Threat Intelligence – Part 4 The Way Forward

### Overview This discussion explores the practical application and necessity of threat intelligence and cyber attribution for organizations navigating today's threat landscape. The speakers examine whether pinpointing specific adversaries matters to enterprise defense, how organizations can contextualize threat intelligence to fit their business requirements, and how the economic and technological landscape of security operations is shifting.

### Key Topics - **The Value of Attribution**: The speakers debate whether attributing an attack to a nation-state, cyber criminal gang, or hacktivist makes an operational difference. Attribution is predominantly critical when there are legal or law enforcement implications that require presenting evidence in a court of law. For general defense, attributing mass-scale, sprayed attacks (such as mass scanning or credential brute forcing) is largely impractical, whereas understanding exposure to specific attack patterns—such as MageCart-style tactics—offers direct defensive value. - **Contextualization and Asset Mapping**: Threat intelligence is defined as a combination of technology and people that must be shaped around an organization's specific threat landscape. Merely ingesting data feeds without correlating them to an internal asset database leads to spiraling costs without actionable cyber risk reduction. - **Sourcing Diverse Intelligence**: Organizations are advised not to rely on a single vendor or supplier. A resilient threat intelligence capability incorporates open-source intelligence, US-based vendors, Chinese vendors, and built-in intelligence from next-generation SIEM engines and SOC platforms to gain a truly global perspective. - **Economics and Operational Shifts**: The cost of monitoring and Security Operations Center (SOC) capabilities is decreasing significantly due to automation and modern toolsets. Capabilities that previously cost £50 to £60 per user per month in large multinationals can now be acquired for around £10 per user per month.

### Technical Details - **Attacks & Threat Vectors**: Covers broad, automated campaigns including mass port/vulnerability scanning, mass credential brute forcing, and web skimming/targeting exemplified by MageCart actors. - **Infrastructure & Monitoring**: Ingestion of data feeds into next-generation SIEM platforms and SOC architectures, tied directly to an organization's internal asset inventory to prevent data overload and uncontrolled expense.

### Takeaways - Focus threat intelligence on protecting critical internal assets and understanding relevant adversary TTPs (like MageCart) rather than obsessing over naming individual threat actors, unless preparing cases for law enforcement. - Contextualize feeds against your business environment and asset databases to control costs and deliver measurable risk reduction. - Take advantage of descending SOC and monitoring costs brought by next-generation automated tooling, and engage in open public discussions to train the next generation of security professionals.