Threat Intelligence

5 automated security scanners

Strategic Intelligence Analysis

Purpose: This scanner is designed to analyze strategic threat intelligence for a given domain and company. It aims to identify potential vulnerabilities in an organization’s approach to managing cyber threats by evaluating its industry awareness, geopolitical understanding, APT group tracking, information sharing, and overall maturity level in the field of cybersecurity.

What It Detects:

Industry Threats: The scanner identifies mentions of potential cyber threats related to the company’s industry or sector.
Geopolitical Threats: The scanner looks for indicators of global cyber threats that could impact the organization, especially those originating from politically sensitive regions.
APT Groups Tracked: It detects if any Advanced Persistent Threat (APT) groups are being tracked and whether there is a documented understanding of these actors’ activities.
Threat Intelligence Sources: The scanner checks for mentions of threat intelligence vendors or sources that the organization relies on to enhance its security posture.

Inputs Required:

Domain: The web address of the company’s main website, which helps in conducting the analysis.
Company Name: The official name of the company, used for context and identification within the analysis.

Business Impact: Understanding and managing strategic threat intelligence is crucial for organizations to protect their assets from potential cyber threats. A robust approach to this can significantly reduce the risk of data breaches, intellectual property theft, and other severe consequences associated with cyber attacks.

Risk Levels:

Critical: The organization shows no awareness or evidence of dealing with significant global threats that could compromise its security infrastructure.
High: There is a notable gap in one or more critical areas such as industry threat recognition or APT group tracking, indicating potential vulnerabilities.
Medium: Multiple deficiencies exist in the strategic threat intelligence capabilities, but they are not yet considered critical for immediate action.
Low: Some gaps are present, but overall, the organization demonstrates a reasonable level of awareness and preparedness against cyber threats.
Info: The findings provide informational insights into areas where improvements could be made without posing an immediate risk to security.

Example Findings:

Acme Corporation shows no mentions of potential industry-specific cyber threats in its online communications, indicating a lack of proactive defense mechanisms.
A notable absence of information about APT groups or significant global threats is detected on the company’s website, suggesting a need for enhanced threat monitoring and intelligence gathering efforts.

Industry-Specific Threat Modeling

Purpose: This scanner analyzes industry-specific threat modeling for a given domain and company. It identifies key indicators such as sector threats, regulatory threats, competitor breaches, and supply chain threats to assess the organization’s vulnerability in handling potential cyber threats specific to its industry.

What It Detects:

Sector Threats: Identifies potential risks unique to the company’s sector based on publicly available information.
Regulatory Threats: Uncovers regulatory compliance risks that could impact business operations and security posture.
Competitor Breaches: Analyzes if there are any known breaches in competitors’ sectors, which might indicate emerging threats or vulnerabilities in similar areas.
Supply Chain Threats: Evaluates the potential risks associated with third-party suppliers to identify potential weak links that could be exploited by adversaries.

Inputs Required:

Domain: The main website address of the company for analysis.
Company Name: The official name or identifier of the company being analyzed.

Business Impact: Assessing industry-specific threat modeling is crucial as it helps organizations to proactively identify potential vulnerabilities and threats that might not be immediately apparent from general cybersecurity practices. This can significantly impact a company’s ability to protect sensitive information, maintain operational continuity, and comply with regulatory requirements.

Risk Levels:

Critical: If the scanner identifies no sector identified or if there are critical gaps in threat modeling (e.g., no known threats or regulatory context), it would flag this as “critical.”
High: If there is a significant number of vulnerabilities, such as multiple gaps in threat modeling without clear mitigation strategies, the risk level would be set to “high.”
Medium: For moderate levels of vulnerability with some identified issues that could be mitigated through strategic planning and improvements, the risk level would be “medium.”
Low: If there are minimal vulnerabilities or if the organization has a robust framework for threat management and intelligence, the risk level would be considered “low.”
Info: This category is used for informational findings such as no ISAC participation or sector threat intelligence sharing, which while not critical, still provide valuable insights into potential areas for improvement.

Example Findings:

If a company in the technology sector fails to identify any sector threats but has clear regulatory compliance issues, it would be flagged with a “critical” risk level due to significant gaps in threat modeling related to its industry.
A pharmaceutical company that does not disclose any competitor breaches but shows minimal supply chain transparency could still face a “high” risk level if there are no identified sector threats or clear mitigation strategies for regulatory compliance risks.

Threat Campaign Attribution

Purpose: The Threat_Intelligence.Threat_Campaign_Attribution scanner is designed to assess a company’s capability in identifying and attributing threat campaigns based on their domain and name. It evaluates the presence of campaign references, TTP mentions, infrastructure tracking, and malware families across various sources to gauge the effectiveness of an organization’s threat intelligence gathering efforts.

What It Detects:

Campaign References Count: The number of past or ongoing threats identified by name within the company’s communications or reports.
TTP Mentions Count: The instances where techniques, tactics, and procedures (TTPs) commonly used by adversaries are mentioned in documents or discussions.
Infrastructure Tracking Count: The detection of persistent infrastructure elements that could be associated with ongoing threats.
Malware Families Count: The identification of malware families within the company’s systems or data that suggest active exploitation and ongoing campaigns.

Inputs Required:

<domain>: The internet domain under investigation to assess its threat campaign attribution capabilities.
<company_name>: The name of the company whose threat campaign attribution is being evaluated.

Business Impact: Threat campaign attribution is crucial for understanding and predicting future threats, enabling proactive defense mechanisms against potential attacks. A robust ability to attribute campaigns allows organizations to better allocate resources, implement targeted defenses, and enhance overall security posture.

Risk Levels:

Critical: The scanner identifies no campaign references or TTP mentions, indicating a complete absence of threat intelligence gathering efforts.
High: The scanner finds minimal campaign references or TTP mentions with limited infrastructure tracking and malware families, suggesting inadequate threat detection practices.
Medium: The scanner detects some campaign references and TTPs but lacks detailed infrastructure tracking and specific malware identification, signaling potential gaps in threat awareness.
Low: The scanner identifies a reasonable number of campaign references, TTPs, and some infrastructure tracking and malware families, indicating a basic level of threat intelligence gathering.
Info: The scanner detects informational findings such as mentions or counts that are considered normal for the given domain and company size but do not significantly impact security posture.

Example Findings:

A critical finding where no campaign references or TTPs are detected, indicating a severe lack of threat intelligence gathering efforts.
A high risk level where minimal indicators suggest an organization is highly vulnerable to ongoing threats without effective detection mechanisms in place.

Emerging Threat Research

Purpose: This scanner analyzes emerging threat research capabilities for a given domain and company. It evaluates indicators such as zero-day vulnerabilities, novel techniques in cyber threats, vulnerability research, and threat forecasting to assess the maturity of an organization’s response to these evolving risks.

What It Detects:

Zero-Day Mentions: Counts the number of unpatched security vulnerabilities that are publicly disclosed but not yet fixed by vendors.
Novel Techniques: Identifies new methods or tactics used in cyber attacks, which may require immediate adaptation and response strategies from cybersecurity teams.
Vulnerability Research: The ability to identify, assess, and report on potential weaknesses in an organization’s infrastructure that could be exploited by adversaries.
Threat Forecasting: Predictive analysis of future threats based on current trends and patterns, which is crucial for proactive defense planning.

Inputs Required:

Domain: The main website address used to access the company’s services or information (e.g., “acme.com”).
Company Name: The legal name of the organization that operates under this domain (e.g., “Acme Corporation”).

Business Impact: Assessing emerging threat research is vital for understanding and mitigating potential risks associated with cyber threats. Organizations that can quickly identify and respond to new vulnerabilities are better positioned to protect their assets, maintain customer trust, and comply with regulatory requirements.

Risk Levels:

Critical: If the organization does not monitor zero-day vulnerabilities or forecast future threats effectively, it may be unable to take necessary precautions, leading to significant damage in case of an attack.
High: Inadequate detection mechanisms for novel techniques can result in a reactive posture that is difficult to sustain against persistent and sophisticated adversaries.
Medium: Limited vulnerability research capabilities might not uncover all potential risks, potentially exposing the organization to higher levels of risk than initially perceived.
Low: Organizations with robust emerging threat research capabilities are generally well-prepared for cyber threats, having implemented effective detection mechanisms and response strategies.
Info: Informal findings such as participation in industry conferences or publication of security advisories can indicate a proactive approach but do not significantly impact the overall risk assessment.

Example Findings:

A company that does not engage with industry conferences to share best practices might be found lacking in its research and engagement capabilities, indicating a potential gap in its threat intelligence efforts.
An organization showing no evidence of vulnerability research could face higher risks due to unaddressed weaknesses in their infrastructure.

Geopolitical Cyber Risk

Purpose: This scanner analyzes geopolitical cyber risk for a given domain and company by examining their website, compliance frameworks, regional presence, and executive awareness. It aims to identify potential vulnerabilities related to nation-state threats, data sovereignty, sanctions compliance, and overall cyber risk awareness.

What It Detects:

Nation-State Threats: Identifies if the company tracks or mentions any nation-state actors that could pose a threat in cyberspace.
Regional Presence: Evaluates whether the company operates globally or has significant presence in specific regions, which can be influenced by geopolitical dynamics.
Compliance Frameworks: Checks for adherence to data protection laws and sanctions compliance, reflecting the company’s commitment to legal and ethical standards.
Geopolitical Expertise: Assesses the company’s awareness of geopolitical risks and its ability to manage cyber threats effectively.
Executive Awareness: Verifies if top executives are aware of potential risks associated with geopolitical cyber threats.

Inputs Required:

Domain: The website address under investigation (e.g., “acme.com”).
Company Name: The name of the company associated with the domain (e.g., “Acme Corporation”).

Business Impact: Understanding and managing geopolitical cyber risks is crucial for organizations to protect their operations, reputation, and strategic assets from potential threats posed by nation-state actors. This includes financial losses, reputational damage, and operational disruptions that could arise from compromised data or systems.

Risk Levels:

Critical: The company does not track any nation-state actors or fails to comply with significant data protection laws and sanctions compliance requirements.
High: There is a lack of awareness about geopolitical risks among top executives, inadequate tracking of potential threats, or failure in key regulatory compliances.
Medium: Some gaps exist in understanding geopolitical cyber risks, but the company has taken some steps to address these issues.
Low: The company demonstrates strong awareness and compliance with relevant regulations and shows effective management of geopolitical cyber risks.
Info: Informal findings indicating minor deficiencies or areas for improvement in geopolitical risk management practices.

Example Findings:

A notable absence of mentions about nation-state actors on the company’s website, suggesting a lack of awareness and preparedness against such threats.
Inadequate tracking of data protection laws compliance across various regions, which could lead to legal liabilities and operational disruptions.