USMC Veteran – 2651 Secure Comms/Intel SysAdmin +14 Years in Information Technology/Security Specialties: Incident Response/Forensics Threat Intelligence Offensive Security $dayjob = Senior Malware & Threat Intel Analyst $sidejob = AdroitSec LLC – Principal/Consultant

Or…

“Details of the motivations, intent, and capabilities of internal and external threat actors. Threat intelligence includes specifics on the tactics, techniques, and procedures of these adversaries. Threat intelligence's primary purpose is to inform business decisions regarding the risks and implications associated with threats.” - Forrester

. Etc.FeedsIOCs

Analysis Etc.FeedsIOCs

Prevention Detection

H/T: ThreatConnect

Threat Intel could be it’s own “Program”

Threat Intel Program OSINT Threat Research External Intelligence Services ISACs Firewall IPS/IDS Web Gateway Anti-Virus HIDs/HIPs DLP Network Endpoint SIEM Detection & Response Governance / Resistance

Realize that threat TI is 80% internal 20% external (relative to your business)

May not be a “technical” application

"A shiny threat intel capability without a mature IR capability is like putting a big ole fancy spoiler on a stock 4 cyl Dodge Neon.“

Visibility SIEM/Logs Network Hosts Threat Intel Analysis Verification Containment Remediation CSIRT Security reviews Identity mgmt Security design/reqs Vuln Mgmt Security Operations Policy Risk Management Security program design Compliance Reporting Audit Resist DetectIR Plan Ops IR

Threat Intelligence Consumption Asset Classification and Security Monitoring Incident Response Threat & Environment Manipulation Source: RecordedFuture.com – Robert Lee

Logs Network Endpoint Threat Intel Focal points: Logs Network Threat Intel Endpoint

Logs Network Endpoint Threat Intel Recon Weaponization DeliveryExploitationC2Exfiltration

Scope, Relevancy, Context, Breadth, Capabilities