Cyber Threat Intelligence - Analysis and Management

I’m sharing a presentation I delivered in 2023 titled "Cyber Threat Intelligence Analysis and Management."

It was originally created for a private training focused on the operationalization of Cyber Threat Intelligence (CTI). While the full training remains confidential, I’m happy to make this single presentation publicly available, as the concepts continue to be relevant for maturing CTI capabilities.

I hope it provides value to practitioners and anyone interested in strengthening their cyber threat intelligence programs.

Always open to discussions around CTI, threat analysis, and security operations.

Transcript

1. Cyber Threat Intelligence Analysis and Management John Ombagi
2. Introduction 2 The main objective in leveraging threat intelligence is to give organisations a defence mechanism against events or attacks they , have not yet experienced and to give them a way to spot intrusions that could have gone . unnoticed otherwise Intelligence management and sharing , refers to the process of collecting , , analysing disseminating and utilising - intelligence information to support decision making and achieve . operational objectives
3. Intelligence Analysis is Not an Easy Task 3 Intelligence analysts use a variety of techniques and , methods including data , , mining statistical analysis , pattern recognition and expert knowledge to identify and assess threats, opportunities, and risks. Intelligence analysis and management is a complex task ( and contextual in some ), cases we shall focus on CTI specifics while applying a number of general principles . of intelligence analysis
4. Information versus Intelligence 4 Information refers to raw , , data facts or details about an event or . situation It can come from various sources and can be accessed by anyone with access to that . information Information by itself is not very useful without context . or analysis Intelligence, on the , other hand is information that has been analyzed and processed to provide , , insights assessments or predictions about a particular situation . or event
5. Some Frameworks for Intelligence Management Intelligence Cycle The Intelligence Cycle is a framework that provides a structured approach to , , the process of collecting analysing and disseminating intelligence . information The cycle includes five : , phases planning and direction , , collection processing and exploitation , analysis and production and . dissemination Analytic Standards Analytic Standards are a set of principles and best practices for , intelligence analysis developed by the intelligence community to ensure that analysts adhere to rigorous and consistent standards when conducting . intelligence analysis The standards , cover areas such as objectivity , . accuracy and transparency Intelligence Preparation of the Environment (IPE) IPE is a framework that provides a systematic approach to analysing the operating environment in order to , , identify potential threats opportunities . and vulnerabilities The framework : includes four steps defining the , operational environment describing the , impact of the environment evaluating , the adversary and determining . adversary courses of action Intelligence-Driven Operations (IDO) IDO is a framework that integrates intelligence analysis into operational . planning and execution The framework involves continuous intelligence , gathering and analysis as well as ongoing communication and collaboration between intelligence . analysts and operational teams
6. Intelligence Cycle - Common and Relevance to CTI Planning and direction , In this phase intelligence managers and analysts develop a . plan to identify and monitor potential cyber threats This includes identifying the types of threats and actors to monitor and determining the sources of intelligence data to . collect Collection , In the collection phase intelligence analysts collect data , , from a range of sources such as network traffic logs dark , , web forums and social media to identify potential cyber . threats They may also use technical tools to identify . vulnerabilities in their own networks and systems Processing and exploitation , In the processing and exploitation phase the data collected in the previous phase is processed and . analysed to identify potential cyber threats This may , involve automated processing and analysis tools as . well as manual analysis by intelligence analysts Analysis and production , In the analysis and production phase the data analysed in the previous phase is used to identify , patterns and trends in cyber threats as well as . potential threat actors and their motivations This , analysis may be used to develop intelligence products , - . such as reports or briefings to inform decision making Dissemination , In the dissemination phase the intelligence products produced in the previous phase are , shared with relevant stakeholders such as , , government agencies law enforcement or private , sector organizations to inform their cybersecurity . strategies and operations Feedback , In the feedback phase intelligence managers and analysts review the effectiveness of the intelligence cycle and use this feedback to refine the process . for future operations 01 02 03 04 05 06
7. Managing Cyber Threat Intelligence Tools and Technologies Threat Intelligence Platforms (TIP) This is a software tool that enables , , organisations to aggregate correlate and , analyse threat data from various sources , , such as internal systems external feeds . and threat intelligence exchanges TIPs provide a centralised repository for threat , , data automate threat intelligence analysis . and support collaboration among analysts Data Management Systems These are essential for managing the volume and variety of data generated by . cyber threat intelligence activities These , , systems help organisations to collect store , . process and retrieve threat data efficiently Some of the key features of data management systems include data , , normalisation data enrichment and data . deduplication Data visualisation tools They are used to create meaningful and actionable insights from the large volumes of data collected and analysed . , , , during cyber threat intelligence activities These tools help to identify patterns trends and anomalies in the data and . enable analysts to present their findings in a visual format that is easy to understand
