IID made threat intelligence a team sport

A bank discovers a fake version of its website. Someone else’s customers may be next. The bank can warn its own staff, call a service provider, perhaps send an email to a trusted counterpart. But the useful discovery is still moving at the speed of somebody’s inbox. For IID, the Tacoma company formerly called Internet Identity, that was a business problem hiding inside a security problem.

• The job: collect, check and distribute cyberthreat intelligence.
• The product: ActiveTrust, a controlled exchange for enterprises and government agencies.
• The turn: Infoblox bought IID in 2016, joining intelligence to network controls.

Consider the everyday imbalance. Attackers can reuse infrastructure and techniques. Defenders may discover the same danger separately, paying for the same lesson twice. IID’s proposition was that organizations should be able to learn from one another without throwing sensitive information into a public bucket. The trick was making cooperation useful enough, and controlled enough, that people would actually participate.

A very expensive neighborhood watch

Internet Identity began in 1996. Its early work included domain management, followed by services for detecting and disabling phishing sites. In November 2005, Microsoft named the company as a supplier of confirmed phishing information for its browser and email protection technologies. IID worked in the unglamorous space between finding a fraudulent destination and getting somebody to do something about it.

That experience became ActiveTrust. Generally available in February 2014, after an earlier limited rollout, the platform combined a controlled intelligence exchange, a data layer for integrating tools, and a private collaboration network. Participants could govern what they shared and with whom. Imagine a neighborhood watch whose members operate banks and government networks, and whose reports need to be understood by software.

The business was software plus intelligence plus human expertise. A 2015 Forrester assessment described a searchable portal, a REST API and exports formatted for security-event systems. Analyst assistance could be purchased on a time-and-material basis. The value lay partly in doing the sorting: turning different people’s observations into information another organization could put to work.

That price makes the intended customer rather clear. This was enterprise security plumbing. A buyer needed staff, systems and exposure sufficient to justify the bill. Financial institutions, large online businesses and public agencies fit the proposition. Smaller organizations could benefit indirectly when IID’s intelligence reached services they already used, as the Microsoft relationship illustrated.

IID also occupied a peculiar competitive position: other intelligence businesses could become suppliers. Emerging Threats made premium data available through ActiveTrust in 2015. Forrester also identified Flashpoint as a contributor. The exchange could sit between vendors and the customer’s existing equipment, rather than require every useful observation to originate inside IID.

The cleanup nobody had finished

There is a revealing episode in IID’s earlier research. In February 2012, Brian Krebs reported the company’s finding that computers at half of Fortune 500 firms showed evidence of at least one DNSChanger infection. So did machines at 27 of 55 major government entities. Authorities had already disrupted the malware operation. The cleanup was still unfinished.

DNS translates names people recognize into addresses computers can reach. DNSChanger tampered with that arrangement. The episode exposed a stubborn distinction: disrupting an attacker’s infrastructure does not automatically repair every infected machine. Large, sophisticated organizations could know about a problem and still struggle to finish the work. A warning had to survive the journey into somebody’s operational queue.

“Enterprise security teams have a difficult time putting threat intelligence into operation.”

Lars Harvey / February 2016

That was the bottleneck IID and Infoblox eventually addressed together. Threat data needs checking. It needs to reach the right tool. Then someone, or some configured policy, needs to authorize a response. Each handoff can consume time. Buying another feed does little if the organization cannot translate its contents into a decision.

First a partner. Then a buyer.

The relationship had a public rehearsal. In July 2015, Infoblox introduced its DNS Threat Index, powered by IID. It tracked the creation of malicious domains, watching attackers assemble infrastructure before using it. The companies called the alternating activity planting and harvesting. Cybercrime, apparently, had an agricultural calendar. The index offered a way to discuss preparation, rather than count damage afterward.

On February 8, 2016, Infoblox acquired IID for an announced $45 million in cash, subject to adjustments. Its rationale was unusually concrete: ownership would permit deeper integration with on-premise products than a partnership alone. Infoblox managed core network services. IID brought outside intelligence. Combining them promised to connect a suspicious destination with the network activity that made it relevant.

The customer promise extended beyond a bigger database. Infoblox said it would retain ActiveTrust and Dossier, the investigation feature, while folding mitigation and takedown services into a premium package. Earlier, Bessemer had supplied IID’s first institutional financing, an $8 million round in 2013. That money backed expansion of the sharing platform; the acquisition addressed where its intelligence could land.

Give the warning somewhere to go

For a security team, the practical lesson is to start with a response: which system receives an indicator, who trusts it, and what action follows? Then work backward to the feed. Set sharing permissions before asking peers for information. Check quality before automating a block. A stale or mistaken indicator can turn rapid enforcement into rapid disruption.

The approach also depends on coverage. A DNS control can act on traffic it sees; bypassed controls and threats absent from the intelligence still require other defenses. Today, Infoblox describes IID’s technology as building blocks for Threat Defense and its analysts as part of the Threat Intelligence Group. The name receded. The operational question remains usefully blunt: after the warning arrives, what happens next?