SANS CTI Summit Inglorious Threat Intelligence

From the depths of the Atlantic Ocean to the deserts of North Africa to the formation of the Office of Strategic Services, World War II provides countless lessons for the intelligence analyst. The talk will discuss the evolution of intelligence work at that time and how it had to evolve to address the needs of the intelligence consumer. Rick will draw conclusions from the intelligence successes and failures of the conflict that you can apply to your threat intelligence program

Transcript

1. INGLORIOUS THREAT INTELLIGENCE @rickhholland Rick Holland VP Strategy, Digital Shadows
5. “Now this is not the end. It is not even the beginning of the end. But it is, perhaps, the end of the beginning.”
6. Chapter One Wild Bill Donovan @rickhholland
7. US Intelligence - 1941 7 Primitive Parochial Underfunded Undermanned Dumping ground
9. “Information is useless unless it is intelligently directed to the strategic purpose.”
10. Office of Strategic Services
11. Behind enemy lines
13. Chapter Two Operation Torch @rickhholland
15. 1. Inspire guerrilla warfare campaign against French
16. 2. Ensure French forces wouldn’t resist landing US troops
17. 3. Provide intel on French troop strength and disposition
18. 4. Provide intel on landing conditions at ports and beaches
19. OSS enabled the path to the “soft underbelly” of Europe. Align to the “strategic purpose”
20. Chapter Three Operation Barbarossa @rickhholland
22. Avoid winter warfare in Russia
23. Also never get involved in a land war in Asia
24. Admiral Wilhelm Canaris Head of the Abwehr
26. 1. SOC analyst 2. Threat hunter 3. Chief Information Security Officer 4. Other C level executives 5. Business unit / Line of business leader Use personas to better understand your intel customers
29. • Specific to the individual • What are their triggers? • What are they passionate about? • Document! Build dossiers on your intel customers
30. 5 ways to connect with your intel customers
31. 1. Use their terminology; not yours
32. 2. Focus on what they care about
33. 3. Create a personal story that resonates
34. 4. Be flexible, adjust your process
35. 5. Engage outside of work
36. Chapter Four Operation North Pole @rickhholland
38. Major Hermann Giskes of the Abwehr
39. Huub Lauwers
40. ‣ 90 Royal Air Force sorties flown ‣ 54 Dutch SOE agents died ‣ 83 RAF crew died
41. 500,000 Guilders
42. 53 SOE radio sets
43. > 4,000 machine guns
44. 50,000 rounds of ammunition
46. “Whenever you will come to pay a visit to the Continent you may be assured that you will be received with the same care and result as all those who you sent us before.”
48. Don’t let rivalries impact analysis
49. Leave the drama at home
50. Structured analytic techniques should be 2nd nature
53. 1. Align to the “strategic purpose” 2. Use personas to better understand your intel customer 3. Build dossiers on your intel customer 4. Connect with your intel customer Summary
54. 5. Don’t let rivalries impact analysis 6. Leave the drama at home 7. Structured analytic techniques should be 2nd nature Summary
55. 55 Thank you! @rickhholland
56. • Wild Bill Donovan: The Spymaster Who Created the OSS and Modern American Espionage • Hitler's Spies: German Military Intelligence in World War II • German Military Intelligence In World War II • Volume 1 War Report Office of Strategic Services Washington Organization, https://searchworks.stanford.edu/view/11645521 • Volume 2 War Report: Office of Strategic Services: Operations in the Field, https://searchworks.stanford.edu/view/11645521 • Analysis of The Personality of Adolph Hitler http://lawcollections.library.cornell.edu/nuremberg/analysis • A Timeline for Using Analytic Techniques Throughout an Analytic Project https://www.cia.gov/library/center-for-the-study-of-intelligence/csi- publications/books-and-monographs/Tradecraft%20Primer-apr09.pdf • The Science of Building Buyer Personas, https://www.singlegrain.com/blog- posts/content-marketing/science-building-buyer-personas/ • Trump and intelligence: 6 ways to deal with challenging intelligence consumers https://www.digitalshadows.com/blog-and-research/trump-and-intelligence-6- ways-to-deal-with-challenging-intelligence-consumers/ • Two ways to effectively tailor your intelligence products https://www.digitalshadows.com/blog-and-research/two-ways-to-more- effectively-tailor-your-intelligence-products/ References: