Threat Intelligence A quick glace at Intelligence Led Risk Management A brief history of me Former Child Former Military Police NCO Former Military Intelligence NCO Former Bus Driver got into InfoSec 5 years ago Worked for DXC on the
"Threat Intelligence A quick glace at Intelligence" is the property of its rightful owner. Permission is granted to
download and print the materials on this website for personal, non-commercial use only, and to display it
on your personal computer provided you do not modify the materials and that you retain all copyright
notices contained in the materials. By downloading content from our website, you accept the terms of this
agreement.
Presentation Transcript
01
Threat Intelligence A quick glace at Intelligence Led Risk Management<br>
02
A brief history of me…… Former Child
Former Military Police NCO
Former Military Intelligence NCO
Former Bus Driver – got into InfoSec 5 years ago
Worked for DXC on the MoD Contract
Worked at Auriga Consulting on the Nuclear Decommissioning Authority contract
Worked at Virgin Money in 2nd Line Risk
Currently working for Infinium as an IT Security Specialist
RNLI volunteer
All round “good egg”<br>
03
Agenda What is “Threat intelligence”
Information, Misinformation, Intelligence and Actionable Intelligence
What's the difference between information and intelligence
What does threat intelligence mean to business?
Threat Intelligence & Risk Management
Techniques, tactics and procedures (TTPs)
Symmetric TTPs in digital business
Asymmetric TTPs in digital business
Application of Intelligence led risk management in digital business
Conclusions
Questions<br>
04
Threat Intelligence Utilisation<br>
05
What is Threat Intelligence? Threat intelligence is inferred, evidence-based knowledge including context, mechanisms, indicators, implications and actionable advice about an existing or emerging threat or hazard to assets.
It can be used to inform decisions regarding the subject's deployment of countermeasures or response to that hazard or threat or target adversarial assets.
If its Done Well!<br>
06
Intelligence Terminology Information
Misinformation
Intelligence
Actionable Intelligence<br>
07
Information vs Intelligence<br>
08
Intelligence Tools Intelligence Collection Plans
PoL Analysis
Link Analysis
F3EA
Money Tracing
OSINT Tools
Forming a working Hypothesis
Murder groups (its not what you think)<br>
09
Intelligence Products<br>
10
Threat Intelligence in the Business World Threat Intelligence will identify, categorise and draw recommendations in relation to threats from a number of malicious sources
A robust business threat intelligence program, done well, will assist with strategic decisions affecting any number of business critical processes<br>
11
Threat Intelligence in Risk Management Ad – Hoc
Threat Based
Formal Risk Management Frameworks
Intelligence Led………………….?<br>
12
Intelligence Led Risk Management<br>
13
Tactics, Techniques & Procedures<br>
14
Symmetric TTPs Defensive Control or Countermeasure Offensive Capability or Toolset Malicious Actor Environment Supported Live Environment Offensive Capability or Toolset Offensive Capability or Toolset Offensive Capability or Toolset Offensive Capability or Toolset Offensive Capability or Toolset Defensive Control or Countermeasure Defensive Control or Countermeasure Defensive Control or Countermeasure Defensive Control or Countermeasure Defensive Control or Countermeasure Attack Vector Attack Vector Attack Vector Attack Vector Attack Vector Attack Vector<br>
15
Asymmetric TTPs Defensive Control or Countermeasure Offensive Capability or Toolset Malicious Actor Environment Supported Live Environment Offensive Capability or Toolset Offensive Capability or Toolset Offensive Capability or Toolset Offensive Capability or Toolset Offensive Capability or Toolset Defensive Control or Countermeasure Ineffective Control or Countermeasure Defensive Control or Countermeasure Defensive Control or Countermeasure Defensive Control or Countermeasure Attack Vector Attack Vector Attack Vector Attack Vector Attack Vector Attack Vector Compromise of Environment<br>
16
Conclusions Threat intelligence should be at the forefront of everything we do
Threat Intelligence is the processing of information into actionable intelligence
Intelligence Led Risk Management can save significant sums of money by applying budget only where it is required
The key to effective threat intelligence is understanding our estate, vulnerabilities, adversaries and countermeasures
Understanding adversarial asymmetric TTPs is vital to understanding which exploits pose most the significant risk
Intelligence Led Risk management could be the single most effective means of managing risk to any organisation….. If its done well!<br>
17
Questions? The Fewer you ask, the quicker we’re in the pub…….. #justsayin<br>
