ISO 27001 Annex A 5.7 Threat Intelligence

Threat Intelligence is a new control is ISO 27001:2022 and is about understanding and managing the threats to your information security. Threats to the confidentiality, integrity and availability of data.

It can be confusing when you first come to this control but I will show you what is required and some simple, practical steps you can take to implement it.

ISO 27001 Threat Intelligence is the identification and management of information security threats.

In ISO 27001 this is known as ISO27001:2022 Annex A 5.7 Threat Intelligence . It is one of the ISO 27001 Annex A controls.

Key Takeaways

• Sources of threat intelligence information are readily available and many are free
• Management of threats is done by risk management

What is ISO 27001 Annex A 5.7 Threat Intelligence?

ISO 27001 Annex A 5.7 Threat Intelligence is an ISO 27001 control that requires an organisation to collect and analyse information relating to information security threats and use that information take mitigation action.

Threat intelligence is used to prevent, detect or respond to threats. You can produce your own threat intelligence but as a rule you will make use of threat intelligence produced by others. It is often provided by independent providers and advisors which can include government sources and more than likely products and services will spring up around this new control to offer you it as a service, at a cost of course.

ISO 27001 Annex A 5.7 Purpose

ISO 27001 Annex A 5.7 is preventive, detective and corrective control that ensure you provide awareness of the organisations threat environment so that the appropriate mitigation actions can be taken.

Definition

The ISO 27001 standard defines ISO 27001 Threat Intelligence: Annex A 5.7 as:

Information relating to information security threats should be collected and analysed to produce threat intelligence.

ISO 27001:2022 Annex A 5.7 Threat Intelligence

Why is ISO 27001 Threat Intelligence important?

The purpose of this control is to provide awareness of the organisation’s threat environment so that the appropriate mitigation actions can be taken.

Taking collective knowledge of threats can lead to a collective response and that response can be based on collective best practice. If we share information we reduce the risk and impact of the emerging threats that are only ever going to increase. We cannot protect against what we do not know. As we start to know more we can increase our protection making for a safer, more secure working environment and protecting vital customer and employee data.

Implementation Guide

You are going to have to ensure that

• objectives for threat intelligence production are established
• internal and external sources of information are identified, selected and vetted where necessary and appropriate
• information is collected from selected sources
• information is then prepared for analysis for example by formatting or translating it
• information is analysed to understand how it relates to you
• communication and sharing of information is done to relevant in people in a way they will understand it

When implementing threat intelligence you are analysing and using information and including it in your risk management process. You are using it as input to inform how you implement and configure technical controls. You are adapting information security tests and techniques based on it.

Threat intelligence is used to inform decisions and actions to precent these threats causing harm to the organisation and reduce the impact of such threats.

There are 3 layers to threat intelligence.

The 3 layers of threat intelligence

1. Strategic Threat Intelligence: high level information about the threat landscape
2. Tactical Threat Intelligence: intelligence on tools, techniques and attack methodologies
3. Operational Threat Intelligence: intelligence on specific attacks and indicators

Threat intelligence objectives

When you write your threat intelligence process it will have objectives. Based on best practice real world experience the following are the objectives of the ISO 27001 Threat Intelligence process:

1. Identify Existing and Emerging Threats

Through the use of internal and external data sources existing and emerging threats will be identified. In addition, the use of audit processes such as internal audit, external audit and penetration testing will be used. 

2. Assess Risk and Impact

Threats will be analysed for relevance to the organisation. Where a relevant threat is identified it will be added to the risk register and managed via the risk management process.

3. Communication

Threat Intelligence will be shared with the Management Review Team as part of the regular structured agenda.

4. Improve the Information Security Management System (ISMS)

Threat Intelligence that identifies emerging and existing threats will be managed via the Risk Management Process and any changes or improvements will be managed via the Continual Improvement Process.

