CMMC SI.4.221 - Use Threat Indicator Information

CMMC SI.4.221 - Use Threat Indicator Information

Requirement text: SI.4.221: Use threat indicator information relevant to the information and systems
being protected and effective mitigations obtained from external organizations to inform intrusion detection and threat hunting.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171B
The constantly changing and increasing sophistication of adversaries, especially the
advanced persistent threat (APT), make it essential that threat information relating to
specific threat events (e.g., TTP, targets) that organizations have experienced, mitigations
that organizations have found are effective against certain types of threats, and threat
intelligence (i.e., indications and warnings about threats that can occur) be sourced from and
shared with trusted organizations. This information can be used by organizational Security
Operations Centers (SOC) and incorporated into monitoring capabilities. Threat information
sharing includes threat indicators, signatures, and adversary TTP from organizations
participating in various threat-sharing consortia, government-commercial cooperatives, and
government-government cooperatives (e.g., CERTCC, US-CERT, FIRST, ISAO, DIB CS
Program). Unclassified indicators, based on classified information but which can be readily
incorporated into organizational intrusion detection systems, are available to qualified
nonfederal organizations from government sources.

CMMC CLARIFICATION
When conducting cyberattacks the attackers tend to operate using certain patterns of
behavior or exploit capabilities. This collection of patterns and capabilities are known as
Tactics, Techniques, and Procedures (TTP). An organization can build their knowledge of
attacker TTPs by participating in Information Sharing and Analysis Centers (ISAC) for their
industry. An ISAC collects cyber threat information relevant to the industry and its members
in order to improve the cyber posture of that industry. Based on the lines of business an
organization may consider more than one ISAC. An organization may also acquire TTPs
through commercial providers in order to integrate into various technologies.

Example
You are the manager of the Security Operations Center (SOC) and have recently added a role
to perform cyber threat hunting. You have been tasked to set up the process for the SOC.
You first identify relevant sources of threat information for the organization. You have the
organization join the National Defense ISAC and begin to interact with peers in the ISAC. You
capture events in your organization and share the TTPs with your peers. In return, they
share new TTPs with you. After downloading the TTPs, you build queries against the SOC’s
central repository for recurring searches. You also acquire a commercial threat indicator
feed of suspicious domains, known malware hashes, and IP addresses. You use these to
supplement a custom intrusion detection system.

ADDITIONAL READING

National Council of ISACs: https://www.nationalisacs.org/


NIST Special Publication 800-150: Guide to Cyber Threat Information Sharing:

Homeland Security Systems Engineering & Development Institute Cyber Threat Modeling:

References
• Draft NIST SP 800-171B 3.14.6e
• NIST CSF v1.1 ID.RA-2, ID.RA-3

    • Related Articles

    • System and Information Integrity: SP 800-171 Security Family 3.14

      Integrity is defined as guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. It is the assertion that data can only be accessed or modified by the authorized employees. ...

    • CMMC SA.3.169 - Use Cyber Threat Intelligence

      Requirement text: SA.3.169: Receive and respond to cyber threat intelligence from information sharing forums and sources and communicate to stakeholders. DISCUSSION FROM SOURCE: CMMC Establish relationships with external organizations to gather cyber ...

    • CMMC SI.1.211 – Protect Information Systems from Malicious Code

      Requirement text: SI.1.211: Provide protection from malicious code at appropriate locations within organizational information systems. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Designated locations include system entry and exit points which ...

    • CMMC SC.4.199 - Use Threat Intelligence to Manage DNS Requests

      Requirement text: SC.4.199: Utilize threat intelligence to proactively block DNS requests from reaching malicious domains. DISCUSSION FROM SOURCE: CMMC Threat intelligence can provide information on known, bad domain names. Using that information to ...

    • CMMC SA.4.171 - Implement Cyber-Threat Hunting

      Requirement text: SA.4.171: Establish and maintain a cyber-threat hunting capability to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls. DISCUSSION FROM SOURCE: DRAFT ...