Levels of Cyber Threat Intelligence
Cyber threat intelligence is a very broad term. With the most comprehensive meaning including collecting intelligence using publicly available information (open source intelligence), the question "how does it do that?" divides it into 4 subcategories: tactical, technical, operational and strategic, according to CPNI.
The most crucial thing to do when protecting information from outside attacks is to identify the risks, possible entry points the attackers might try to use, their motives and plans, basically everything that can help company management make decision about its next move. This is what strategic threat intelligence is all about. It analyzes possible threats and makes an informed risk management decisions based on that information. Operational part of intelligence brings details to specific attacks and tries to determine the future threats. Tactical threat intelligence, on the other hand, involves individuals who are specialized to detect and response to incoming attacks.
Possibly a better approach of defining these parts would be to imagine layers they operate on and questions they give answer to:
To conclude this post, good defense means good communication between the levels of CTI and collecting necessary information to defend yourself because today, using CTI might be the bridge between survival and downfall of a company.
Picture 1. Levels of CTI
Possibly a better approach of defining these parts would be to imagine layers they operate on and questions they give answer to:
- The top layer, where Strategic TI operates will provide information on "who would attack us and why?".
- One layer above operational intelligence answers to "what kind of an attack should we anticipate?"
- Tactical TI would be the bottom layer giving an answer to the question of "how to deal with an attack?" .
The goal of the threat intelligence analyst is to produce relevant, timely, accurate intel on cyber threats - especially those associated with espionage, hacktivism, cybercrime, malicious software, social engineering, and other emerging threats. Essentially, the analyst needs to focus on providing the �who, what, when, where, why, how, and importance� of cyber threats to the business, and help the business reduce overall risk.- Adam Meyer, securityweekAlthough this seems pretty straight forward on paper, in reality the attackers behavior can become very creative. That being said, collecting precise intelligence is far better then getting every possible information that is out there. It will get overwhelming pretty fast which wont help too much on protecting your goal.
To conclude this post, good defense means good communication between the levels of CTI and collecting necessary information to defend yourself because today, using CTI might be the bridge between survival and downfall of a company.
download file now
alternative link download