Tackling Expensive and Complicated Information Security

Information Security: It doesn’t have to be so expensive (or complicated!)

The Bad News

For Small/Medium Businesses (SMBs), you can’t approach information security the same way your bigger brothers do. Face it, Capital One has a much larger information security (infosec) budget than the Downtown Credit Union in Powhatan, VA. Small companies don’t have the same staffing models, technology expertise or highly specialized analysts that focus solely on protecting data. Sure, there are free and open source tools, for example, but they still require expertise and time to get them up and running, not to mentioned tuned, maintained, updated, etc!

Here’s another challenge. A good information security practice relies on intelligence about threats, attacks, vulnerabilities, etc. There are open source data sets that can help your SMB know what to look for in network scans, packet matching signatures and queries in your SIEM, but that open source data tends to be stale. Don’t get me wrong, it’s table stakes. You NEED to be on the lookout for what Emerging Threats has, but it’s not sufficient. That data will protect you, but it’s a tiny part of the known bad things out there.

Ok, one more ‘bad news’ comment. There are vendors out there that will sell you cyber threat intelligence (CTI) data. Some aggregate data from intelligence providers; they’re called TIPs, Threat Intelligence Platforms. They provide tools and technologies to help you get known intelligence data. Others research, probe and monitor the internet/private networks looking for ‘things’ that are bad. They’ll either sell you the data or sell it to an aggregation company who will sell it to you. They provide a great service, and deserve to be paid for the work they do, but again, this may be pricey and out of your budget.

The Good News!

There is a new reality out there. There are sharing communities being formed to share this threat intelligence data (ISACs and ISAOs). These groups are focused around specific industries (Health Care, Financial Services, Aviation, etc) and allow a platform to share more RELEVANT data. This is data that affects your industry, and therefore has a much higher chance of being relevant to you company. Their cyber intelligence data is target to their industry and typically much more relevant than the data served from large repositories.

Size doesn’t always matter. With finite resources, both technical and human, it’s nearly impossible for SMBs to look out for all the bad things; and why should they? A bank doesn’t care about a command and control channel for a botnet that is targeting manufacturing equipment.

Sharing communities are becoming the KEY source of threat intelligence data for small to mid-size business. It’s putting the control of the infosec spend back into their hands.

By leveraging shared community data as the primary (but still not only!) source of intelligence, we substantially reduce the cost of a comprehensive cyber intelligence and threat mitigation plan. Once we embrace this new world of industry-specific, relevant cyber intel, we’ll have new ways to connect in a USABLE way. What’s “usable”? In order to reap the benefits of your sharing community memberships, you need readily tools that:

Don’t require a skilled analyst behind the dashboard 24x7. Don’t require a SIEM to use it. Doesn’t require a knowledge of code. Doesn’t require more than a basic understanding of CTI (STIX, TAXII) terminology

Now What

Who’s going to provide a tool like this? Ha! I’m not good at keeping secrets, but I’m working on something that will help bring the promise of a sharing community to reality.

We'd love to hear your thoughts. Find us on Twitter, LinkedIn or write in to hello@perchsecurity.com