サイバー脅威インテリジェンスとは何ですか?
Cyber threat intelligence is information used to identify present, or future cyberattacks against an organization’s systems. Companies can subscribe to threat intelligence feeds and services to learn more about current malware or threat campaigns and take advantage of services to identify potential threats to a company, its employees and its customers.
サイバー脅威インテリジェンスの重要性
Cyber threat intelligence provides insight into the current threat landscape and the potential cyberattacks that companies can face. It also can include information about intrusions and other security incidents that an organization has already experienced.
Threat intelligence is key to ensuring that organizations allocate limited cybersecurity resources to maximize the potential benefit to the organization.
With knowledge of current threat campaigns, companies can tune their defenses to maximize the potential that they will be able to identify and block future cyberattacks. Plus, threat intelligence is useful for identifying past intrusions into a company’s systems and gauging the potential impact on the business and its customers.
サイバー脅威インテリジェンスに含まれるもの
Cyber threat intelligence includes any information that can be used to help inform the business about potential cyber threats that they face and how to address them. The majority of threat intelligence deals with the current cyberattacks and active malware variants.
ただし、組織は、よりターゲットを絞ったタイプの脅威インテリジェンスにアクセスできる場合もあり、ブランドに対するリスクや過去のデータ侵害によって漏洩したデータに関する情報を提供します。
攻撃者の戦術、技術、および手順(TTP)
The bulk of technical threat intelligence data is related to the TTPs used by various threat actors. When new malware or cyberattack campaigns are detected, security researchers collect and disseminate indicators of attack (IoAs) and indicators of compromise (IoCs) that can be used to identify these threats.
For instance, a strategic threat intelligence feed could include file hashes for new malware variants and the IP addresses and domain names associated with known cyber attack campaigns.
Organizations can subscribe to tactical threat intelligence feeds to collect this information and feed it to their security solutions. This data can also be filtered or personalized to identify the relevant threats that an organization is most likely to face, such as:
- マルウェア対策 or cyberattacks targeting other organizations in the same industry or geographic region.
このより的を絞った脅威インテリジェンスを活用することで、組織は直面する可能性のある脅威の種類と、それらに対する最善の防御方法をより正確に評価できます。
ブランド保護
サイバー犯罪者は、フィッシング攻撃でよく似たメールアドレスやウェブサイトを使用します。 これは、潜在的な攻撃がターゲットに対して正当であるように見せ、ターゲットのブランドに対する信頼を利用するように設計されています。
この慣行は、顧客、ベンダー、サプライヤー、およびその他のパートナーに対する組織の評判を著しく損なう可能性があります。
以下の情報は、組織にパーソナライズされた実用的な脅威インテリジェンスとして収集できます。
- 疑わしいドメイン
- フィッシング Web サイト
- ソーシャルメディアのなりすまし
- Unauthorized APKs
その後、組織はこれらの脅威からブランドを保護するための措置を講じることができます。
侵害の監視
Often, it takes time for a breach to be detected, if the company notices it at all.
In the state of a data breach report, IBM and Ponemon differentiate between breaches identified within 200 days and those that took more than 200 days to detect when comparing the price and impact of faster breach detection.
場合によっては、企業、従業員、または顧客のデータがダークウェブで販売されている場合にのみ、企業が侵害に気付くことがあります。 侵害監視サービスでは、次の点を検索できます。
- 従業員の資格情報
- お客様情報
- 知的財産
- ダークウェブに投稿または販売のために宣伝されたその他のデータ
脅威インテリジェンスの恩恵を受けるのは誰ですか?
Threat intelligence provides insight into potential cyber threats a company may face or breaches that it has not yet identified within its systems.
This diverse set of security information has numerous potential applications within an organization.
One of the most common applications of strategic threat intelligence is for identifying potential security incidents via persistent threat detection and threat hunting. Threat intelligence feeds commonly provide IoCs that organizations can look for in their systems to either identify and block an impending attack or detect the presence of an intruder within their systems.
チェック・ポイント別の脅威インテリジェンス・サービス
Threat Intelligence services are delivered Check Point Exposure Management and the Check Point Research (CPR) organization.
Check Point Exposure Management embeds real‑time threat intelligence directly into how exposures are prioritized and fixed.
By continuously correlating internal vulnerabilities, external attack surfaces, and live adversary activity from Deep and Dark Web monitoring and Check Point’s ThreatCloud AI, it highlights which weaknesses are actively exploited or most likely to be weaponized next.
The result is clear, intelligence‑backed prioritization, with security teams focus remediation on critical exposures, instead of chasing static CVE scores or endless alerts.
CPR is made up of over 150 researchers and analysts. This team also works closely with third parties, including other security vendors, various CERTs, and law enforcement.
CPR sources threat intelligence and other data from a variety of different locations. These include publicly accessible sources, Check Point’s ThreatCloud AI, external solutions and technologies provided by our service partners, and intelligence collected from the dark web.
社内では、セキュリティチームがカスタム機械学習モジュール、リバースエンジニアリング、異常検出、キャンペーンハンティングの手法を作成し、企業が進化する脅威の状況に対応するのを支援しています。
デモをリクエスト of Check Point Exposure Management’s Threat Intelligence Offering today.
