Chapter 1: Why You Need a Threat Intelligence Program
Today, almost every organization has a digital footprint, and this alone makes any organization a target of opportunity for threat actors who have malicious intent.
So, something happened, right? Ransomware? Supply chain attack? Ransomware because of a supply chain attack? Something worse? Often, individuals and organizations experience a revelation during times of concern or crisis that causes them to explore other options. Through the process of discovery, if you have come across the term threat intelligence and want to know more about how it can assist in maturing your security posture or protecting your organization, great! We're glad you made it here because we're here to help.
Threat intelligence, a mystery to many, is a science to some. The how, where, when, and why of technical threat intelligence collection and enrichment is a complex topic, with many facets to explore. The objective of this chapter is to introduce core concepts related to technical threat intelligence, including the motivation, models, and methods by which threat intelligence can be collected and enriched.
Specifically, in this chapter, we are going to cover the following topics:
- What is Cyber Threat Intelligence (CTI), and why is it important?
- Tactical, strategic, operational, and technical CTI
- The uses and benefits of CTI
- How to get CTI
- What is good CTI?
- Intelligence life cycles
- Threat intelligence maturity, detection, and hunting models
- What to do with threat intelligence
