Cyber Threat Intelligence Analysts

Topic Covered:

Methodology Understanding Cyber Threats

• Overview of Cyber Threats
• Cyber Security Threat Categories
• Threat Actors/Profiling the Attacker
• Threat: Intent, Capability, Opportunity Triad
• Motives, Goals, and Objectives of Cyber Security Attacks
• Hacking Forums

Understanding Advanced Persistent Threats (APTs)

• Advanced Persistent Threats (APTs)
• Characteristics of Advanced Persistent Threats (APTs)
• Advanced Persistent Threat Lifecycle

Understanding Cyber Kill Chain

• Cyber Kill Chain Methodology
• Tactics, Techniques, and Procedures (TTPs)
• Adversary Behavioral Identification
• Kill Chain Deep Dive Scenario - Spear Phishing

Understanding Indicators of Compromise (IoCs)

• Indicators of Compromise (IoCs)
• Why Indicators of Compromise Important?
• Categories of IoCs
• Key Indicators of Compromise
• Pyramid of Pain

Topic Covered:

Understanding Organization’s Current Threat Landscape

• Identify Critical Threats to the Organization
• Assess Organization’s Current Security Pressure Posture
• Assess Current Security Team’s Structure and Competencies
• Understand Organization’s Current Security Infrastructure and Operations
• Assess Risks for Identified Threats

Understanding Requirements Analysis

• Map out Organization’s Ideal Target State
• Identify Intelligence Needs and Requirements
• Define Threat Intelligence Requirements
• Threat Intelligence Requirement Categories
• Business Needs and Requirements
• Business Units, Internal Stakeholders, and Third-Parties
• Other Teams
• Intelligence Consumers Needs and Requirements
• Priority Intelligence Requirements (PIRs)
• Factors for Prioritizing Requirements
• MoSCoW Method for Prioritizing Requirements
• Prioritize Organizational Assets
• Rules of Engagement
• Non-Disclosure Agreements
• Avoid Common Threat Intelligence Pitfalls

Planning Threat Intelligence Program

• Prepare People, Processes, and Technology
• Develop a Collection Plan
• Schedule Threat Intelligence Program
• Plan a Budget
• Develop Communication Plan to Update Progress to Stakeholders
• Aggregate Threat Intelligence
• Select a Threat Intelligence Platform
• Consuming Intelligence for Different Goals
• Track Metrics to Keep Stakeholders Informed

Establishing Management Support

• Prepare Project Charter and Policy to Formalize the Initiative
• Establish Your Case to Management for a Threat Intelligence Program
• Apply a Strategic Lens to the Threat Intelligence Program

Building a Threat Intelligence Team

• Satisfy Organizational Gaps with the Appropriate Threat Intelligence Team
• Understand different Threat Intelligence Roles and Responsibilities
• Identify Core Competencies and Skills
• Define Talent Acquisition Strategy
• Building and Positioning an Intelligence Team
• How to Prepare an Effective Threat Intelligence Team

Overview of Threat Intelligence Sharing

• Establishing Threat Intelligence Sharing Capabilities
• Considerations for Sharing Threat Intelligence
• Sharing Intelligence with Variety of Organizations
• Types of Sharing Partners
• Important Selection Criteria for Partners
• Sharing Intelligence Securely

Reviewing Threat Intelligence Program

• Threat Intelligence Led Engagement Review
• Considerations for Reviewing Threat Intelligence Program
• Assessing the Success and Failure of the Threat Intelligence Program

Topic Covered:

Overview of Threat Intelligence Data Collection

• Introduction to Threat Intelligence Data Collection
• Data Collection Methods
• Types of Data
• Types of Threat Intelligence Data Collection

Overview of Threat Intelligence Collection Management

• Understanding Operational Security for Data Collection
• Understanding Data Reliability
• Ensuring Intelligence Collection Methods Produce Actionable Data
• Validate the Quality and Reliability of Third Party Intelligence Sources
• Establish Collection Criteria for Prioritization of Intelligence Needs and Requirements
• Building a Threat Intelligence Collection Plan

