Las amenazas cibernéticas se están volviendo cada vez más sofisticadas y frecuentes, lo que hace imprescindible que las organizaciones aprovechen la inteligencia de amenazas cibernéticas para anticipar y responder a ataques. Las soluciones de inteligencia de amenazas proporcionan información accionable sobre el comportamiento de los actores de amenaza, vulnerabilidades emergentes y posibles riesgos.​​ 

Comprender los casos de uso de inteligencia de amenazas puede ayudar a las organizaciones a implementar operaciones de seguridad más efectivas, flujos de trabajo SOC y estrategias de protección digital de riesgos, cerciorando que se mantengan un paso por delante de los actores amenazantes.​​ 

Key Takeaways​​ 

• Información útil de Threat Intelligence: CTI convierte datos en bruto de fuentes abiertas, profundas y de la dark sitio web en información accionable, permitiendo la detección proactiva, la respuesta a incidentes y la mitigación de riesgos.​​ 
• Integración con las Operaciones de Seguridad: Integrar CTI en SIEM, SOAR y otras herramientas de seguridad mejora la eficiencia del flujo de trabajo SOC, la priorización de vulnerabilidades y la búsqueda de amenazas.​​ 
• Priorización de vulnerabilidades y amenazas: El análisis basado en inteligencia permite a las organizaciones centrar recursos en vulnerabilidades de alto riesgo y amenazas emergentes que suponen el mayor impacto operativo.​​ 
• Protección Digital Integral contra Riesgos: Combinar la monitorización de amenazas, la protección de marca y el enriquecimiento de indicadores de amenazas fortalece la postura general de ciberseguridad e informa las decisiones estratégicas de seguridad.​​ 

El papel de la inteligencia de amenazas cibernéticas en la seguridad​​ 

Organizations need to be vigilant and proactive in their approach to security to protect sensitive information and maintain business continuity. And this is where threat intelligence comes in. But what is threat intelligence?​​ 

Threat intelligence is the information an organization uses to understand the threats that have, will, or are targeting the organization. This intelligence is gathered from various sources such as open sources (OSINT), social media, technical data, and dark web monitoring. The primary objective of threat intelligence is to provide actionable insights to prevent, detect, and respond to cyber threats.​​ 

Threat intelligence can be broadly categorized into four main types:​​ 

• Strategic threat intelligence - provides a high-level overview of the threat landscape, including emerging trends, geopolitical events, and major threat actors.​​ 
• Tactical threat intelligence - focuses on the tactics, techniques, and procedures (TTPs) used by threat intelligence actors.​​ 
• Operational threat intelligence - more immediate and actionable, detailing specific incidents and campaigns that are currently active or imminent.​​ 
• Technical threat intelligence - includes data on specific indicators of compromise (IOCs) such as IP addresses, domain names, file hashes, and malware signatures.​​ 

By leveraging these various types of threat intelligence, organizations can build a comprehensive and layered defense against potential cyber threats.​​ 

Por qué la inteligencia de amenazas es importante para las organizaciones​​ 

La inteligencia de amenazas convierte los datos en bruto en información significativa que los equipos de seguridad pueden emplear para tomar decisiones informadas. Al comprender las tácticas, técnicas y procedimientos (TTPs) de los actores amenazantes, las organizaciones pueden:​​ 

• Identificar amenazas emergentes​​ 
• Prioriza las vulnerabilidades de forma eficaz​​ 
• Fortalecer la postura general de seguridad​​ 

According to the Markets Insider Report, the number of vulnerabilities exploited increased threefold in 2023, highlighting the critical need for cyber threat intelligence in safeguarding sensitive data.​​ 

Componentes clave de una inteligencia de amenazas eficaz​​ 

Effective threat intelligence is built on data gathering and sophisticated analysis. It involves a multi-faceted approach that ensures the collected information is relevant, accurate, and actionable. Here are several key components:​​ 

• Data Collection: Gathering raw data from various sources, including network logs, security incidents, and external threat intel feeds.​​ 
• Data Analysis: Processing and analyzing the collected data to identify patterns, trends, and indicators of potential threats.​​ 
• Dissemination: Sharing the analyzed intelligence with relevant stakeholders within the organization to inform security decisions and actions.​​ 
• Actionable Insights: Turning the analyzed data into actionable insights that can be used to mitigate risks and enhance security measures.​​ 

How Can Threat Intelligence Use Cases Help Organizations Against Cyber Threats?​​ 

