Actionable Threat Intelligence for External Risks
Actionable Threat Intelligence for External Risks is the process of gathering, analyzing, and disseminating information about potential cyber threats that originate from outside an organization's direct control in a way that enables the organization to take specific actions to defend itself.
Here's a breakdown of the key components:
Threat Intelligence: This involves collecting and processing data from various sources to understand the capabilities, motivations, and activities of cyber threat actors.
External Risks: This refers to potential threats outside the organization's traditional network perimeter. These can include:
Threats targeting an organization’s web presence.
Risks associated with third-party vendors.
Activities on the dark web that could impact the organization.
Phishing campaigns that impersonate the organization.
Actionable: This is the crucial part. The intelligence isn't just information; it can be directly used to improve security. This means it's:
Relevant: It pertains specifically to the organization and its threat landscape.
Timely: It's provided quickly enough to take action before an attack occurs.
Accurate: It's reliable and can be trusted.
Contextualized: It includes enough information to understand the threat's potential impact and how to respond.
Prioritized: It helps security teams focus on the most critical threats.
Actionable Threat Intelligence for External Risks empowers organizations to move from a reactive security posture to a proactive one by providing the knowledge needed to anticipate, prevent, and mitigate external cyber threats.
ThreatNG provides actionable threat intelligence for external risks through a combination of capabilities that gather, analyze, and present information in a way that organizations can readily use.
External Discovery: ThreatNG's external discovery capabilities provide a broad view of potential threats. ThreatNG identifies the attack surface visible to possible attackers by performing purely external unauthenticated discovery.
External Assessment: ThreatNG delivers risk assessments that act as threat intelligence by evaluating external threats' likelihood and potential impact. Examples include:
It assesses Web Application Hijack Susceptibility and Subdomain Takeover Susceptibility, providing intelligence on potential attack vectors targeting web assets.
It evaluates BEC & Phishing Susceptibility, Brand Damage Susceptibility, and Data Leak Susceptibility, offering insights into threats that can compromise an organization's operations and reputation.
It determines Cyber Risk Exposure by analyzing external factors, delivering intelligence on potential cyberattacks.
It assesses ESG Exposure and Supply Chain & Third-Party Exposure, providing intelligence on risks related to external relationships and factors.
It calculates Breach & Ransomware Susceptibility and assesses Mobile App Exposure, delivering intelligence on threats that could lead to significant security incidents.
Reporting: ThreatNG generates reports such as Executive, Technical, and Prioritized, which present threat intelligence in a structured format. These reports enable organizations to understand their risk posture and prioritize actions.
Continuous Monitoring: ThreatNG's continuous monitoring of external attack surface, digital risk, and security ratings provides ongoing threat intelligence, ensuring organizations are aware of emerging threats and changes in their risk profile.
Investigation Modules: ThreatNG's investigation modules offer detailed information that security teams can use to understand and act on potential threats:
Domain Intelligence: Provides a broad overview and detailed analysis of various aspects of domains.
IP Intelligence: Provides information on IPs, Shared IPs, ASNs, Country Locations, and Private IPs.
Certificate Intelligence: Provides information on TLS Certificates and Associated Organizations.
Social Media: Gathers posts from the organization under investigation, providing intelligence on potential social media-related threats.
Sensitive Code Exposure: Discovers public code repositories and uncovers digital risks, delivering intelligence on potential code-related vulnerabilities.
Mobile Application Discovery: Discovers mobile apps and analyzes their contents.
Search Engine Exploitation: Helps investigate an organization’s susceptibility to exposing information via search engines.
Cloud and SaaS Exposure: Identifies sanctioned and unsanctioned cloud services, cloud service impersonations, and exposed cloud buckets, and covers SaaS implementations.
Online Sharing Exposure: Identifies organizational entity presence within online code-sharing platforms.
Sentiment and Financials: Covers organizational-related lawsuits, layoff chatter, SEC filings, SEC Form 8-Ks, and ESG violations.
Archived Web Pages: Provides access to archived web pages.
Dark Web Presence: Covers organizational mentions, associated ransomware events, and compromised credentials.
Technology Stack: Identifies the technologies used by the organization.
Intelligence Repositories: ThreatNG uses intelligence repositories, including data on the dark web, compromised credentials, ransomware events and groups, known vulnerabilities, ESG violations, bug bounty programs, SEC Form 8-Ks, Bank Identification Numbers, and Mobile Apps. These repositories provide a broad source of threat intelligence.
Work with Complementary Solutions: While the document does not detail specific integrations, ThreatNG's capabilities can complement other security tools. For example, its threat intelligence and vulnerability data can be valuable for SIEM and SOAR systems.
