1. A quick glace at Intelligence Led Risk Management
Threat Intelligence
A quick glace at Intelligence Led Risk Management

2. A brief history of me…… Former Child Former Military Police NCO
Former Military Intelligence NCO
Former Bus Driver – got into InfoSec 5 years ago
Worked for DXC on the MoD Contract
Worked at Auriga Consulting on the Nuclear Decommissioning Authority contract
Worked at Virgin Money in 2nd Line Risk
Currently working for Infinium as an IT Security Specialist
RNLI volunteer
All round “good egg”

3. Agenda What is “Threat intelligence”
Information, Misinformation, Intelligence and Actionable Intelligence
What's the difference between information and intelligence
What does threat intelligence mean to business?
Threat Intelligence & Risk Management
Techniques, tactics and procedures (TTPs)
Symmetric TTPs in digital business
Asymmetric TTPs in digital business
Application of Intelligence led risk management in digital business
Conclusions
Questions

4. Threat Intelligence Utilisation

5. What is Threat Intelligence?
Threat intelligence is inferred, evidence-based knowledge including context, mechanisms, indicators, implications and actionable advice about an existing or emerging threat or hazard to assets. It can be used to inform decisions regarding the subject's deployment of countermeasures or response to that hazard or threat or target adversarial assets. If its Done Well!

6. Intelligence Terminology
Information Misinformation Intelligence Actionable Intelligence

7. Information vs Intelligence

8. Intelligence Tools Intelligence Collection Plans PoL Analysis
Link Analysis
F3EA
Money Tracing
OSINT Tools
Forming a working Hypothesis
Murder groups (its not what you think)

9. Intelligence Products

10. Threat Intelligence in the Business World
Threat Intelligence will identify, categorise and draw recommendations in relation to threats from a number of malicious sources
A robust business threat intelligence program, done well, will assist with strategic decisions affecting any number of business critical processes

11. Threat Intelligence in Risk Management
Ad – Hoc
Threat Based
Formal Risk Management Frameworks
Intelligence Led………………….?

12. Intelligence Led Risk Management

13. Tactics, Techniques & Procedures
TTPs
How we think
How we carry out actions
What we like
Routes we take
Places we go to
Places we avoid
People we avoid
Things we wear
People we interact with
Our Loyalties
Our Ideals
Things we eat
Things we admire
Our Ideology
Language we use
What we dislike

14. Symmetric TTPs Supported Live Environment Malicious Actor Environment
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset
Malicious Actor Environment
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset

15. Asymmetric TTPs Supported Live Environment Malicious Actor Environment
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset
Malicious Actor Environment
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset
Compromise of Environment
Ineffective Control or Countermeasure
Attack Vector
Offensive Capability or Toolset
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset
Defensive Control or Countermeasure
Attack Vector
Offensive Capability or Toolset

16. Deploy countermeasures
Apply Intelligence Process
Understand your defensive capabilities
Understand your Vulnerabilities
Know your Foe
Understand your infrastructure
Protect

17. Conclusions
Threat intelligence should be at the forefront of everything we do
Threat Intelligence is the processing of information into actionable intelligence
Intelligence Led Risk Management can save significant sums of money by applying budget only where it is required
The key to effective threat intelligence is understanding our estate, vulnerabilities, adversaries and countermeasures
Understanding adversarial asymmetric TTPs is vital to understanding which exploits pose most the significant risk
Intelligence Led Risk management could be the single most effective means of managing risk to any organisation….. If its done well!

18. Questions. The Fewer you ask, the quicker we’re in the pub……
Questions? The Fewer you ask, the quicker we’re in the pub…….. #justsayin