Threat Intelligence

Question 1

Threat Intelligence Sources:

Answer 1

Facilitate risk management. Hardening can reduce incident response time. Provide cybersecurity insight. Adversary tactics, techniques, and procedures. (TTP) Threat maps.

Question 2

Closed/proprietary. OSINT (Open-Source Intelligence)

Answer 2

Government reports - Media - Academic papers.

Question 3

Closed/proprietary.

Answer 3

File/code repositories for example: GitHub

Question 4

Vulnerability Databases:

Answer 4

Common vulnerabilities and exposures (CVES)

Question 5

Dark Web/Dark Net

Answer 5

Tor network, Tor Web browser. Encrypted anonymous connections, not indexed by search engines, Tor encryption and anonymity.

Question 6

Automated Indicator Sharing (AIS)

Answer 6

Exchange of cybersecurity intelligence (CI) between entities.

Question 7

Structured Threat Information eXpression (STIX)

Answer 7

A form of AIS. Data exchanged format for cybersecurity.

Question 8

Trusted Automated eXchange Intelligence information (TAXI)

Answer 8

Like RSS feed for threats. Consists of TAXII servers and clients. Real-time cyber intelligence feeds.