4.3 Threat intelligence

Question 1

Threat intelligence

Answer 1

• Research the threats– And the threat actors
• Data is everywhere– Hacker group profiles, tools used by the attackers,
  and much more
• Make decisions based on this intelligence– Invest in the best prevention
• Used by researchers, security operations teams,
  and others

Question 2

Open-Source Intelligence (OSINT)

Answer 2

• Open-source– Publicly available sources - A good place to start
• Internet - Discussion groups, social media
• Government data– Mostly public hearings, reports, websites, etc.
• Commercial data– Maps, financial reports, databases

Question 3

Proprietary/third-party intelligence

Answer 3

• Someone else has already compiled the threat
  information - You can buy it
• Threat intelligence services– Threat analytics– Correlation across different data sources
• Constant threat monitoring– Identify new threats– Create automated prevention workflows

Question 4

Information-sharing organization

Answer 4

• Public threat intelligence– Often classified information
• Private threat intelligence– Private companies have extensive resources
• Need to share critical security details– Real-time, high-quality cyber threat information sharing
• Cyber Threat Alliance (CTA)– Members upload specifically formatted
  threat intelligence– CTA scores each submission and validates across
  other submissions– Other members can extract the validated data

Question 4

Dark web intelligence

Answer 4

• Dark web– Overlay networks that use the Internet– Requires specific software and configurations to access
• Hacking groups and services– Activities– Tools and techniques– Credit card sales– Accounts and passwords
• Monitor forums for activity– Company names, executive names