The Threat Intelligence Lifecycle: Turning Threat Feeds into Decisions

Many organisations buy threat feeds, pipe thousands of indicators into their security tools and call it threat intelligence. Then nobody can say what decision any of it changed. Intelligence is information that has been collected, analysed and put in context so that someone can act on it. The difference is the question it answers.

Start with requirements

The intelligence lifecycle begins with the people who need intelligence and what they need to decide:

1. Direction: agree the questions. Which threat groups target our sector? Is the vulnerability in our VPN being exploited? Should we fund a new control?
2. Collection: gather information that can answer them, from your own logs and incidents, sharing communities, vendors, government advisories and open sources.
3. Processing: turn raw data into something usable: remove duplicates, translate, normalise formats and enrich it.
4. Analysis: judge what it means for you, how confident you are and what you should do.
5. Dissemination: deliver it to the people who asked, in a form they can use and at a time it still helps.
6. Feedback: ask whether it helped, and adjust the questions.

The step most often skipped is the first. Without agreed requirements, collection grows without limit and analysis has nothing to aim at.

Three levels, three audiences

• Strategic intelligence is for leaders: trends, threat groups’ motives and what they mean for risk and investment. It is written in plain language and arrives monthly or quarterly.
• Operational intelligence is for security managers and incident responders: the campaigns and techniques in use against organisations like yours, and how to detect them.
• Tactical intelligence is for the security operations centre: indicators of compromise, such as malicious IP addresses, domains and file hashes, which expire quickly.

Frameworks such as MITRE ATT&CK describe attackers’ tactics and techniques in a common language. Mapping intelligence to them helps you check whether your detections cover what the threat groups relevant to you actually do.

Sharing it safely

Threat information is most valuable when it is shared, but senders need to control where it goes. NIST’s SP 800-150 explains how to set sharing goals, choose communities and set rules for what you publish. The Traffic Light Protocol (TLP) 2.0, maintained by FIRST and in effect since August 2022, gives a simple set of labels:

• TLP:RED: for the named recipients only, with no further sharing.
• TLP:AMBER: shared within the recipient’s organisation and its clients on a need-to-know basis; TLP:AMBER+STRICT limits it to the organisation alone.
• TLP:GREEN: shared within the recipient’s community, but not publicly.
• TLP:CLEAR: no limits on sharing.

Label everything you share, and respect the labels on what you receive.

What ISO/IEC 27001 expects

The 2022 edition of ISO/IEC 27001 added control 5.7, threat intelligence. It asks organisations to collect and analyse information about threats and to produce intelligence from it. Auditors typically look for defined sources and requirements, analysis that considers the organisation’s own context, and evidence that the results were used: in risk assessments, in detection rules, in patching priorities or in awareness campaigns.

Making it useful

The test of a threat intelligence programme is simple: name a decision it changed. A good place to start is a short list of intelligence requirements agreed with leadership and the security team, a few trusted sources matched to them, and a regular brief that says what has changed and what to do about it. Add feeds only when they answer a question on the list.