8. Best Practices for Managing CTI Tools and Technologies Choose the right tools Select tools and technologies that align with your organization's threat intelligence , requirements technical , . capabilities and budget Integrate your tools Ensure that your tools and technologies are integrated and work seamlessly with each other to enable a smooth and efficient cyber threat . intelligence process Regularly update your tools Keep your tools and - - technologies up to date with the latest threat , intelligence feeds , software patches and security updates to ensure they are effective in detecting . and mitigating threats Train your analysts Provide your analysts with training on the use of the tools and technologies to ensure that they can use them effectively . and efficiently Monitor and evaluate Regularly monitor and evaluate the performance of your tools and technologies to identify areas for improvement and ensure that they continue to meet your organization's cyber threat . intelligence needs
9. CTI Analysts Desired Skills Strong technical skills A good CTI analyst should have a solid understanding , of cyber security concepts and technologies including , , . networking operating systems and security tools They should also be familiar with the latest threat intelligence . collection and analysis tools and techniques Analytical mindset CTI analysts should have strong analytical skills and be able , , to identify patterns trends and anomalies in large volumes of . data They should be able to draw meaningful insights from . disparate sources of data and develop actionable intelligence Attention to detail - CTI analysts should be detail oriented and have a strong . ability to spot inconsistencies and anomalies in data They should be able to identify indicators of compromise ( ) . IOCs and other signs of potential cyber threats Effective communication skills CTI analysts should have strong written and verbal communication skills to effectively communicate threat - . intelligence data to technical and non technical stakeholders They should be able to tailor their communication style to different audiences and clearly articulate the risks and . implications of cyber threats Creativity CTI analysts should have a creative mindset and be able to think outside the box when collecting and . analysing threat intelligence data They should be able to use innovative techniques to identify new sources of . data and develop new approaches to threat analysis Continuous learning CTI analysts should have a strong desire to continuously learn - - and stay up to date with the latest cyber security trends and . threats They should be proactive in seeking out new information and be willing to adapt their approach based on . new insights and feedback 01 02 03 04 05 06
10. The Conflict Spectrum The types of intelligence are often , defined to mirror these three levels though like the conflict levels , themselves the lines between types . of intelligence are often blurred Against any opponent in a , conflict three successive . levels of action can be taken , One can attempt to prevent , . deter or prevail Military organizations commonly define three levels of conflict • Strategic • Operational • Tactical
11. Time frame The Conflict Spectrum - Big picture Level of Action Level of conflict Activities called for Long Short Immediate Prevent Deter Prevail Operational Plan execution Tactical Crisis management Strategic Planning
12. The Conflict Spectrum – Prevent Executives, policymakers, and operations organisations first try to prevent a disadvantageous situation from developing. Examples include preventing : Prevention can also include making an existing situation more advantageous, for example : • The opponent from organizing and acquiring momentum • The opponent from acquiring or developing a , , capability a strategy or a new weapons system • The opponent from making an unfavourable decision • The opposing negotiations team from taking a certain position • By encouraging an opponent to reverse an unfavorable decision that has been made • ’ Rolling back an opponent s existing capability • Or inducing the opponent to abandon a ... favorable position
13. The Conflict Spectrum – Deter Deterrence is used when it is too late for prevention. Examples include the following • , Deterring an attack • , Deterring the use of a capability or weapons system • , Deterring the opponent from escalating or aggravating a crisis • , Creating uncertainty that induces the opponent to be cautious • . Deterring gang members from criminal activity Prevention keeps a situation from becoming unfavourable while deterrence focuses on an opponent’s potential actions to resolve an already unfavourable situation in its favour
14. The Conflict Spectrum – Prevail Defeating the opponent in counter attack Creating a perception that an insurgent opponent , is losing in order to deny recruiting and popular support Destroying the ’ opponent s infrastructure or sources of revenue Taking market share away from the opponent in commerce Arresting and incarcerating cyber criminals Dismantling international criminal networks Imposing trade embargoes When all else fails, the goal is to resolve the conflict on favourable terms. Examples include the following
15. Analysts in CSOC Operations – APT Attacks, State Sponsored Attacks, Cyber Espionage 15
16. Different Approaches to Intelligence Analysis Situational Logic Applying Theory Historical Comparisons Situational logic involves analysing a particular situation or event based on . the available facts and data This approach focuses on identifying patterns and trends in the data to develop logical explanations for . the situation This approach focuses on identifying the key factors or variables that may be driving the situation and then using existing theories or models to explain the behavior of these variables This approach focuses on identifying similarities and differences between the current situation and past events or trends to develop insights into the behavior of . the key variables involved 16
17. Generating an Hypothesis Sometimes known as an “educated guess,” a hypothesis rests upon some existing level of knowledge of a given subject However, rather than a guess, we are going to propose an answer to a specific question based upon a level of knowledge about a topic When generating a hypothesis Involve more analysts and seek more , perspectives which will result in more hypotheses generated Ensure it is / measurable testable Keep an open mind First try to disprove rather than prove it 17
18. Steps for Generating an Hypothesis Define the problem or question Gather information Analyse the information Develop hypotheses Evaluate the hypotheses Refine the hypotheses The first step in generating hypotheses is to clearly define the problem or question that needs . to be answered This involves identifying the scope of the analysis and the key variables that need to be considered Once the problem , has been defined the analyst needs to gather as much relevant information . as possible This may involve collecting data from a variety of , sources such as - open source , intelligence social , media or classified reports Once the information has , been collected the analyst needs to analyse it to identify patterns or trends that may provide insights . into the problem This may involve using analytical techniques such as , link analysis trend , analysis or pattern recognition Based on the analysis of the , information the analyst can develop a list of potential hypotheses that explain the problem . or question These hypotheses should be logical and supported by the available data The analyst needs to evaluate each hypothesis to determine which ones are most . plausible This may involve testing the hypotheses against additional information or evidence After evaluating the , hypotheses the analyst may need to refine them or develop new ones based on the results of the evaluation 18
19. Strategies for Hypothesis Formulation 19
20. Logic Weaknesses in such Processes This occurs when the analyst only looks for information that confirms their existing beliefs or hypotheses and ignores information that contradicts them This occurs when the analyst relies too heavily on the first piece of information they receive and fails to consider other possibilities This occurs when the analyst is influenced by the opinions or attitudes of their peers or colleagues and fails to challenge assumptions or consider alternative perspectives Xxx This occurs when the analyst overestimates the importance or likelihood of a particular event or threat because it is more easily recalled from memory Availability bias Anchoring bias Groupthink Confirmation bias This occurs when the analyst overestimates their ability to predict the outcome of an event after it has already occurred This occurs when the analyst overemphasizes , internal factors such as a person's intentions or , personality and fails to consider external factors that may have contributed to a particular event or situation Failing to exploit theoretical knowledge obtained from the study of similar cases Xxx This occurs when the analyst is overly confident in their ability to predict or understand a particular , threat which can lead to errors in judgment or analysis Overconfidence bias Fundamental attribution error Other Considerations Hindsight bias 20
21. PMESII-PT in Cyber Threat Intelligence Analysis Alternative to this framework we can utilize the ( , DIME Diplomatic , Information Military and ) Economic framework This framework can also be applied in cyber threat intelligence analysis to help understand the various factors that influence the cyber threat landscape - PMESII PT stands for , , Political Military , , Economic Social , Information , Infrastructure Physical , Environment and Time - PMESII PT is a military framework used to analyze the operational environment 21
22. PMESII-PT in CTI Analysis Context Political Military Economic Social Information Infrastructure Physical Environment Time . , This factor involves analysing the political landscape and identifying key actors and their motivations In cyber threat intelligence this could involve analysing the political tensions between different countries or groups and how these tensions may manifest in the cyber . domain . , This factor involves analysing the military capabilities and strategies of different actors In cyber threat intelligence this could involve . analysing the cyber capabilities of different military groups and how they may use these capabilities in cyber operations . This factor involves analysing the economic landscape and identifying economic factors that may influence the cyber threat landscape In , cyber threat intelligence this could involve analysing the economic motivations of different actors and how these motivations may drive . their cyber operations . , This factor involves analysing social and cultural factors that may influence the cyber threat landscape In cyber threat intelligence this . could involve analysing the social dynamics within different groups and how these dynamics may influence their cyber behaviour . , This factor involves analysing the information environment and how information is used in the cyber domain In cyber