Building an Intelligence-Led Security Program

Introduction

In February of this year I was on the floor of the RSA conference, the first one I had been to in many years, and I was struck by how much security seems to have changed in a very short time. Actually, to be more accurate, I was struck by how much security marketing seems to have changed in a very short time.

Almost every security vendor at RSA was touting its intelligence, whether it was native intelligence provided by the vendor directly into its platform or the vendor’s integration with third-party intelligence providers. Don’t get me wrong, I am a firm believer that intelligence is the best way to identify and resolve security incidents before they become a problem. But intelligence is not a data feed or a series of indicators. ...