사이버 위협 인텔리전스란 무엇인가요?
Cyber threat intelligence is information used to identify present, or future cyberattacks against an organization’s systems. Companies can subscribe to threat intelligence feeds and services to learn more about current malware or threat campaigns and take advantage of services to identify potential threats to a company, its employees and its customers.
사이버 위협 인텔리전스의 중요성
Cyber threat intelligence provides insight into the current threat landscape and the potential cyberattacks that companies can face. It also can include information about intrusions and other security incidents that an organization has already experienced.
Threat intelligence is key to ensuring that organizations allocate limited cybersecurity resources to maximize the potential benefit to the organization.
With knowledge of current threat campaigns, companies can tune their defenses to maximize the potential that they will be able to identify and block future cyberattacks. Plus, threat intelligence is useful for identifying past intrusions into a company’s systems and gauging the potential impact on the business and its customers.
사이버 위협 인텔리전스에 포함된 내용
Cyber threat intelligence includes any information that can be used to help inform the business about potential cyber threats that they face and how to address them. The majority of threat intelligence deals with the current cyberattacks and active malware variants.
그러나 조직은 브랜드에 대한 위험이나 과거 데이터 침해로 인해 유출된 데이터에 대한 정보를 제공하는 보다 타깃화된 유형의 위협 인텔리전스에 액세스할 수도 있습니다.
공격자 전술, 기법 및 절차(TTP)
The bulk of technical threat intelligence data is related to the TTPs used by various threat actors. When new malware or cyberattack campaigns are detected, security researchers collect and disseminate indicators of attack (IoAs) and indicators of compromise (IoCs) that can be used to identify these threats.
For instance, a strategic threat intelligence feed could include file hashes for new malware variants and the IP addresses and domain names associated with known cyber attack campaigns.
Organizations can subscribe to tactical threat intelligence feeds to collect this information and feed it to their security solutions. This data can also be filtered or personalized to identify the relevant threats that an organization is most likely to face, such as:
- 멀웨어 or cyberattacks targeting other organizations in the same industry or geographic region.
조직은 이 보다 타깃화된 위협 인텔리전스를 활용하여 직면할 가능성이 있는 위협의 유형과 이를 가장 효과적으로 방어할 수 있는 방법을 보다 정확하게 평가할 수 있습니다.
브랜드 보호
사이버 범죄자들은 일반적으로 피싱 공격에 유사한 이메일 주소와 웹사이트를 사용합니다. 이는 잠재적인 공격이 공격 대상에게 합법적인 것처럼 보이게 하고 브랜드에 대한 공격 대상의 신뢰를 이용하기 위해 고안되었습니다.
이러한 관행은 고객, 벤더, 공급업체 및 기타 파트너에 대한 조직의 평판을 크게 훼손할 수 있습니다.
아래 정보는 조직에 맞춤화된 실행 가능한 위협 인텔리전스로 수집할 수 있습니다:
- 의심스러운 도메인
- 피싱 웹사이트
- 소셜 미디어 사칭
- Unauthorized APKs
그런 다음 조직은 이러한 위협으로부터 브랜드를 보호하기 위한 조치를 취할 수 있습니다.
침해 모니터링
Often, it takes time for a breach to be detected, if the company notices it at all.
In the state of a data breach report, IBM and Ponemon differentiate between breaches identified within 200 days and those that took more than 200 days to detect when comparing the price and impact of faster breach detection.
어떤 경우에는 회사, 직원 또는 고객 데이터가 다크웹에서 판매되고 나서야 유출 사실을 알게 되는 경우도 있습니다. 침해 모니터링 서비스에서 찾을 수 있는 대상은 다음과 같습니다:
- 직원 자격 증명
- 고객 정보
- 지적 재산
- 다크웹에 판매 목적으로 게시되거나 광고된 기타 데이터
위협 인텔리전스의 혜택은 누구에게 제공되나요?
Threat intelligence provides insight into potential cyber threats a company may face or breaches that it has not yet identified within its systems.
This diverse set of security information has numerous potential applications within an organization.
One of the most common applications of strategic threat intelligence is for identifying potential security incidents via persistent threat detection and threat hunting. Threat intelligence feeds commonly provide IoCs that organizations can look for in their systems to either identify and block an impending attack or detect the presence of an intruder within their systems.
체크 포인트별 위협 인텔리전스 서비스
Threat Intelligence services are delivered Check Point Exposure Management and the Check Point Research (CPR) organization.
Check Point Exposure Management embeds real‑time threat intelligence directly into how exposures are prioritized and fixed.
By continuously correlating internal vulnerabilities, external attack surfaces, and live adversary activity from Deep and Dark Web monitoring and Check Point’s ThreatCloud AI, it highlights which weaknesses are actively exploited or most likely to be weaponized next.
The result is clear, intelligence‑backed prioritization, with security teams focus remediation on critical exposures, instead of chasing static CVE scores or endless alerts.
CPR is made up of over 150 researchers and analysts. This team also works closely with third parties, including other security vendors, various CERTs, and law enforcement.
CPR sources threat intelligence and other data from a variety of different locations. These include publicly accessible sources, Check Point’s ThreatCloud AI, external solutions and technologies provided by our service partners, and intelligence collected from the dark web.
내부적으로 보안팀은 기업이 진화하는 위협 환경에 발맞출 수 있도록 맞춤형 머신 러닝 모듈, 리버스 엔지니어링, 이상 징후 탐지, 캠페인 헌팅 기술을 개발했습니다.
데모 받기 of Check Point Exposure Management’s Threat Intelligence Offering today.
