Every week, we read in the news of another breach or targeted campaign, as more patches are released to protect against the next strain of sophisticated malware. For the administrators responsible for safeguarding a company’s systems, networks, and digital information, keeping up is an overwhelming task, made doubly difficult because it is often hard to determine the most significant threats.
To serve those admins, Intel Security began work nine months ago to design a new dashboard that identifies the most significant threats and illustrates the relationships between them.
We want to assist security practitioners when they make decisions about which vulnerabilities should be patched first, based on the prevalence of attacks that exploit those vulnerabilities.
Using vulnerabilities as the pivot point, the Threat Landscape Dashboard illustrates the relationships among exploit kits, campaigns, and ransomware. For example, the RIG exploit kit takes advantage of vulnerabilities that are used to spread certain ransomware families. Further, some of these vulnerabilities are also seen in targeted campaigns. Consequently, we can show links between exploit kits and targeted campaigns through vulnerability correlation. We also calculate a “risk score” for each threat and campaign, and recently added a “media score,” too. Monitoring and processing information from social media feeds, we calculate a score for the press attention received by the specific threat or campaign.
On each threat’s details page, we provide reference links to more information about the threat, including the source, blogs, and whitepapers. The dashboard also supports RSS feeds.
This is just the beginning for the Threat Landscape Dashboard; we are eager for your feedback. In the near future we plan to expand the dashboard with detailed threat descriptions and more contextual data. That information will be available through the RSS feed so users can import the feed and, based on keywords, filter the incoming stream.
To view the Threat Landscape Dashboard, visit tld.mcafee.com. It is also accessible through the Threat Center at www.mcafee.com/threatcenter. To provide feedback on the dashboard, please email me at christiaan[dot]beek[at]intel[dot]com.