Threat intelligence

What the control asks

Information about security threats is to be gathered and examined so that it yields threat intelligence. Purpose: make the organization aware of the threats around it so that fitting mitigations can be chosen. Guidance: knowledge of current and emerging threats is analysed so the organization can act to stop them doing harm and lessen their effect. All three layers should be considered: strategic (the broad picture of how the threat landscape is shifting, such as kinds of attacker or attack), tactical (how attackers operate, their tools and technologies) and operational (detail of particular attacks, including technical indicators). Good intelligence is relevant to protecting the organization, gives accurate and detailed insight, carries context (timing, location, past experience, how common it is among similar organizations) and can be acted on quickly. The activities are: set objectives for producing intelligence; identify, vet and choose internal and external sources; collect from them; process the material for analysis (translating, formatting, corroborating); analyse what it means for the organization; and pass it in understandable form to the people who need it. The results feed information security risk management, serve as extra input to technical preventive and detective tools such as firewalls, intrusion detection and anti-malware, and inform security testing. Intelligence should be shared with other organizations on a reciprocal basis. Other information: most organizations consume intelligence from independent providers, government agencies or collaborative groups rather than producing it, and controls 5.25, 8.7, 8.16 and 8.23 depend on its quality.

Purpose in the standard’s terms, in our words: Makes the organization aware of the threats it faces so fitting mitigations can be chosen.

Attribute values in one line: Preventive, Detective, Corrective; Confidentiality, Integrity, Availability; Identify, Detect, Respond; Threat and vulnerability management; Defence, Resilience.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Documented threat intelligence objectives and a process covering collection, processing, analysis and dissemination
• A list of vetted internal and external intelligence sources with the rationale for selection
• Threat intelligence outputs at strategic, tactical and operational levels, such as landscape briefings, attacker technique summaries and indicator feeds
• Evidence that intelligence updated the risk assessment or risk register
• Evidence that indicators were loaded into firewalls, intrusion detection, SIEM or anti-malware tooling and used in security test planning
• Records of reciprocal sharing with peer organizations or sharing communities

Where audits commonly find gaps

• Feeds are subscribed to but nobody analyses what they mean for the organization
• Only operational indicators are consumed and strategic or tactical intelligence is ignored
• Intelligence does not reach risk management or the teams running detective controls
• Sources are never evaluated for reliability or relevance

What ISO/IEC 27028 changes for this control

It carries more than one control type (preventive, detective, corrective), so the register should record each and the evidence that proves each one operates. It is one of the eleven controls added in the 2022 edition, so a register carried over from the previous edition may have no row for it. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.5 Contact with authorities
• 5.25 Assessment and decision on information security events
• 5.28 Collection of evidence

Read the five attributes All 93 controls