Threat intelligence plays a pivotal role in helping organizations defend against the ever-evolving landscape of emerging cyber threats. Because threat intelligence solutions can be used in a wide variety of ways, it is important to identify your potential use cases before you choose a threat intelligence platform, rather than picking a solution and then trying to conform your use cases to the strengths of that solution.​​ 

Threat intelligence use cases can streamline the incident response process. In its recent Market Guide, the technology research company Gartner suggests that end users of cyber threat intelligence solutions identify their best solution by taking a “use-case-centric” approach.​​ 

For example, you may wish to gain insights into the identity, methods, and motives of threat actors targeting you so that you can avoid future threats and adjust or update your security; you may wish to create case studies for use in training exercises; or you may wish to gather more threat data so that you can prioritize vulnerability management based on the risks that your organization is particularly vulnerable to — Gartner provides a long list of possible use cases that are important to consider before choosing a solution.​​ 

Before making expensive and informed security decisions on how to improve your security operations and programs, review Gartner’s five examples below on the most effective uses of threat intelligence platforms.​​ 

1. Enriching Other Security Technologies by Integrating Threat Intelligence​​ 

Estos son los fundamentos: integrar la inteligencia de amenazas cibernéticas en tus procesos de seguridad ya existentes mejora la toma de decisiones para la respuesta a incidentes y mejora tu política de seguridad. Según Gartner, la inteligencia de ciberamenazas comenzó recientemente a incorporar ampliamente en la mayoría de los sectores tecnológicos de seguridad, incluyendo la gestión de información y eventos de seguridad (SIEM), firewall y sistemas unificados de gestión de amenazas, detección y prevención de intrusiones, pasarelas sitio web seguras y de email seguro, protección de endpoints, protección de aplicaciones sitio web, denegación de servicio distribuida, gestión de vulnerabilidades , orquestación de seguridad y más.​​ 

If your organization does not already include threat intelligence in its security program, a good place to start is by looking at what you are already using and seeing how threat intelligence can make it more effective. Many threat intelligence solutions offer machine-readable intelligence that can integrate frictionlessly with the security products you already use, and an increasing number of solutions are using open-source standards, making it easier than ever to share data across platforms.​​ 

2. Vulnerability Prioritization For Security Teams​​ 

One of the best uses for an effective threat intelligence program is to gather data and perform analysis that will help your organization create a simple metric for evaluating vulnerabilities. This metric should be a measure of the overlap between the problems you can fix and the solutions that will make the biggest difference, given the time and resources available to you.​​ 

The traditional approach to prioritizing vulnerabilities comes from the attitude that the best security approach is to “patch everything, all the time, everywhere.” Achieving this goal would, in theory, lead to a perfectly impenetrable system — but it sets an impossibly high standard. So organizations that follow this approach will inevitably make compromises and go after the “biggest” problems first.​​ 

But, contrary to popular belief, the “biggest” problems (based on how much damage they actually cause) are not issues like zero-day threats or clever new exploits, but the same old vulnerabilities that continue to be exploited, precisely because so many organizations prioritize new threats within their threat hunting instead of focusing on improving their fundamentals.​​ 

Threat actors are just as limited — if not more so — by time and the resources available to them as you are. They naturally will tend to use the simplest, least resource-intensive exploit as long as it continues to provide results.​​ 

In its analysis of vulnerabilities discovered over the last decade, Gartner found that new CVEs were found at a mostly steady rate, while the number of exploits grew exponentially over the same period. This indicates that the vast majority of new exploits were variations on old ones — making it clear that any organization’s top priority should be patching already-known vulnerabilities rather than worrying about new threats.​​ 

3. Open, Deep, and Dark Web Monitoring​​ 

A threat intelligence solution should gather its threat data from both open and closed sources on the internet.​​ 

Open sources, in short, are publicly available to everyone on the internet. This includes all the data that is indexed on search engines, which is sometimes called the surface web. Although this comprises some 4.56 billion pages, the public part of the internet only makes up about four percent of all data online.​​ 

The other 96 percent is divided between the deep web and the dark web. The deep web, which makes up about 90 percent of that data, refers to those parts of the internet that are locked away behind secure logins or paywalls, leaving them out of the reach of search engine crawlers. Most of this information includes scientific, academic, or government reports, personal information like financial records or medical histories, and private company databases.​​ 

The dark web, which makes up the remaining six percent of all the data on the internet, is made up of websites that can only be reached through browsers like Tor, which provide encryption and anonymity. Although this is not exclusively the case, many websites provide marketplaces for illegal goods and services.​​ 

Vulnerabilities and their exploits are commonly discussed and traded in spaces on both the dark and deep web, both by parties that would wish to keep them safe, and by threat actors. That makes it essential to gather threat data from these threat intelligence sources to maintain a more comprehensive and up-to-date picture of what threats are out there.​​ 

