1B. Importance of Threat Data and Intelligence obj 1.1, 1.2

Question 1

What is Security Intelligence?

Answer 1

Security intelligence focuses on your systems (firewall logs, IDS alerts, etc) . It is the act of collecting, normalising, and analysing data generated by IT infrastructure in real-time, and using the information to assess and improve an organisation’s security posture.

Question 2

What is Cyber Threat Intelligence (CTI)?

Answer 2

CTI provides data about the external threat landscape and emerging threats (e.g., hacker groups, malware outbreaks, zero-days, etc).

Question 3

What are the Two formats of CTI reports?

Answer 3

1) Narrative
- written document that must be assimilated manually. Useful for strategic intelligence.
2) Data feeds
- Lists of IoCs (domain names, IPs, hashes of exploit code, etc). Useful for use in automated systems to inform real-time decisions.

Question 4

what do threat feeds provide?

Answer 4

up-to-date details about threats, such as IP addresses, hostnames/domains, emails, URLs, file hashes/paths, CVE numbers, etc.

Question 5

What are the five stages of the security Intelligence Gathering life cycle?

Answer 5

1) Requirements
2) Collection
3) Analysis
4) Dissemination
5) Feedback

(Ryan Cooked A Delicious Feast)

Question 6

Briefly explain the first phase of the security intelligence gathering life cycle

Answer 6

Requirements Gathering (e.g., types of threats you’re most likely to face, identify specific sources that will be used to gather the required information, identifying laws/regs you must adhere to, etc). This phase includes:

1) assessing security breaches you have faced,

2) assess what information could have prevented/limited to impact of the breach,

3) assess what security controls were not in place that could have mitigated the breach

Question 7

Briefly explain the second phase of the security intelligence gathering life cycle

Answer 7

Collection. Once the information requirements have been identified, you can begin collecting from Threat Intelligence sources to meet those requirements.

Question 8

Briefly explain the third phase of the security intelligence gathering life cycle

Answer 8

Analysis and Processing. Data must be formatted so that it can be consumed by whatever tools or processes you intend to use. You must then analyse the data yourself. The output of this stage may then be fed into automated systems, or written reports for seniors.

Question 9

Briefly explain the fourth phase of the security intelligence gathering life cycle

Answer 9

Dissemination (sharing is caring). The information is distributed to leadership, IT personnel, and other stakeholders.

Question 10

Briefly explain the fifth phase of the security intelligence gathering life cycle

Answer 10

Feedback. Gathering feedback about the report and data you have gathered to create better requirements and improve the output of the security intelligence program

Question 11

What four points should threat intelligence be assessed against? (TRAC)

Answer 11

1) Timeliness. If feed is delayed, could miss a threat or react after a threat is no longer relevant.
2) Accuracy. Is the intelligence valid and true? is the intelligence general or of a specific nature? are the sources reliable?
3) Relevancy. Is it relevant to your systems, platforms, and software. If not, then it is obsolete.
4) Confidence score. Threat intelligence sources are given a confidence score which can be used as filter.

Question 12

Name some examples of open-source threat intelligence

Answer 12

Alien Vault, US-Cert. Threatfeeds.io, VirusTotal, NCSC

Question 13

ISACs?

Answer 13

Information Sharing and Analysis Centres.

Question 14

What are ISACs?

Answer 14

A non-profit group that facilitates the sharing of threat intelligence for industry specific threats and security best practices e.g., healthcare, government, finance

Question 15

In the context of the fourth phase of the threat intelligence life cycle, what is Risk Management?

Answer 15

Identifying, evaluating, and prioritising threats/vulns to reduce their impact

Question 16

In the context of the fourth phase of the threat intelligence life cycle, what is Incident Response?

Answer 16

A protocol for addressing and managing the aftermath of a security breach or attack

Question 17

In the context of the fourth phase of the threat intelligence life cycle, what is Vulnerability Management?

Answer 17

Practice of identifying, classifying, prioritising, remediating, and mitigating vulnerabilities

Question 18

In the context of the fourth phase of the threat intelligence life cycle, what is Detection and Monitoring?

Answer 18

Practice of observing activity to identify anomalous patterns for further analysis. Fine tuning defences to avoid false-positives/false-negatives.

Question 19

What is Reputational Threat research?

Answer 19

The act of identifying threat actors based upon IP addresses, emails, domains, etc, that were previously used in attacks

Question 20

What is Behavioural Threat Research?

Answer 20

identifying threat actors based upon the similarities of their behaviour to past attackers