Cyber Threat Intelligence Flashcards
(35 cards)
What is Cyber Threat Intelligence (CTI)?
Evidence-based knowledge about adversaries, including their indicators, tactics, motivations, and actionable advice against them.
What are the three terms often used interchangeably in CTI?
Data, Information, Intelligence.
Define Data in the context of CTI.
Discrete indicators associated with an adversary, such as IP addresses, URLs or hashes.
Define Information in the context of CTI.
A combination of multiple data points that answer specific questions.
Define Intelligence in the context of CTI.
The correlation of data and information to extract patterns of actions based on contextual analysis.
What is the primary goal of CTI?
To understand the relationship between your operational environment and your adversary and how to defend against attacks.
What type of questions should CTI aim to answer?
Who’s attacking you? What are their motivations? What are their capabilities? What artefacts and indicators of compromise (IOCs) should you look out for?
What are the internal sources of threat intelligence?
- Corporate security events
- Cyber awareness training reports
- System logs and events
What are the community sources of threat intelligence?
- Open web forums
- Dark web communities for cybercriminals
What are the external sources of threat intelligence?
- Threat intel feeds (Commercial & Open-source)
- Online marketplaces
- Public sources including government data, publications, social media, financial and industrial assessments.
What are the classifications of Threat Intelligence?
- Strategic Intel
- Technical Intel
- Tactical Intel
- Operational Intel
What does Strategic Intel focus on?
High-level intel that looks into the organisation’s threat landscape and maps out risk areas based on trends and emerging threats.
What does Technical Intel focus on?
Evidence and artefacts of attacks used by adversaries.
What does Tactical Intel assess?
Adversaries’ tactics, techniques, and procedures (TTPs).
What does Operational Intel look into?
An adversary’s specific motives and intent to perform an attack.
What is the first phase of the CTI lifecycle?
Direction.
What is the purpose of the Direction phase in the CTI lifecycle?
To define objectives and goals, identify information assets and business processes that require defending.
What does the Collection phase involve?
Gathering required data to address defined objectives.
What is the goal of the Processing phase in the CTI lifecycle?
To ensure data is extracted, sorted, organised, correlated, and presented in a usable format.
What is the outcome of the Analysis phase?
Deriving insights and making decisions about potential threats.
What is the dissemination phase of the CTI lifecycle?
The phase where intelligence is communicated to various organizational stakeholders.
What is the Feedback phase in the CTI lifecycle?
The phase where analysts rely on stakeholder responses to improve the threat intelligence process.
What is the MITRE ATT&CK framework?
A knowledge base of adversary behaviour focusing on indicators and tactics.
What does TAXII stand for?
Trusted Automated eXchange of Indicator Information.
