Time for the good guys to learn from cybercriminals

IN RECENT years, cybercrime has produced one of the most collaborative and efficient marketplaces in the world on the Dark Web. The rise of exploit kits and, more recently, cybercrime-as-a-service, have significantly lowered the cost of individual cyberattacks. This lowers the bar for even amateur hackers to launch sophisticated cyberattacks.

It also increases the likelihood that cybercriminals may launch attacks against smaller businesses, owing to the decreased effort involved in launching an attack.

This should be a major cause of worry for security professionals around the globe, as it can be predicted that:

At the same time, the growing reliance of businesses on digital tools such as Internet of Things and cloud means an ever-growing surface area for attacks, as well as greater consequences of a cyberbreach.

As cybercriminals collaborate to achieve their nefarious goals, it is time for security professionals to rally and strive towards the same level of efficiency. To do this, a first step would be for security professionals to engage in greater threat intelligence sharing, or leveraging the potential of the cloud.

Concerns about threat intelligence

"There is already more threat data out there than my team can handle"

A study by the Ponemon Institute in 2016 revealed that up to 70 per cent of security professionals believe threat intelligence is already too voluminous or complex to provide actionable insights. At the same time, the industry i experiencing an acutelack of qualified cybersecurity professionals to analyse this data, with 32 per cent of enterprises indicating that they take six months or more to fill cybersecurity positions, according to a recent report by ISACA. However, this is no reason to back down from greater threat intelligence sharing - in fact it is key to achieving greater cyber protection with a smaller security team.

Combined with automation tools and advanced machine learning capabilities, businesses have an opportunity to take advantage of existing threat intelligence to enhance their protective capabilities.

Contributing meaningful and timely threat intelligence to this pool further strengthens protection for all businesses - across entire industries.

"What if I lose my data?"

The loss of personally identifiable information (PII) is another key factor companies have to consider. This is a valid concern. The key question businesses need to ask, however, is: what exactly needs to be shared as "threat intelligence".

Context is king

Much of what is needed in threat intelligence sharing actually does not contain PII. Trojans, for example, are usually .exe (Windows Executable) files, which do not contain PII. At the same time, "threat intelligence" also doesn't always refer to a "file". It can actually be information as simple as filename, email senders and subjects, or targeted users. The key would be to ultimately share the tradecraft and adversary uses, such as the techniques, tactics and procedures. Piecing such context together allows security vendors to pick out trends and patterns, and thereby identify the motivations and modus operandi behind attack campaigns.

Benefits of threat intelligence sharing

Enables more accurate insights from machine learning capabilities

With the volume and severity of cyberattacks today, it is no longer viable for security teams to scan logs and produce threat reports manually. On the other hand, the greater volume of threat intelligence enhances machine learning capabilities and training programs to identify models and features quicker and more accurately.

Better and more timely user education alerts on attack methods

Businesses and security vendors can put in place every measure possible against cyberattacks, but the weakest link in cybersecurity is still the unassuming end-user.

Careless employees were identified as the most likely source (74 per cent) of cyberbreaches in EY's Global Information Security Survey, far ahead of criminal syndicates, which came in second at 56 per cent. Threat intelligence aggregated across organisations allows security teams to spot patterns and identify who the attackers are targeting, and how they're doing it. In turn, this allows companies to reach out to their own employees more quickly to alert them of ongoing campaigns and stop them from becoming the next unwitting victim.

Allows businesses to move to a prevention-based security posture - together

With businesses' heavy reliance on digital technologies such as Cloud and IoT, a successful cyberattack can easily cripple even the largest of companies.

Earlier in 2017, the NotPetya ransomware attack paralysed corporate giants such as the WPP advertising group globally, demonstrating the scale at which successful breaches can hit companies.

Today, businesses can no longer afford a detect-and-respond approach to cybersecurity.

It is important for companies to pivot to a prevention-based security posture and leveraging automation, allowing them to anticipate and block cyberattacks before they can land.

Effective threat intelligence sharing allows businesses to create a positive multiplier effect on their own insights, thereby creating a safer cyberspace for both themselves and industry at large.

Time to fight back

Cybercriminals have raised their capabilities manifold by collaborating and creating a network effect through the Dark Web. It is time for businesses to fight back, learn from their adversaries and enable better protection by leveraging the power of the crowd.

READ MORE: More opinions and commentaries