A quick glace at Intelligence Led Risk Management Threat Intelligence A quick glace at Intelligence Led Risk Management

A brief history of me…… Former Child Former Military Police NCO Former Military Intelligence NCO Former Bus Driver – got into InfoSec 5 years ago Worked for DXC on the MoD Contract Worked at Auriga Consulting on the Nuclear Decommissioning Authority contract Worked at Virgin Money in 2nd Line Risk Currently working for Infinium as an IT Security Specialist RNLI volunteer All round “good egg”

Agenda What is “Threat intelligence” Information, Misinformation, Intelligence and Actionable Intelligence What's the difference between information and intelligence What does threat intelligence mean to business? Threat Intelligence & Risk Management Techniques, tactics and procedures (TTPs) Symmetric TTPs in digital business Asymmetric TTPs in digital business Application of Intelligence led risk management in digital business Conclusions Questions

Threat Intelligence Utilisation

What is Threat Intelligence? Threat intelligence is inferred, evidence-based knowledge including context, mechanisms, indicators, implications and actionable advice about an existing or emerging threat or hazard to assets. It can be used to inform decisions regarding the subject's deployment of countermeasures or response to that hazard or threat or target adversarial assets. If its Done Well!

Intelligence Terminology Information Misinformation Intelligence Actionable Intelligence

Information vs Intelligence

Intelligence Tools Intelligence Collection Plans PoL Analysis Link Analysis F3EA Money Tracing OSINT Tools Forming a working Hypothesis Murder groups (its not what you think)

Intelligence Products

Threat Intelligence in the Business World Threat Intelligence will identify, categorise and draw recommendations in relation to threats from a number of malicious sources A robust business threat intelligence program, done well, will assist with strategic decisions affecting any number of business critical processes

Threat Intelligence in Risk Management Ad – Hoc Threat Based Formal Risk Management Frameworks Intelligence Led………………….?

Intelligence Led Risk Management

Tactics, Techniques & Procedures TTPs How we think How we carry out actions What we like Routes we take Places we go to Places we avoid People we avoid Things we wear People we interact with Our Loyalties Our Ideals Things we eat Things we admire Our Ideology Language we use What we dislike

Symmetric TTPs Supported Live Environment Malicious Actor Environment Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset Malicious Actor Environment Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset

Asymmetric TTPs Supported Live Environment Malicious Actor Environment Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset Malicious Actor Environment Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset Compromise of Environment Ineffective Control or Countermeasure Attack Vector Offensive Capability or Toolset Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset Defensive Control or Countermeasure Attack Vector Offensive Capability or Toolset

Deploy countermeasures Apply Intelligence Process Understand your defensive capabilities Understand your Vulnerabilities Know your Foe Understand your infrastructure Protect

Conclusions Threat intelligence should be at the forefront of everything we do Threat Intelligence is the processing of information into actionable intelligence Intelligence Led Risk Management can save significant sums of money by applying budget only where it is required The key to effective threat intelligence is understanding our estate, vulnerabilities, adversaries and countermeasures Understanding adversarial asymmetric TTPs is vital to understanding which exploits pose most the significant risk Intelligence Led Risk management could be the single most effective means of managing risk to any organisation….. If its done well!

Questions. The Fewer you ask, the quicker we’re in the pub…… Questions? The Fewer you ask, the quicker we’re in the pub…….. #justsayin