that threat actors could do. Threat Hunters use many security tools, analytics - even threat intelligence - to create these hypotheses, which are the basis of the hunt.
Challenges of Cyber Threat Intelligence and Cyber Threat Hunting
Cyber Threat Intelligence and Threat Hunting should be seamless. However, some limitations pose challenges to the two processes. In Cyber Threat Intelligence, observed data patterns could be written in a broad description. This makes it challenging for SoCs to differentiate the characteristics of an attack. There are still many threats intel feeds that cannot distinguish static and dynamic IP addresses or co-hosted systems. If the intel becomes vague, the suspicious data from a specific IP address becomes harder to notice and will seem like "safe" data. Advanced and sophisticated threat attacks nowadays are carried out to fit the targeted environment. Due to the broadness of the description delivered by a Cyber Threat Intel, these false "safe" communication will be overlooked by Cyber Threat Hunters.
But, the only challenge for Threat Hunting is identifying a language used for a set of processes. Different SoCs may develop different threat hunting methods, models, and frameworks to hunt and detect threats. As per SANS 2019, there is not a universal process that Threat Hunters should use as a base. This can also be due to the lack of training or education offered for this kind of field. Thus, SoCs are starting to offer courses for Threat Hunting to spread awareness about the general processes of threat hunting.
Why are both important?
Despite the limitations, cyber threat intelligence and Threat Hunting are crucial to protect the network from sophisticated attacks. These two processes identify and collect information of potential threats before it causes a disruption to the network. Furthermore, a detailed analysis from Cyber Threat Intelligence can make Threat Hunting much more efficient and effective. Intel of attack behaviors and patterns can help network firewall security services. These improve the security posture of the network security tool. Also, Cyber Threat Intelligence becomes a base brick of the wall defending the network.
Meanwhile, Threat Hunting prevents threats before they even get a chance to attack the network. It is like a foot soldier gathering intelligence against suspicious people. Then, seizing them as soon as possible to protect the network. Without the process of Cyber Threat Hunting, a network would be much more vulnerable to advanced attacks. that traditional network security tools or even AI-powered malware detection tools have a hard time detecting.
Both processes are interconnected with each other. Both are utilized to get a much more in-depth analysis of information from the attacker. And both are what protect our data from getting stolen by these malicious people.
