Ashraf Sheet, regional director, Middle East and Africa, Infoblox, discusses why threat intelligence sharing is key to staying cyber-resilient in the connected era.
Cybersecurity is a team sport. Today, the bad guys share information, expertise, and code as they help one another infiltrate organisations. However, the good guys are lagging behind.
As the security landscape becomes more complex and interconnected, cooperation between individuals and organisations is proving to be increasingly crucial. For enterprises, threat intelligence is a key cybersecurity element and sharing this information is instrumental to the success of a security strategy.
“Companies today are always on the look-out for the latest security solutions,” said Ashraf Sheet, regional director, MEA, Infoblox. “They seek to protect multiple IT layers from mission-critical assets to the network to the endpoint and so on. However, often, organisations onboard multiple technologies from different vendors.”
Security teams often need to buy a separate solution to address varying threats or vulnerabilities. However, due to this, they tend to struggle with the abundance of cybersecurity point solutions and the lack of integration among them.
“Even in a connected environment, solutions from varying vendors don’t communicate with one another,” Sheet explained. “This leaves organisations with clusters of information that are too complex and incohesive.”
Sheet further explained that the threat data gets too diverse and identifying potential risks, prioritising them, and allocating security resources become cumbersome.
“Having a cohesive set of threat data shared by all devices is the best way to eliminate this challenge,” he said. “The goal is ensuring that when one device detects a bad compromise that information will be disseminated across the entire network to ensure that this information can be optimised by all other relevant IT layers.”
Unfortunately, sharing is still not a norm. Security companies look at data as a competitive advantage to sell their products and services. They tend to keep it to themselves in hopes of uncovering a nugget that will enable them to win against competing security vendors. But the cost of this approach is losing the bigger picture for security. “Security players should aim to lower the risks for customers,” Sheet explained. “The goal is to protect organisations from what will make them vulnerable.”
According to Sheet, the mindset is slowly changing, however, there is still a lot of work that needs to be done and Infoblox can play a big role in expanding awareness on the importance of threat intelligence sharing.
“We don’t compete with different security solutions, in fact, we complement them and because of this we are able to create a threat intelligence ecosystem that communicates to all kinds of security vendors,” said Sheet. “Organisations prefer sharing with a neutral party or a trusted intermediary rather than sharing with companies directly, indicating the need for a trusted, neutral exchange platform.”
Infoblox, according to Sheet, also provides a central threat intelligence platform, which allows speedy distribution information to customers. “More than being able to deliver a timely and actionable threat intelligence, having a core threat data source enable organisations to reduce costs and streamline resources.
“We are in an era where global threats are rapidly evolving and intelligence should be shared. Every information and ability should be leveraged to cope with growing threats,” said Sheet.
The battle in the digital age landscape should not be between security players, but rather between the threat actors and security innovators. No organisation can detect all the threats or understand what they mean on their own. Therefore, collaboration is key to create stronger defences.
