Articles

Forget 007 Intel…What Truly Wins the War?

How important is intelligence in bringing victory or averting defeat? In our IT Security universe, this refers to "threat intelligence", which has been all the rage for some years now. Indeed, a number of providers charge hefty sums to provide best-of-breed, mixed strategic and tactical, with full actor information, detailed indicators, and with revelations about future attacks targeted at your organization. During a conference, attendees at a roundtable were asked, "If you hear 3 days in advance that you will be hit with a colossal DDoS attack of a particular type, will it help you?" Some people answered “yes” and pointed at specific things they can do in the time they have, while others said, “sort of”. They would still take heavy damage, but may be able to reduce panic and avoid some mistakes in responding. A few said that they will be able to do a few things only… and if the “3-day attack warning” costs them $100K, they won’t sign for it.

F.H. Hinsley, the historian of British intelligence in the real war against Hitler, made a sustained attempt to show how intelligence affected its outcome. His conclusion, which did not please the intelligence establishment, is that the efforts of MI6 and Bletchley Park shortened the war, but emphatically did not win it. As John Keegan noted "The reason is that the fiction of intelligence has worked so powerfully on the Western imagination that many of its readers, including presidents and prime ministers, have been brought to believe that intelligence solves everything. It stops wars starting. If they start nevertheless, it assures that the wrong side loses and the right-side wins."

Actual warfighters (= skilled security professionals) with weapons (=security tools), on top of threat intelligence are needed to win the war. As Chuvakin observed in this Threat Intelligence and Operational Agility article, telling armed peasants and spearmen that a ballistic missile is coming does not help – even if you know the exact model and who launched it. You need to have the defenses, tools, people, and effective processes already in place.

This is the value proposition of our SIEMphonic co-managed SIEM-as-a-service offering. Put our 24/7, ISO 27001-certified team of experts to work for you. They come armed with deep subject matter experience, robust processes,and award-winning weaponry. And oh yes, it’s all integrated with up-to-the-minute threat intelligence.

Still skeptical? See use cases about what the team has caught, in top-secret 007 fashion: from stories that "never happened" from "files that do not exist". Intel never wins wars on its own, but combined with effective teams, defenses, and processes, the right-side may always triumph.