Counter Today’s Cyber Threats with Actionable Threat Intelligence
In the ongoing battle against ever more advanced cyberattacks, defenders must innovate to remain a step ahead of the newest threats. After all, yesterday’s defenses are no match for today’s attacks. Forward looking organizations need real-time, actionable intelligence about the threats they face.
Threat intelligence solutions provide the data that cybersecurity professionals need to make informed decisions about their cyber defenses. With threat intelligence technology, security teams can know:
- Who is attacking me?
- What are the attacker’s methods?
- What is the attacker trying to accomplish?
Put It in Context
The key to making informed decisions is context. Without context, threat intelligence is a jumbled torrent of alerts that no human being can possibly monitor. With too many alerts comes alert fatigue – not solutions.
This is the common criticism of conventional threat intelligence tools, like security incident and event management (SIEM) applications. They deliver a lot of information, but it’s not always actionable intelligence. The result? Too many “false positives” – crucial security warnings that turn out to be empty threats.
According to our survey at RSA Conference 2019, false positives are the largest obstacle in maximizing the value of a SIEM solution. One analyst study discovered that 79% of cybersecurity teams are overwhelmed by the volume of threat alerts.
Like the boy who cried wolf in Aesop’s fables, issue too many false positives and the warnings are simply ignored. The best example of alert fatigue leading to a cyberattack is the notorious 2013 Target breach that impacted more than 40 million customers. According to post-breach analysis, the cybersecurity team repeatedly saw the same, false malware alert prior to the attack. Eventually those warnings were ignored, even as the real intrusion occurred.
The Modern Threat Intelligence Approach
Since context is key, clearly what’s needed is a solution that can provide proper context by quickly analyzing new alerts, filtering out false positives, and generating real-time data about actual threats. This is where Gurucul excels. Our User and Entity Behavior Analytics (UEBA) product uses behavior analytics powered by machine learning to automate data collection and generate risk-scored intelligence.
Advanced machine learning algorithms provide a holistic view of all log data and reveal suspicious activity. Gurucul’s more than 1,400 machine learning models can predict insider threats, account compromise and data exfiltration by identifying users engaging in “abnormal” activities compared to peer-group behavior.
Most organizations already use multiple security tools to produce detailed log data. Applying machine learning and artificial intelligence (AI) to that data to examine anomalous user behavior is the logical next step.
Learn more by downloading the whitepaper User and Entity Behavior Analytics Use Cases.
The post Counter Today’s Cyber Threats with Actionable Threat Intelligence appeared first on Gurucul.
*** This is a Security Bloggers Network syndicated blog from Blog – Gurucul authored by Kevin Franks. Read the original post at: https://gurucul.com/blog/counter-todays-cyber-threats-with-actionable-threat-intelligence
