Threat Intelligence
Effective threat intelligence enables organizations to anticipate, detect, and respond to evolving risks with informed, timely decisions.
4 slides · 1 min read · Domain 7
Threat intelligence is the structured process of identifying organizational threats.
This information is generated from a variety of external and internal sources. Properly conducted, threat intelligence information provides valuable input for a great number of organizational activities including risk assessments and incident response processes.
External threat intelligence activities entail open-source research, threat modeling, and third-party information. Vendors, governmental entities, Information Sharing and Analysis Centers (ISACs), and similar organizations are key sources of threat intelligence. External threat intelligence is valuable for identifying threats that have been identified by or affected other organizations.
Internal threat intelligence is the result of the organization's monitoring of systems and activities in its environment. A variety of sources can provide valuable inputs to threat intelligence efforts, including system, event, and application logs; incident reporting; and the results of forensic investigations. The organization's configuration management database and system inventories can identify resources whose weakness might present attractive targets to particular threats. The IAM environment can also be used to identify individuals with elevated privilege or unusual activity.
Threat intelligence activities rely heavily on proper reporting and correlation of information to develop a comprehensive list of current organizational threats.
In turn, metrics can be applied to various threats, threat scenarios, and activities indicating that a particular threat is likely or active. This allows the organization to detect incidents in a timelier manner, speeding appropriate response and reducing the impact of events.
Large enterprise and governmental organizations often have elaborate intelligence cycles, which structure the collection, refinement, and distribution of threat intelligence. For example, the U.S. Federal Bureau of Investigation (FBI) follows the intelligence cycle shown in the figure.