Chapter 15: Threat Intelligence Sharing and Cyber Activity Attribution – Practical Use Cases

Sharing threat intelligence has proven beneficial to the security community, helping organizations strategically, tactically, and operationally. Intelligence can be shared in several ways and formats. The Cyber Threat Intelligence (CTI) analyst or team must be comfortable drafting threat intelligence reports and preparing output for internal and external dissemination. When conducting threat intelligence, they should understand how to build threat activity groups and campaigns from analyses. Awareness of nation-state or state-sponsored actors' influences and advanced cyber criminals' threats in the cyber arena is critical in tracking some of the most sophisticated cyber activities. Previous attacks and breaches have shown that state-sponsored actors can target private institutions. Therefore, the CTI analyst or team should be able to conduct an Analysis of Competing Hypotheses...