(4) Intelligence Cycle and Threat Intelligence Community

Question 1

What is the threat intelligence life cycle?

Answer 1

The Threat Intelligence Life Cycle is:

1. Requirements gathering
2. Threat Data Collection
3. Threat Data Analysis
4. Threat Intelligence Dissemination
5. Gathering Feedback

Question 2

Describe what needs to happen during the first step in the threat intelligence cycle: Requirements Gathering

Answer 2

-Assess what security breaches or compromises you have faced

-Assess what information could have prevented or limited the impact of the breach

-Assess what controls and security measures were not in place that would have mitigated the breach

Question 3

Describe the data collection process that happens during the intelligence cycle

Answer 3

once information requirements are completed, the next step is to collect data from threat intelligence sources to meet requirements.

This phase may happen multiple times as requirements are added or as requirements are changed based on data available and sources

Question 4

Describe the data processing and analysis phase of the intelligence cycle

Answer 4

Once the data has been gathered, the data needs to be processed and reformatted, as it is likely that the data is not in a format that your systems can properly ingest. Once it is properly ingested and formatted, it can be fed into automated systems and tools for analysis and can be compiled into a report for leadership

Question 5

What happens in the intelligence dissemination phase of the intelligence lifecycle?

Answer 5

In the intelligence dissemination phase, data is distributed to leadership and operational personnel who will use the data as part of their security role

Question 6

Describe the feedback process of the threat intelligence cycle

Answer 6

The final step in the process is to get feedback on what you have done.

Continuous improvement is very important in the process. Better requirements should grow out of this process.

Question 7

What are the Information Sharing and Analysis Centers (ISACs)?

Answer 7

The ISACs are there to help infrastructure owners and operators pool threat information and to provide tools and help to members

Question 8

How do the Information Sharing and Analysis Centers (ISACs) work?

Answer 8

The ISACs use a trust model for operation, sharing threat information in depth for physical and cyber threats.