Section 3: Integrating Cyber Threat Intelligence Strategy to Business processes

Section 3 focuses on integrating threat intelligence into an organization’s security processes. It discusses threat intelligence as part of development and operations by focusing on usable security. It also discusses Security Information and Event Management (SIEM) solutions and the benefits of threat intelligence in Security Operation Centers (SOCs). It then discusses threat intelligence metrics, Indicators of Compromise (IOCs), their applications, and the pyramid of pain in intelligence-based defense systems. Section 3 also covers threat intelligence reporting and dissemination – a means to show the program’s value. Lastly, the section discusses practical threat intelligence sharing and cyber activity attribution. On completion of the section, you should be able to use CTI in the context of development and operations, helping transition from Development and Operations (DevOps) to...