Threat Intelligence Sharing Valued, But Many Not Doing it: Survey

Enterprises may largely agree that threat intelligence is important, but few are doing any actual sharing themselves, according to a new survey.

According to a survey by Enterprise Strategy Group (ESG), while 94 percent of the more than 300 IT professionals surveyed believe it is either highly or somewhat valuable to share threat intelligence between federal agencies and the private sector, only 37 percent actually share internally-driven threat intelligence with other companies or Information Sharing and Analysis Centers (ISACs).

“There is clearly an understood value in leveraging threat data, but organizations are finding it difficult to collect, analyze and pinpoint critical threats,” said Jon Oltsik, ESG senior principal analyst, in a statement.

Earlier this year, a separate study by the Ponemon Institute revealed a similar finding. In that survey, organizations expressed overwhelming support for threat intelligence, with 80 percent of those that had experienced a breach during the past two years stating that threat intelligence would have prevented or minimized the consequences of the attack. However while 45 percent of respondents said they are increasing the amount of intelligence data they receive, just nine percent classified the accuracy of that intelligence as “very reliable.”

“According to our research, automation is needed for organizations to wade through the mass of alerts they receive, and standards are needed for the secure sharing of threat intelligence,” Oltsik said.

One of the top challenges to using threat intelligence identified in the ESG survey is that the intel is collected and analyzed by different tools and individuals, which makes it difficult to get a comprehensive picture of internal and external threats. That was identified as a challenge by 32 percent of respondents. Twenty-eight percent said the threat intelligence they receive isn’t as timely or actionable as it needs to be. In addition, 31 percent also cited workflow process and integration problems.

Still, 72 percent said their organization plans to increase spending on their threat intelligence program in the next 12 months.

“The idea around sharing threat intelligence among organizations is rapidly gaining traction,” said Anne Bonaparte, CEO of Vorstack, which sponsored the study, in a statement. “To achieve this, organizations need a holistic picture of internal and external threats for the enterprise , and the ability to share threat intelligence among organizations in a manner that is secure, anonymous, non-attributed and standards based.”