How A Lower Maturity Security Organization Can Use Threat Intel

Historical Archive Note: This post was originally published on the Gartner Blog Network on May 16, 2016 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2016/05/16/how-a-lower-maturity-security-organization-can-use-threat-intel/ | Archive.org Snapshot

This post discusses How A Lower Maturity Security Organization Can Use Threat Intel, addressing enterprise architecture considerations and operational guidance based on our ongoing research inquiries on the Gartner Blog Network.

In analyzing security operations, detection telemetry, and incident handling workflows, practitioners must carefully balance organizational design, process maturity, and technology automation.

Key takeaways and recommendations:

• Define explicit operational use cases before committing to technology tooling.
• Ensure telemetry normalization and detection engineering feedback loops are established.
• Foster close collaboration between monitoring, detection engineering, and incident response teams.

Related blogs:

• Cloud Security Monitoring!
• Two Essential SIEM Notes