Building a Threat and Vulnerability Intelligence Program
Building a Threat and Vulnerability Intelligence (TVI) program from the ground up requires more than just collecting feeds; it needs a clear strategy for ingestion, operational response, and executive alignment. In this post, I will walk through how I used real-time intelligence, operationalized technical workflows across IOCs, TTPs, third parties, and zero-days, and established a governance loop that provided total visibility to the C-suite and Board.
I set up the threat and vulnerability intelligence program. We first were using Rapid 7’s IntSights as a TIP, then migrated to Dataminr (Way better). We subscribed to H-ISAC and used Feedly to aggregate open-source intelligence.
We also got regular reports from Mandiant, Rapid7, CrowdStrike, Deepwatch, and a company called Blackthorne did regular presentations on primary threat actors of healthcare.
In our TIP, we listed and monitored our top applications that we used, and the top vendors that were critical to business operations.
We had a weekly summary of what was happening in this space and rolled up a monthly summary into our executive leadership decks that could be used for board level discussion.
Any threat alerts that went out were either news of attacks, their TTPs and their IOCs, or zero-day vulnerabilities. IOCs would go into ServiceNow that would propagate to our secure email gateway, our managed detection and response suite, and to our firewalls, while our incident response team would perform queries into our SIEM to validate that those IOCs were not present in our environment. The attack TTPs are analyzed by our detection engineers and converted to use-cases into our SIEM, are assigned a criticality, and tested with our incident response team. If a playbook didn’t exist for that use-case, it was developed.
If the news of attack was about a 3rd party or vendor, we would communicate out to our vendor management team, our strategic sourcing team, our FTP team, our BISO team, and the senior leadership team. We would perform a quick impact assessment to determine how our company was affected and if we had connectivity to the 3rd party or vendor, we would escalate to the business leader of that relationship and determine severity and if there was a business continuity plan. If needed, we would cut our connections and monitor the situation and wait for an attestation of compliance from a third-party organization before resuming connectivity.
Zero-day vulnerabilities would be communicated to our vulnerability governance team for an impact assessment, the exploitable assets would be identified, and the owners of those assets would be required to create an immediate plan of attack on deploying a patch to non-prod, calling in for emergency testing, and then deploying to production.
News of both TTPs/IOCs and vulnerabilities would get communicated to our BISO team and to senior leadership, my peers, so that we can address any concerns with executive leadership and our customers. Instilling assurance that we are doing our due diligence.
In short, we built an intelligence engine that converted raw threat data into automated defenses, established rigorous protocols for supply chain and zero-day risks, and delivered continuous transparency to executive leadership. A strong TVI program isn’t measured by the volume of threat feeds you subscribe to, but by how fast and effectively that intelligence drives action across your environment.
