Summary

We've just gone through and thrown everything but the kitchen sink at you trying to illustrate the motivations behind starting and building a threat intelligence program! Some of the key takeaways from this chapter should be what CTI is, what its benefits are, and how it can be used by every level of employee to prioritize and improve the security posture of an organization. Further, we tried to frame what good intelligence is by utilizing several known frameworks for judging the credibility and reliability of your gathered source information. We also walked through the threat intelligence life cycle that is used to hunt, pivot, and enrich information to create CTI. Finally, we walked you through a model in which you can rate the maturity of your organization's CTI capability.

In the next chapter, we will start ramping up the technicality by introducing core concepts such as defining threat actors and campaigns, as well as looking at tools and vulnerabilities that threat actors often leverage. Further, we will clearly define threat actor types and discuss the attribution of threat actors in depth. Finally, we will introduce standardized naming conventions for identifying campaigns and TAGs and discuss the advantages and disadvantages of attribution overall.