Whether in the private or public sector, the term “cyber” means different things to different people, especially when words like “security,” “attack” and “defense” are attached to it. I particularly struggled with the term “defensive cyber operations,” having heard people use “cyber defense” and “cybersecurity” interchangeably. To me, cyber defense sounds like a cooler-sounding version of cybersecurity. In this blog, I’ll try to clear up the confusion and explain how the differences affect cyberspace operations.
The Department of Defense’s (DoD’s) online doctrine, Joint Publication 3-12, divides cyberspace operations into three parts: offensive, defensive and DoD information network (DODIN) operations. The divide between offensive and defensive is relatively straightforward, albeit nuanced, but the difference between DODIN and Defensive Cyberspace Operations (DCO) is less obvious. The publication outlines four possible actions in cyberspace operations: attack, exploitation, defense and security. Security falls within the realm of DODIN operations, while defense falls under DCO.
You may wonder how cyberspace defense can differ from cyberspace security. Well, the publication clearly defines the difference: DODIN operations and cyberspace security are threat agnostic. In other words, operators perform cyber defense and DCO with a specific threat in mind while performing cybersecurity with general security measures. Therefore, DCO exists and operates completely based on threat intelligence.
Threat intelligence provides external context to security teams. Security teams use this information to defend against anticipated threats. The information may originate from other networks or from threat researchers who know where to find hacker preparation activities. President Biden specifically called out the need for better threat intelligence in his Executive Order on Improving the Nation’s Cybersecurity. He proposed sharing more information about threats between service providers and agencies within industry-recognized formats.
Integrating threat intelligence into threat hunting and incident investigation is still a highly manual process. Security analysts must query their different feeds and deduplicate incidents between them. If they trust one feed more than another, they manually compare the two feeds. The analysts will learn each feed’s API and use the results to either create alert rules or determine if the existing alerts match a specific threat actor. If evidence of an attack is found on their network, they then compile the information about the attacker to share externally.
Cyber operators within agencies can accelerate the execution of DCO using Cortex XSOAR, which provides centralization, deduplication, threat correlation and intelligence sharing.
Centralization
Cortex XSOAR has 165 threat intelligence integrations. Regardless of which threat intelligence platform is used, threat intelligence teams can manage all of their threat intelligence indicators and data in a single location. They can see which threat indicators appear across multiple threat feeds, showing high-fidelity indicators. The threat intelligence teams can then more easily integrate these disparate feeds into a streamlined workflow for security operations personnel.
Deduplication
When teams use multiple threat intelligence feeds, they will receive duplicate threat intelligence information from the different sources. Cortex XSOAR deduplicates the threat intelligence objects for alert creation or enrichment and enables deduplication of those alerts. Security teams can use threat intelligence to determine which alerts are part of a single campaign by a specific threat actor. Analysts can combine the context from these alerts in order to view the entire lifecycle of the attack and enable thorough incident response.
Threat Correlation
Security teams may use threat intelligence to generate alerts or determine if existing alerts are tied to a known threat actor. Cortex XSOAR simplifies and automates both of these tasks. Using high-fidelity intelligence sources, Cortex XSOAR can create rules and push them into a security information and event management tool for alert generation. It can also extract indicators from existing alerts to determine if the alerts match an existing threat actor. This helps security teams triage a high number of alerts.
Intelligence Sharing
When security teams discover threats within their environments, Cortex XSOAR allows automatic generation of threat profiles and can export those profiles using the Structured Threat Information Expression (STIX) format for sharing with partners. This allows different organizations to help one another defend against various threat actors. They can pool their resources to fend off large-scale attacks.
For government agencies actively looking for improved threat detection and response, Cortex XSOAR places threat intelligence at the heart of security operations. Intelligence-focused operations enable rapid, streamlined and well-informed defensive cyber operations.
Learn more about Cortex XSOAR. Contact the Palo Alto Networks federal team for additional information.