The 2019 CTI survey has shown that the use of cyber threat intelligence (CTI) is evolving. The results of the survey will be released by SANS Institute in a two-part webcast on February 5 and February 7.
“This year’s survey saw an increase in usage and interest in CTI, along with a diversification in how the intelligence is being used by organisations,” says SANS Analyst and threat intelligence expert Rebekah Brown. “While the use of CTI continues to grow, there is no one-size-fits-all approach. Organisations leverage different types of CTI to meet different needs.”
CTI is a resource for network defense at a majority of survey respondents’ organisations, with 72 per cent either consuming or producing it. Perhaps more importantly, only 8 per cent reported having no plans to begin using intelligence. Top use cases include security operations, detecting threats and attacks, blocking threats and security awareness. A diversification in use cases for CTI, along with a better understanding of how it is used to benefit an organisation’s security posture, means that CTI is being more widely utilised by both large and small organisations.
Although more are using CTI, organisations are not defining requirements for the CTI programmes in any organised manner. Just 30 per cent have documented their requirements, while 37 per cent has ad hoc requirements, leaving 33 per cent without defined requirements for their efforts.
“Arguably the most important part of the CTI process is identifying and defining good requirements to guide the entire intelligence life cycle and make the collection, analysis, processing and dissemination of intelligence much more focused,” adds Robert M. Lee, SANS analyst and threat intelligence expert. “Requirements enable organisations to properly operationalise intelligence work. That makes it all the more alarming, that so few have invested the time in defining their focus.”
