📋ISO 27001 A.5.7Rule: ISO27001-A57medium

Threat Intelligence

Description

Information relating to information security threats shall be collected and analysed to produce threat intelligence relevant to the organisation.

⚠️ Risk Impact

Threat intelligence is the radar for adversaries. Organisations without threat intel respond to attacks they didn't see coming — typically days or weeks behind organisations with active intel programs.

🔍 How EchelonGraph Detects This

ISO27001-A57Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.

🔧 Remediation

Subscribe to authoritative threat feeds: CISA KEV, MITRE ATT&CK, NVD, vendor-specific feeds (CrowdStrike, Mandiant). Integrate into detection rules. Run a weekly threat-brief for security team.

💀 Real-World Attack Scenario

Volt Typhoon (state-actor APT) activity was publicly characterised by CISA in Feb 2024. Organisations with threat intel subscriptions saw the attribution indicators (specific living-off-the-land binaries, target sectors) and hunted in their own environments. Three Fortune 500 organisations detected pre-existing Volt Typhoon presence purely from intel-driven hunts.

💰 Cost of Non-Compliance

Threat-intel maturity correlates with 2-3× faster threat detection (Mandiant M-Trends 2024). Average detection delay without intel: 9-12 months for state-actor activity.

📋 Audit Questions

  • 1.What threat intelligence feeds are subscribed?
  • 2.How is intel translated into detection rules?
  • 3.Show last 30 days of intel-driven hunts.
  • 4.Who reviews intel + briefs the team?

🎯 MITRE ATT&CK Mapping

T1078 — Valid Accounts

⚡ Common Pitfalls

  • ⛔Subscribing to too many feeds — drowning in noise
  • ⛔Intel that isn't operationalised into detection rules
  • ⛔No human review — intel arrives but nobody synthesises it

📈 Business Value

Threat intel transforms security from reactive to anticipatory. Material for high-target organisations (financial, healthcare, government, AI/tech).

⏱️ Effort Estimate

Manual

8-16 hours weekly for intel review + integration

With EchelonGraph

EchelonGraph integrates CISA KEV + MITRE ATT&CK into live detection

🔗 Cross-Framework References

NIST-RA-3SOC2-CC3.2

Automate ISO 27001 A.5.7 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →