THE ANATOMY OF CYBER THREAT INTELLIGENCE (CTI) Noureen Njoroge - PowerPoint PPT Presentation

THE ANATOMY OF CYBER THREAT INTELLIGENCE (CTI) Noureen Njoroge

OVERVIEW • Define Cyber Threat Intelligence (CTI) • Define Cyber Intelligence (CI) • Understand the importance of CTI to an organization • Components of Threat • Sources of Cyber Threat Intelligence (CTI) • Categories of Cyber Threat Intelligence (CTI) • Benefits of Cyber Threat Intelligence (CTI) • Importance of real-time Cyber Threat Intelligence (CTI) Noureen Njoroge

DEFINITION Cyber Threat Intelligence (CTI) Is the analysis of information related to adversaries who have the intent, opportunity and capability to do harm. Noureen Njoroge

DEFINITION Cyber Intelligence (CI) Is the ability to gain knowledge about an enterprise and it’s existing conditions and capabilities. Noureen Njoroge

COMPONENTS OF A SUCCESSFUL THREAT INTELLIGENCE STRATEGY Three Important components 1. Good Data Sources 2. Good Policies, Procedures and chain of command. 3. Good Threat Intelligence Analysts Noureen Njoroge

CTI ON A CYBERSECURITY CHART

Noureen Njoroge

CTI IS INTELLIGENCE FOCUS Know the three components of threats: 1. Intent 2. Capability 3. Opportunity Noureen Njoroge

CYBER THREAT INTELLIGENCE (CTI) SOURCES Past Incidents • Commercial Feeds • Govt & Non- Profit sharing programs • Threat Intel Reports • Noureen Njoroge

CATEGORIES OF CYBER THREAT INTELLIGENCE Know the three categories of threats: 1. Tactical 2. Operational 3. Strategic Noureen Njoroge

CATEGORIES OF CYBER THREAT INTELLIGENCE

THE FIVE W ’ S & HOW Know threat and answer the 5 w ’s and How. WHEN WHERE WHY WHO WHAT HOW Noureen Njoroge

CASE FOR CYBER THREAT INTELLIGENCE (CTI) Before Attack During an Attack After Attack Noureen Njoroge

KEY BENEFITS OF CTI TO AN ORGANIZATION • It provides organizations a fighting chance to defeat ever-changing threats. • Provides a holistic view of the threat landscape and provide a posture to protect the organization from the multitude of threats they face ever day. Noureen Njoroge

INTEGRITY OF CTI REPORTS “All organizations that share threat information to customers or the public through any channel should employ guidelines that help them ensure accuracy in their reporting. Even if all the facts aren’t clear, organizations can still communicate what they know—and avoid guessing. Being right is better than being first”. https://www.cisco.com/c/dam/m/hu_hu/campaigns/security-hub/pdf/acr-2018.pdf Noureen Njoroge

BENEFITS OF REAL-TIME -- DYNAMIC CTI Provide visibility of threat landscape • Freshness of data • Collaboration • Threat context • Noureen Njoroge

KEY TAKEAWAYS Detection • Context • Advance Persistent Threat (APT) • Community Defense • Noureen Njoroge

FREE CTI RESOURCES https://www.mitre.org/capabilities/cybersecurity/cyber-threat-intelligence https://www.misp-project.org/feeds/ https://cymon.io https://www.us-cert.gov/ncas/alerts https://talosintelligence.com Noureen Njoroge

CONTACT Noureen Njoroge cybersecmentorship@gmail.com or nnjoroge@cisco.com Linkedin @ Noureen Njoroge Thank you for your time Noureen Njoroge