Cyber threat intelligence

Threat intelligence is a term that’s often used by many professionals that encompass tactical, operational, and strategic intelligence. The sources, audiences, and forms of intelligence are all different. At the core, any threat intelligence that’s received by the SOC, in any business, must be proactively actionable. The blue team should be able to absorb this intelligence and use it to proactively defend their organization.

In terms of the basics, threat data consists of indicators of various cyber threats such as IP addresses, URLs, or file hashes. These are referred to as Indicators of Threats (IoTs) or Indicators of Compromise (IoCs). On the other hand, threat intelligence is a type of factual, processed, and provable record based on analysis that connects data and information from many sources to identify patterns and provide insights that would be relevant to the organization. It lets people and systems make educated decisions and take effective action to avoid breaches, fix vulnerabilities, improve the security posture of the enterprise, and decrease risk. Strategic intelligence usually focuses on the TTPs of the threat actors.

Often, such teams sit within the blue team. Alternatively, large organizations may prefer to have them separately and act as a standalone unit to collaborate across the blue team, red team, purple team, business lines, and more. We will discuss this in more depth later in this book.

Now that we have covered teams that work closely together with the blue team, let’s understand the skills that organizations should look out for while recruiting. This will help ensure the right candidates are hired and placed in the right roles.