This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.

News reports show cyber attacks continue to outpace IT’s ability to protect critical data, but teams that have built systems to deliver accurate threat intelligence can often end an attack before damage is done. Threat intelligence comes from commercially available information, ongoing analysis of user behavior and native intelligence from within the organization.

The ideal approach is a security strategy that defeats malicious actors and leverages the extended network to stop attacks and protect critical data. Addressing the attack continuum—before, during and after the attack itself — is a logical approach. Each step of the continuum can be approached as follows:

* Before an incident takes place, the security team is monitoring the network for any possible vulnerability. Historically, security had focused on defense. Today, teams are developing ways to more intelligently halt intruders by gaining total visibility into network environments by leveraging resources like physical and virtual hosts, operating systems, applications, services, protocols, users, content and network behavior. Security teams can use this information to take action before an attack has even begun.

* During an incident, speed is critical. Security teams should quickly identify and understand threats and how to stop them to minimize their impact. Content inspection, behavior anomaly detection, context awareness of users, devices, location information and applications and other tools are critical to understanding an attack as it is occurring. Security teams also need visibility into where, what and how users are connected to applications and resources.

* After the incident, teams should take steps to understand what took place and – if damage was done – how to minimize its impact. Advanced forensics and assessment tools help security teams learn from attacks. Where did the attacker come from? Where did they find a way into the network? Could anything have been done to prevent the breach? More importantly, retrospective security enables an infrastructure that can continuously gather and analyze data to create security intelligence. Compromises that would have gone undetected for weeks or months can be identified, scoped, contained and remediated.

As a result, intelligence and understanding are crucial to any defensive strategy. Cybersecurity teams are trying to learn more about malicious actors, including why and how they are attacking. This is where the extended network provides unexpected value, delivering a depth of intelligence that cannot be attained anywhere else in the computing environment. Much like in counterterrorism, intelligence is key to stopping attacks before they happen.

Just as terrorists sometimes inflict damage disproportionate to their resources, such can be the case in cyberspace. Relatively small adversaries with limited means can inflict significant damage on larger foes. In these situations, intelligence is one of the most important assets for addressing threats. But intelligence alone is of little benefit without an approach that optimizes the organizational and operational use of intelligence.

However, by using network analysis techniques that enable the collection of IP network traffic as it enters or exits an interface, security teams can correlate identity and context. This enables teams to synthesize what they learn from multiple sources of information to help identify and stop threats. Sources include what they know from the Web and what is happening in the network, as well as a growing amount of collaborative intelligence gleaned from exchange with public and private organizations.

A well-constructed cybersecurity strategy will include an all-inclusive threat control plan that addresses the entire attack continuum: before, during and after. This enables security teams to find threats, defend against them and remediate the vulnerabilities that let them happen in the first place. When threat intelligence is used at the organizational and operational level, it provides a more comprehensive security posture. This process helps defenders think like attackers, and to use these insights to better protect their environments.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com