threat intelligence . this could involve analysing the use of propaganda or disinformation in cyber operations , , , This factor involves analysing the physical infrastructure that supports the cyber domain including the networks systems and . , technologies that are used In cyber threat intelligence this could involve analysing the vulnerabilities and strengths of different types of . infrastructure and how they may be exploited or defended against , , This factor involves analysing the physical environment in which cyber operations take place including factors such as geography , . , weather and climate In cyber threat intelligence this could involve analysing the physical vulnerabilities or strengths of different . locations and how they may be exploited or defended against . , This factor involves analysing how the cyber threat landscape may change over time In cyber threat intelligence this could involve , . analysing the emergence of new technologies or tactics or the shifting motivations and strategies of different actors over time
23. Advance Threat Attribution from Analysis Collection of evidence The first step is to collect as much information , , as possible about the attack including logs , , network traffic system activity and any other relevant data Analysis of technical indicators Analysts will examine the technical details of , , the attack such as the type of malware used , - the methods of intrusion and the command - . and control infrastructure They may compare these details to known attack patterns and signatures Analysis of behavioural indicators - Analysts will also examine the behavior of , , the attackers such as the timing of the attack , the targets and any communications or social . media activity associated with the attack This can provide clues about the motives and goals . of the attackers Comparison with known threat actors Analysts may compare the attack details and behavioral indicators with known threat actors or hacking groups to see if there are any similarities or connections Corroboration with intelligence sources Analysts may also consult intelligence , , sources such as government agencies , , law enforcement or other organizations to corroborate their findings and gather additional information Report and attribution , Finally analysts will compile their findings into a , report and make an attribution statement identifying the likely source and motive of the attack Read: https://www.mandiant.com/resources/blog/tr ade-offs-attribution The process of attribution is complex and it involves the steps below
24. The Diamond Model 24
25. The MICTIC Framework for Threat Attribution
26. F3EAD Cycle in CTI The F3EAD cycle (Find, Fix, Finish, Exploit, Analyse, Disseminate) is a methodology used by the military and law enforcement agencies to conduct intelligence operations. While originally designed for physical operations, it can also be applied in the context of cyber criminal targeting. Here's how Find Fix Finish Exploit Analyse Disseminate , In the Find phase analysts gather information from various , - sources including open , source intelligence , network logs and other , data sources to identify potential cyber criminals and their activities , In the Fix phase analysts use technical means to pinpoint the location of the cyber , criminals such as through IP geolocation , or network analysis and determine the vulnerabilities in their infrastructure , In the Finish phase law enforcement or security personnel take action to disrupt or disable the cyber criminals' infrastructure or arrest the perpetrators , In the Exploit phase analysts extract intelligence from the cyber criminals' , infrastructure such as by recovering stolen data or analysing the malware used in the attack , In the Analyse phase analysts examine the intelligence gathered to identify trends and patterns in cyber , criminal activity and to improve the effectiveness of future operations In the Disseminate , phase intelligence is shared with other agencies or organizations to improve situational awareness and inform future operations
27. Other Considerations for Attribution - Tooling Lifecycle
28. Cyber Threat Attribution Challenges False flags Attackers may use false flags to disguise their identity and make . it look like the attack came from a different source This can lead . to misattribution and mistakenly blaming innocent parties Insufficient evidence , In some cases there may be insufficient evidence to identify the . , attackers with confidence This can be due to technical limitations such as encrypted traffic or use of sophisticated evasion , . techniques or due to lack of access to relevant information Misinterpretatio n of evidence - , Analysts may misinterpret or over interpret the evidence leading to . , incorrect conclusions For example they may assume that a , specific tool or technique is only used by a particular threat actor . when in fact it may be more widely used Bias Analysts may have preconceived biases or assumptions that can . influence their analysis and lead to incorrect attribution For , example they may be inclined to blame a certain country or . group based on political or strategic considerations Limited access to information , Attribution may be limited by lack of access to information either , due to legal or operational constraints or due to information being . classified or protected by privacy laws Lack of international consensus , Attribution is a politically charged issue and there is often a lack of consensus among countries and organisations on how to . attribute cyber attacks This can lead to confusion and . inconsistency in attribution statements Proprietary and Confidential
29. ’ China s PLA Operations in East Africa and the attribution process Revisiting the Kenya Ministry of Foreign , 2016 Affairs Hack , & . China Russia N Korea APT groups and MO 3 2 1 Case Studies
30. Q/A 30 John Ombagi