CMMC RM.4.150 - Employ Threat Intelligence

CMMC RM.4.150 - Employ Threat Intelligence

Requirement text: RM.4.150: Employ threat intelligence to inform the development of the system and
security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171B
The constantly changing and increased sophistication of adversaries, especially the
advanced persistent threat (APT), makes it more likely that adversaries can successfully
compromise or breach organizational systems. Accordingly, threat intelligence can be
integrated into and inform each step of the risk management process throughout the system
development life cycle. This includes defining system security requirements, developing
system and security architectures, selecting security solutions, monitoring (including threat
hunting) and remediation efforts.

Support References:
      • NIST SP 800-30 provides guidance on risk assessments.
      • NIST SP 800-39 provides guidance on the risk management process.
      • NIST SP 800-160-1 provides guidance on security architectures and systems security
        engineering.
      • NIST SP 800-150 provides guidance on cyber threat information sharing.

CMMC CLARIFICATION
Threat intelligence (See RM.4.149 and SA.3.169) provides for an organization with a better
understanding of the adversaries and their TTPs. This understanding helps an organization
plan, design, architect, and integrate solutions in a manner that will help thwart adversary
activities. This understanding should be used to design the enterprise architecture as well
as the endpoint monitoring capabilities and to plan threat hunting actions. Threat
intelligence can be very valuable when an organization is building their defensive playbook.
Having defensive response and recovery actions planned prior to an attack taking place is
key to having efficient and timely defensive cyber operation actions.

Practice IR.4.100 requires a similar use of adversary knowledge for incident response and
execution.

Example 1
Your organization recently started subscribing to a threat feed service to gain valuable
intelligence on adversary actions and what is currently happening against other
organizations. Based on information gained from this service, your DCO team utilizes the
information to hunt for adversary TTPs received from the service every day. This
information helps provide up-to-date TTPs, and it also provide the latest adversarial actions
taking place across other organizations subscribing to the threat feed, as well. This
information is invaluable in molding your architecture towards specific threats as the
information is received.

Example 2
Your new threat feed has recently sent out information that states a specific action against a
specific vendor solution is underway at various organizations similar to your own. This
information is passed to your DCO team for hunting operations, and the architecture team
utilizes it to make small adjustments to the organizations enterprise architecture that
prevents similar tactics from being successful in your environment.

References
• Draft NIST SP 800-171B 3.11.1e
• NIST CSF v1.1 ID.RA-2, ID.RA-3

    • Related Articles

    • CMMC RM.4.149 - Employ Threat Profiling

      Requirement text: RM.4.149: Catalog and periodically update threat profiles and adversary TTPs. DISCUSSION FROM SOURCE: CMMC One method that more mature enterprises can use to protect its systems is to employ threat profiles and better understand ...

    • CMMC SA.3.169 - Use Cyber Threat Intelligence

      Requirement text: SA.3.169: Receive and respond to cyber threat intelligence from information sharing forums and sources and communicate to stakeholders. DISCUSSION FROM SOURCE: CMMC Establish relationships with external organizations to gather cyber ...

    • CMMC SC.4.199 - Use Threat Intelligence to Manage DNS Requests

      Requirement text: SC.4.199: Utilize threat intelligence to proactively block DNS requests from reaching malicious domains. DISCUSSION FROM SOURCE: CMMC Threat intelligence can provide information on known, bad domain names. Using that information to ...

    • CMMC SI.4.221 - Use Threat Indicator Information

      Requirement text: SI.4.221: Use threat indicator information relevant to the information and systems being protected and effective mitigations obtained from external organizations to inform intrusion detection and threat hunting. DISCUSSION FROM ...

    • CMMC SA.4.171 - Implement Cyber-Threat Hunting

      Requirement text: SA.4.171: Establish and maintain a cyber-threat hunting capability to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls. DISCUSSION FROM SOURCE: DRAFT ...