The Challenges of Leveraging Threat Intelligence to Stop Data Breaches

Abstract

Despite the significant increase in cybersecurity solutions investment, organizations are still plagued by security breaches, especially data breaches. As more organizations experience crippling security breaches, the wave of compromised data is growing significantly. The financial consequences of a data breach are set on the rise, but the cost goes beyond potential fines. Data breaches could have a catastrophic impact not only in loss of company's reputation and stock price, but also in economic terms. Threat Intelligence has been recently introduced to enable greater visibility of cyber threats, in order to better protect organizations' digital assets and prevent data breaches. Threat intelligence is the practice of integrating and analyzing disjointed cyber data to extract evidence-based insights regarding an organization's unique threat landscape. This helps explain who the adversary is, how and why they are comprising the organization's digital assets, what consequences could happen following the attack, what assets actually could be compromised, and how to detect or respond to the threat. Every organization is different and threat intelligence frameworks are custom-tailored to the business process itself and the organization's risks, as there is no "one-size-fits-all" in cyber. In this paper, we review the problem of data breaches and discuss the challenges of implementing threat intelligence that scales in today's complex threat landscape and digital infrastructure. This is followed by an illustration of how the future of effective threat intelligence is closely linked to efficiently applying Artificial Intelligence and Machine Learning approaches, and we conclude by outlining future research directions in this area.

Towards Trusted and Intelligent Cyber-Physical Systems: A Security-by-Design Approach

“…To ensure sustainable protection against attacks, it is necessary to au- tomate extracting TI and evidence-based insights from data sources. While keeping up with the complexity and adaptability of current cybersecurity threats, Artificial Intelligence (AI)driven security solutions provide automated security solutions to detect zero-day threats [20]. In this regard, we utilize intelligence-driven solutions (such as data analytics and TI) in DTs that can help to identify existing vulnerabilities, faulty models, malicious actors, and potential attack vectors, thereby minimizing the threat landscape and improving the CPSs.…”

The Implementation of Strategic Threat Intelligence for Business Organization

“…Data leakage is one of the main cybersecurity issues and it will affect the digital economy (Confente et al, 2019;Ibrahim et al, 2020). Unfortunately, data leakages carry a variety of direct and indirect cost factors and these factors are critical to the survival and competitiveness of the organizations.…”

Untitled

“…Some less sophisticated attacks can be perpetrated with the goal of service disruption, such as a DDOS attack, but can also serve as a decoy for a more sophisticated action; this was the case of the Carphone Warehouse data breach in 2015 where a DDOS attack was launched to distract it's IT team while a coordinated attack was launched on its systems that resulted in the theft of 2.4 million customer records [1].…”

“…Two fundamental aspects of data breaches are data loss and data leakage whose handling is addressed very differently; Data loss may result from the intentional or unintentional, with or without malicious or wrongful intent handling and transfer of data by an inside user but is a vector that can be addressed in a fairly straightforward way through the use of Data Loss Prevention solutions and policies; Data leakage is usually intentional and results from the direct actions of external hackers. These are far more difficult to predict, detect and detain [1].…”

“…Data leaks often take a considerable amount of time to be detected and stopped, potentially providing the perpetrators with weeks, months or even years of free access within corporate systems. Conventional data breach response plans often take place after the fact conducting forensics and evidence gathering for further action but are no means of limiting or stopping a data breach [1].…”