Threat intelligence researcher: Is it the career for you?

No one is immune to a cyberattack. For this reason, it pays to have a playbook of offensive and defensive strategies.

If you think of your defense as recovery, or remediation steps to take after you’ve been hit with a breach, then your offense is prevention. This might include basic block-and-tackle tools like anti-virus and encryption, but it can also mean taking a deeper dive into emerging threats and the attackers who perform them. This is cyber threat intelligence and it’s carried out by threat intelligence researchers.

For Amyn Gilani, vice president of product at threat intelligence company, 4iQ, the work is about disrupting adversaries by unmasking them. “How can we understand the people that are attacking us and how can we disrupt them so we can reduce the losses associated with fraud within our organization?”

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

What is cyber threat intelligence?

The basic premise behind threat intelligence is the best way to stop a threat is to know it. This can be applied to malware — understanding its origin and impact so it can be quickly stopped or, as is the case with Gilani and his company, understanding the attackers themselves so effective stops can be put in place.

“It’s not about finding the bad person and attacking them,” Gilani says. “It’s about knowing how this bad person impacts your network. How do they disrupt your operations?”

Gartner defines threat intelligence as evidence-based knowledge — including context, mechanisms, indicators, implications and actionable advice — about an existing or emerging menace or hazard to IT or information assets. It can be used to inform decisions regarding the subject's response to that menace or hazard.

Often, the practice of threat hunting is used as a supplement to other cyber defenses to shore up loose ends and ensure a fortified security posture for your data and your users. For Gilani and his company, the mission is larger. “Not many organizations choose to go after these criminal groups and that makes it a lot easier for their business to continue. As long as there’s no action, it’s going to continue to grow. We want to make sure there is responsibility behind these attacks.”

What does a threat intelligence researcher do?

Charles DeBeck is a strategic cyber threat expert for IBM’s X-Force Incident Response and Intelligence Services, and he describes threat intelligence as looking outside your walls to see where attackers are coming from and how they are trying to get in. With that knowledge, you can fortify your defenses (and spend your budget) at the point they are most often trying to get in.

Threat intelligence researchers will start by looking at indicators of compromise associated with threat actor activity. You may even do a deep dive into a few actors for a greater understanding of what is happening today. According to DeBeck, this knowledge can then be considered alongside an understanding of macro-level trends — what’s the trend this year? What have we been seeing over the last six months? Has ransomware become more prevalent, for example.

Combining these two things gives you ideas of what may be happening to your network, but then researchers will test out their theories. DeBeck looks at open-source data, internal data and dark web sources to find out if the ransomware spike is imminent. “Do we see people posting on forums for dark web marketplaces, ‘Hey, my ransomware-as-a-service is on sale now,’ or am I seeing more YouTube tutorials about how to use these sorts of products?”

“At the end of the day, threat intelligence is sort of science and an art,” DeBeck says. “There’s only so much the data can tell you because we don’t have perfect data.”

Threat intelligence researchers can be employed by government agencies or companies that ask that you hunt threats specific to them. These companies are usually large with already robust security teams and the budgets to support them. Researchers can also work for consulting firms that, very often, are commissioned by several different companies to compile threat intelligence.

Threat intelligence technology vendors are another option and researchers at these companies often split their time between threat hunting, product development and customer support. Freelance opportunities are another option.

What does it take to be a threat intelligence researcher?

While threat intelligence researcher employer types vary, the overall job market is smaller than many other cybersecurity positions. To land one of these roles, a strong cyber background is key. Certifications, along with other training and experience, will help you demonstrate your technical know-how, such as:

• Certifications are available at a variety of skill levels, such as the EC-Council Certified Ethical Hacker (CEH), CertNexus CyberSec First Responder and CompTIA CySA+
• On-demand training, such as Network Traffic Analysis and Advanced Intrusion Detection
• Hands-on cyber ranges and labs, including red and blue team exercises so you can understand both how attackers operate and how to defend against them

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

DeBeck also recommends you be well-versed in global happenings. Read the news, he suggests. This includes big brand consumer publications like CNN but also security trade journals. Great security insight can be gleaned that way, and it shows another important component to being a good threat intelligence researcher — passion.

“You can teach anyone basic technical skills, but you can’t train passion. Ten times out of 10, I will take a passionate candidate.”

To learn more about what it takes to become a threat intelligence researcher, watch our Cyber Work Podcasts, Hunting criminals and stolen identities across the internet with Amyn Gilani and Learn to become a cybersecurity technician with Charles DeBeck.

Sources

• Threat Intelligence, September 2021, Gartner IT Glossary