Organizations face a constant barrage of digital threats. To mitigate the risk of an attack, IT staff need to continually protect all of an organization's endpoints, such as by creating patching schedules and by hardening vulnerable devices. Unfortunately, protection has its limitations. Security personnel can harden a device or implement a patch only against known threats. Information security teams also need to be on the lookout for suspicious behavior and changes in systems that could be attacked. To help defend against unknown threats, IT staff require an understanding of the relative value and criticality of each business asset, as well as contextual details of a digital threat. That latter point is where threat intelligence comes in. Threat intelligence provides data to organizations on what they can look out for with regards to specific threats. There are countless sources of threat intelligence available today, allowing organizations to customize their feeds based upon speed and origin, among a number of other variables. Ideally, companies will use multiple sources to prioritize vulnerabilities based upon their severity. Not all do, however. In fact, many enterprises' intelligence programs are commonly one-dimensional, hampered by manual processes, lacking additional context provided by security awareness, and focused on threats that may or may not be relevant to a company. Threat intelligence is an important resource in its own right, but it's what organizations do with threat intelligence that really matters. So, how can organizations make the most out of their intelligence programs?
One answer can be found in Tripwire's Endpoint Detection and Response For Dummies, a resource which discusses how to deploy and manage security for different kinds of endpoints. Just as known vulnerabilities should be prioritized, so should emerging threats. With that in mind, organizations can make the most out of threat intelligence by creating an endpoint detection and response (EDR) system that relies on multiple intelligence sources to distinguish low risks from high risks in real-time. For potentially dangerous behavior, companies can issue red flags or choose to disable an asset while they launch a more thorough investigation. The response largely depends on how much is known about the asset and the threat. More intelligence means an organization might be able to automate a response. Less information might require the intervention of a human analyst. For more information on threat intelligence and real-time threat response, download Tripwire's eBook today. Title image courtesy of ShutterStock
