Cyber Threat Intelligence

Cyber Threat Intelligence (CTI) is the process of gathering, analyzing, and disseminating information about current and potential cyber threats in order to proactively protect organizations and individuals from cyber-attacks. CTI enables organizations to understand the threat landscape and make informed decisions about how to defend their networks and systems.

There is no consensus on the exact definition of a cyber threat, and different organizations and analysts may have different interpretations depending on there “School of Thought”. A cyber threat can refer to the origin of the risk, meaning an individual or a group with malicious intent, also known as cyber adversaries, threat actors, or threat agents. These entities have the capability and intent to cause harm to an organization or individual through cyber means. A cyber threat can also refer to the risk event, meaning an action that is detrimental to the targeted organization. These events include malware, phishing scams, denial of service attacks, and more, and are often referred to as threat events, cyber attacks, or attack implementations.

The main activities involved in CTI include:

• Collection: Gathering information from a variety of sources, such as network traffic logs, malware samples, and social media posts. The source may be Open Source (OSINT), or closed source (commercial, cooperation, in-house).
• Analysis: Identifying patterns and trends in the collected data in order to understand the threat landscape, develop and track hypothesis, capitalized past information. The ultimate victory is to predict the next attacker move.
• Dissemination: Sharing actionable intelligence with relevant stakeholders, such as security teams, incident responders, and executives.

The process of CTI is supported by the use of a variety of tools, techniques and disciplines. Those are either performed by the cyber threat analyst itself, or by a dedicated specialized resources that is feeding the threat analysis. For example, Malware analysis examines malware samples to understand how they work, what they are doing and produce dedicated detection rules. Network traffic analysis skills are necessary to inspect network traffic logs to detect and investigate suspicious activity.

The type of data that CTI analyst may be exposed to are very diverses. As a cyber attack is expression of a strategic entity motivation and planification, that is implemented through technical means, the scope of the analysis may be multi-disciplinary, depending on the context of the organization, the CTI Team capability and the dissemination audience and expectation : 

• Technical Intelligence: This type of data focuses on the technical aspects of cyber threats, such as malware samples, network traffic logs, and vulnerability information.
• Behavioral Intelligence: This type of data focuses on the behavior of threat actors, such as their tactics, techniques, and procedures (TTPs), as well as their motivations and intent.
• Threat Actor Intelligence: This type of data focuses on the identity and attributes of threat actors, such as their location, tools, and infrastructure.
• Geopolitical Intelligence: This type of data focuses on the geopolitical context of cyber threats, such as the political, economic and social factors that may drive a threat actor to conduct a cyber-attack.
• Industry Intelligence: This type of data focuses on the specific threats and vulnerabilities that affect a particular industry or sector.
• Vulnerability Intelligence: This type of data focuses on the vulnerabilities in software, hardware and services, and the patches and mitigations available.
• Cyber-Tactical Intelligence: This type of data focus on the current cyber-attacks and its characteristics, targets, motives and tactics. It is more useful for incident responders, to detect and respond to an ongoing attack.

Organizations can use a combination of these different types of data to gain a comprehensive understanding of the cyber threat landscape and make informed decisions about how to protect their networks and systems. But this also requiere to have strong analytical tools that can digest those multi-dimensional type of data to support analysts during their investigation. CTI frameworks are methodologies used to organize and structure the CTI process. The most popularly CTI Framework are generally:

• Diamond Model: A framework used to understand the various aspects of a cyber threat, including the threat actors, their motivations and capabilities, the malware and techniques used, and the victims and impacts. It is based on Porter’s Diamond Model.
• MITRE ATT&CK: A framework used to understand the tactics, techniques, and procedures (TTPs) used by threat actors in cyber attacks.
• Intrusion Kill Chain: A model developed by Lockheed Martin that describes the stages an attacker goes through in order to successfully compromise a target.

The audience of CTI includes security professionals and decision-makers within an organization, government agencies, and other organizations that are responsible for protecting networks and systems from cyber threats. Cyber Threat Intelligence is a fact-based and audience driven activity. Depending of the requester (a.k.a. customer) needs, the analyst may orient the collection, focus on one or more type of data type and produce their intelligence product with different format to fits the final audience needs.