Examples of threat intelligence sources

There are free sources of threat intelligence information that you can use. These can be internal or external so let us take a look at examples of threat intelligence sources you can use:

Internal Sources of Threat Intelligence

The controls and processes that you operate will provide valuable threat intelligence information that you will identify through trend analysis and incident management. The examples include:

• Anti-Virus and Malware Protection Reports
• Information Security Incident Reports
• Phishing Reports
• Internal Audit Reports

External Sources of Threat Intelligence

External sources of threat intelligence are readily available from vendors and government websites. The following are examples:

• UK National Cyber Security Centre
• CISA.gov – Official website of the U.S. Department of Homeland Security
• SANS™ Internet Storm Center

The threat intelligence reporting process

When you collect the threat intelligence information you are going to report on it so you can act on it. The process for threat intelligence reporting, based on practical real world experience would be:

• A Threat Intelligence Report is created.
• The Threat Intelligence Report is shared with The Management Review Team.
• The Threat Intelligence Report is shared at least at the Management Review Team Meeting and if a significant threat is identified.
• Threat Intelligence Reports are kept for at least 12 months.
• Progress of Threat Mitigation is reported via the Risk Management Process and Continual Improvement Process as relevant.

The contents of the threat intelligence report

The Threat Intelligence Report gives a high-level threat snapshot summary. When creating the threat intelligence report it would include:

• Threat Summary: A summary in simple of terms of the threat that can be understood by someone with no technical knowledge.
• Source: The source of the threat. Either a link or a description in words of how the threat was identified.
• Threat Level: Using a simple, easy to understand rating of High / Medium and Low the initial rating is a subjective rating on the potential risk and impact to the organisation. The objective rating will be derived as part of the risk management process.

For each threat in the summary table a more detailed report is provided that includes recommendations on next steps, whether it is added to the risk register and if so a risk reference.

How to create a threat intelligence process and report in under 10 minutes

In this video tutorial I show you How to create a Threat Intelligence Process in Under 10 Minutes

If you are wanting to do this yourself I show you How To Create an ISO 27001 Threat Intelligence Process and Report in this step-by-step implementation guide.

Watch the Tutorial

In the video ISO 27001 Annex A 5.7 Threat Intelligence Explained show you how to implement it and how to pass the audit.

ISO 27001 Threat Intelligence Template

You can save months of effort with the ISO 27001 Toolkit that take 25 years of experience and distill it in a pack of prewritten best practice awesomeness.

If you don’ want of need the full ISO 27001 Toolkit then this is the ISO27001 Annex A 5.7 Threat Intelligence Templates. Both the threat intelligence process and the threat intelligence report.

How to comply

To comply with ISO 27001 Annex A 5.7 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:

• Establish and document objectives for threat intelligence production
• Identify, vet, list and document internal and external sources of information
• Collect the information
• Prepare the information for analysis for example by formatting or translating it
• Analyse information to understand how it relates to you
• Communicate and share information to relevant people in a way they will understand it

How to pass the audit

To pass an audit of ISO 27001 Annex A 5.7 Threat Intelligence you are going to make sure that you have followed the steps above in how to comply.

What will an auditor check?

The audit is going to check a number of areas. Lets go through the main ones

1. That you are gathering threat intelligence and analysing it

What this means is that you need to show that you have a list of sources of threat intelligence information, have records of collecting and show reports where you have shared and communicated it.

2. That you have taken action as a result of threat intelligence

The process may be straightforward. You may have updated a system, changed a configuration, introduced or removed a tool, had an incident that was managed via the incident management process. What ever the course of action you will have records of action taken and audit trails.

3. That threat intelligence forms part of risk management and operations

Your risk management process will factor in and evidence threat intelligence. Your risk register may take account of threat intelligence and emerging or realised risks.

Top 3 Mistakes People Make

In my experience, the top 3 Mistakes People Make For ISO 27001 Annex A 5.7 Threat Intelligence are

1. You are not collecting or using threat intelligence

This is a new control so one that is easy to overlook. Make sure to follow the control requirements and be able to evidence its operation.

2. You rely only on internal threat intelligence

Internal threat intelligence is easy to collect but does not provide for the wider picture. Be sure to include external sources of threat intelligence data.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

ISO 27001 Annex A 5.7 FAQ

Related ISO 27001 Controls

ISO 27001 Annex A 7.5 Protecting Against Physical and Environmental Threats

ISO 27001 Annex A 8.15 Logging

ISO 27001 Clause 9.1 Monitoring, Measurement, Analysis, Evaluation

ISO 27001 Controls and Attribute Values