Because accessing these spaces requires more skill and comes with higher risks, one of the principal values of certain threat intelligence solutions is that they will do it for you. According to Gartner’s Market Guide, it can take many years of experience to effectively infiltrate these spaces and provide effective and timely analysis, and the most effective threat intelligence program will come with expert analysis that cannot be replicated by any algorithm.​​ 

4. Brand Monitoring​​ 

Aunque las discusiones sobre vulnerabilidades y exploits tendrán lugar principalmente en las zonas cerradas de Internet, sigue teniendo gran valor elegir una plataforma accionable de inteligencia de amenazas que también monitorear los fuentes abiertas, especialmente para amenazas cibernéticas emergentes en los canales de redes sociales. Identificar amenazas en este ámbito es una habilidad en sí misma, que requiere conocer la marca de tu organización y las muchas formas en que un actor puede intentar explotarla.​​ 

Because these threats appear in public spaces and are subject to wider scrutiny, they can be more subtle, often relying on social engineering techniques instead of software exploits, and take a degree of expertise to recognize.​​ 

For example, a threat intelligence solution that includes brand monitoring may look for fake or malicious social media profiles that have been accepted by your staff or even mimic your staff’s profiles, identify malicious links that have been posted to your social media profiles, or even evaluate intellectual property loss and theft.​​ 

Cyber attacks that can be identified through social media and brand monitoring include phishing, false flag schemes, domain fraud, or activist or “trolling” attacks. Professionally developed threat intelligence solutions are much more efficient and will generate fewer false positives than open-source tools or ad hoc approaches.​​ 

5. Threat Indicator Investigation, Enrichment, and Response​​ 

Not every attack can be prevented, of course, and one of the values of many threat intelligence solutions is their ability to improve the speed and accuracy of your incident response through operational threat intelligence. In its guide, Gartner advocates shifting away from focusing on prevention toward a more balanced approach that also equally includes both threat detection and response.​​ 

Part of this framework includes rethinking how to prioritize vulnerabilities, as detailed above. It can also be helpful to have a threat intelligence solution that allows on-demand access to submit files or objects and looks for indicators of compromise like suspicious file hashes, domain names, or addresses, and compares them to the large datasets that some solutions maintain, enriching your organization’s data.​​ 

Some solutions even have the ability to go on the hunt for threats proactively. Whereas incident response is, by definition, a reactive process, more advanced solutions can seek out threats before they are actually implemented against your organization.​​ 

Threat hunting takes a mature organization that already maintains the fundamentals of its security stance, like keeping its systems up to date and closely monitoring its own network, but provides an invaluable additional layer of security for those organizations that can do it effectively.​​ 

Marco para la Evaluación de Inteligencia de Amenazas​​ 

Gartner’s Market Guide also provides an easy way to evaluate different threat intelligence services based on where they fall on two scales:​​ 

• Tactical - Strategic: This scale is a measurement of time. In rough terms, a tactical threat intelligence solution may be more effective in the short term, while a strategic solution will be better in the long term. For example, a solution might be considered more tactical if its strengths lie in its ability to quickly process threat data and identify potential threats, whereas a solution that offers a deeper analysis that lends itself to long-term planning for the future could better be defined as strategic.​​ 
• Technical - Business: This scale is a measurement of risk type. In general terms, a technical threat intelligence solution will be more focused on security operations, while a strategic threat intelligence approach will deal with digital risk management. For example, a more technical solution might focus on indicators of immediate compromise like bad IP addresses or domains, but a solution that measures the risk from an emerging tactic or to a particular industry vertical is more aligned with business risk.​​ 

Implementación de inteligencia de amenazas cibernéticas para reforzar la seguridad​​ 

Incorporating threat intelligence into an organization's cybersecurity strategy is crucial for staying ahead of evolving cyber threats. The implementation of threat intelligence solutions is crucial for organizations looking to strengthen their cybersecurity posture (or their security teams) and defend against increasingly sophisticated cyber threats.​​ 

Threat intelligence provides the actionable insights needed to anticipate, identify, and respond to threats, ensuring that security teams are always one step ahead of cyber adversaries. Organizations can proactively protect their assets, reduce risk, and ensure a more secure digital environment by leveraging threat intelligence for various use cases, such as enhancing incident response, proactive threat hunting, vulnerability management, and more.​​ 

To discover how threat intelligence can enhance your cybersecurity strategy and security teams, request a demo from Recorded Future​​ 

This article was originally published January 23, 2018, and last updated on Jun 25, 2024.​​