Threat intelligence

What the requirement asks

Information about security threats is to be gathered and examined so that it yields threat intelligence. Purpose: make the organization aware of the threats around it so that fitting mitigations can be chosen. Guidance: knowledge of current and emerging threats is analysed so the organization can act to stop them doing harm and lessen their effect. All three layers should be considered: strategic (the broad picture of how the threat landscape is shifting, such as kinds of attacker or attack), tactical (how attackers operate, their tools and technologies) and operational (detail of particular attacks, including technical indicators). Good intelligence is relevant to protecting the organization, gives accurate and detailed insight, carries context (timing, location, past experience, how common it is among similar organizations) and can be acted on quickly. The activities are: set objectives for producing intelligence; identify, vet and choose internal and external sources; collect from them; process the material for analysis (translating, formatting, corroborating); analyse what it means for the organization; and pass it in understandable form to the people who need it. The results feed information security risk management, serve as extra input to technical preventive and detective tools such as firewalls, intrusion detection and anti-malware, and inform security testing. Intelligence should be shared with other organizations on a reciprocal basis. Other information: most organizations consume intelligence from independent providers, government agencies or collaborative groups rather than producing it, and controls 5.25, 8.7, 8.16 and 8.23 depend on its quality. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Threat intelligence is expected to be collected against the organization's risks, not in general. The guidance asks for the sources, the review, the decision it informed and the owner. A feed with no consumer is not intelligence.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep documented threat intelligence objectives and a process covering collection, processing, analysis and dissemination and one live sample together.

Evidence an assessor asks for

• Threat intelligenceDocumented threat intelligence objectives and a process covering collection, processing, analysis and dissemination
• Threat intelligenceA list of vetted internal and external intelligence sources with the rationale for selection
• Threat intelligenceThreat intelligence outputs at strategic, tactical and operational levels, such as landscape briefings, attacker technique summaries and indicator feeds
• Threat intelligenceEvidence that intelligence updated the risk assessment or risk register
• Threat intelligenceEvidence that indicators were loaded into firewalls, intrusion detection, SIEM or anti-malware tooling and used in security test planning
• Threat intelligenceRecords of reciprocal sharing with peer organizations or sharing communities

The question an assessor will ask

An assessor will ask for documented threat intelligence objectives and a process covering collection, processing, analysis and dissemination, then trace it to the system it protects. For A.5.7 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Feeds are subscribed to but nobody analyses what they mean for the organization
• Only operational indicators are consumed and strategic or tactical intelligence is ignored
• Intelligence does not reach risk management or the teams running detective controls
• Sources are never evaluated for reliability or relevance

Before the next audit

Before the next audit, check one live sample for this gap: feeds are subscribed to but nobody analyses what they mean for the organization.