Overview of Threat Intelligence Feeds and Sources

• Threat Intelligence Feeds
• Threat Intelligence Sources

Understanding Threat Intelligence Data Collection and Acquisition

• Threat Intelligence Data Collection and Acquisition
• Data Collection through Open Source Intelligence (OSINT)
• Data Collection through Search Engines
• Data Collection through Advanced Google Search
• Data Collection through Google Hacking Database
• Data Collection through ThreatCrowd
• Data Collection through Deep and Dark Web Searching
• Data Collection through Web Services
• Finding Top-level Domains (TLDs) and Sub-domains
• Data Collection through Job Sites
• Data Collection through Groups, Forums, and Blogs
• Data Collection through Social Networking Sites
• Data Collection related to Blacklisted and Whitelisted Sites
• Data Collection through Website Footprinting
• Data Collection through Monitoring Website Traffic
• Data Collection through Website Mirroring
• Extracting Website Information from https://archive.org
• Extracting Metadata of Public Documents
• Data Collection through Emails
• Data Collection by Tracking Email Communications
• Data Collection from Email Header
• Data Collection through Emails: eMailTrackerPro
• Data Collection through Whois Lookup
• Data Collection through DNS Interrogation
• Data Collection through DNS Lookup and Reverse DNS Lookup
• Fast-Flux DNS Information Gathering
• Dynamic DNS (DDNS) Information Gathering
• DNS Zone Transfer Information Gathering
• Automating OSINT effort using Tools/Frameworks/Scripts
• Maltego
• OSTrICa (Open Source Threat Intelligence Collector)
• OSRFramework
• FOCA
• GOSINT
• Automating OSINT effort using Tools/Frameworks/Scripts
• Data Collection through Human Intelligence (HUMINT)
• Data Collection through Human-based Social Engineering Techniques
• Data Collection through Interviewing and Interrogation
• Social Engineering Tools
• Data Collection through Cyber Counterintelligence (CCI)
• Data Collection through Honeypots
• Data Collection through Passive DNS Monitoring
• Data Collection through Pivoting Off Adversary’s Infrastructure
• Data Collection through Malware Sinkholes
• Data Collection through YARA Rules
• Data Collection through Indicators of Compromise (IoCs)
• IoC Data Collection through External Sources
• Commercial and Industry IoC Sources
• IT-ISAC
• Free IoC Sources
• AlienVault OTX
• Blueliv Threat Exchange Network
• MISP
• threat_note
• Cacador
• IOC Bucket
• Tools for IoC Data Collection through External Sources
• IoC Data Collection through Internal Sources
• Tools for IoC Data Collection through Internal Sources
• Splunk Enterprise
• Valkyrie Unknown File Hunter
• IOC Finder
• Redline
• Data Collection through Building Custom IoCs
• Tools for Building Custom IoCs
• IOC Editor
• Steps for effective usage of Indicators of Compromise (IoCs) for Threat Intelligence
• Data Collection through Malware Analysis
• Preparing Testbed for Malware Analysis
• Data Collection through Static Malware Analysis
• Data Collection through Dynamic Malware Analysis
• Malware Analysis Tools
• Blueliv Threat Exchange Network
• Valkyrie
• Tools for Malware Data Collection

Understanding Bulk Data Collection

• Introduction to Bulk Data Collection
• Forms of Bulk Data Collection
• Benefits and Challenges of Bulk Data Collection
• Bulk Data Management and Integration Tools

Understanding Data Processing and Exploitation

• Threat Intelligence Data Collection and Acquisition
• Introduction to Data Processing and Exploitation
• Structuring/Normalization of Collected Data
• Data Sampling
• Types of Data Sampling
• Storing and Data Visualization
• Sharing the Threat Information

Topic Covered:

Overview of Data Analysis

• Introduction to Data Analysis
• Contextualization of Data
• Types of Data Analysis

Understanding Data Analysis Techniques

• Statistical Data Analysis
• Data Preparation
• Data Classification
• Data Validation
• Data Correlation
• Data Scoring
• Statistical Data Analysis Tools
• SAS/STAT Software
• IBM SPSS
• Analysis of Competing Hypotheses (ACH)
• Hypothesis
• Evidence
• Diagnostics
• Refinement
• Inconsistency
• Sensitivity
• Conclusions and Evaluation
• ACH Tool
• PARC ACH
• Structured Analysis of Competing Hypotheses (SACH)
• Other Data Analysis Methodologies

Overview of Threat Analysis

• Introduction to Threat Analysis
• Types of Threat Intelligence Analysis

Understanding Threat Analysis Process

• Threat Analysis Process and Responsibilities
• Threat Analysis based on Cyber Kill Chain Methodology
• Aligning the Defensive Strategies with the Phases of the Cyber Kill Chain Methodology
• Perform Threat Modeling
• Asset Identification
• System Characterization
• System Modeling
• Threat Determination and Identification
• Threat Profiling and Attribution
• Threat Ranking
• Threat Information Documentation
• Threat Modeling Methodologies
• STRIDE
• PASTA
• TRIKE
• VAST
• DREAD
• OCTAVE
• Threat Modeling Tools
• Microsoft Threat Modelling Tool
• ThreatModeler
• securiCAD Professional
• IriusRisk
• Enhance Threat Analysis Process with the Diamond Model Framework
• Enrich the Indicators with Context
• Validating and Prioritizing Threat Indicators

Overview of Fine-Tuning Threat Analysis

• Fine-Tuning Threat Analysis
• Identifying and Removing Noise
• Identifying and Removing Logical Fallacies
• Identifying and Removing Cognitive Biases
• Automate Threat Analysis Processes
• Develop Criteria for Threat Analysis Software
• Employ Advanced Threat Analysis Techniques
• Machine Learning based Threat Analysis
• Cognitive based Threat Analysis

Understanding Threat Intelligence Evaluation

• Threat Intelligence Evaluation
• Threat Attribution

Creating Runbooks and Knowledge Base

• Developing Runbooks
• Create an Accessible Threat Knowledge Repository
• Organize and Store Cyber Threat Information in Knowledge Base

Intelligence Tools

• Threat Intelligence Tools
• AlienVault USM Anywhere
• IBM X-Force Exchange
• ThreatConnect
• SurfWatch Threat Analyst
• AutoFocus
• Additional Threat Intelligence Tools

Topic Covered:

Overview of Threat Intelligence Reports

• Threat Intelligence Reports
• Types of Cyber Threat Intelligence Reports
• Threat Analysis Reports
• Threat Landscape Reports
• Generating Concise Reports
• Threat Intelligence Report Template
• How to Maximize the Return from Threat Intelligence Report
• Continuous Improvement via Feedback Loop
• Report Writing Tools
• MagicTree
• KeepNote

Introduction to Dissemination

• Overview of Dissemination
• Preferences for Dissemination
• Benefits of Sharing Intelligence
• Challenges to Intelligence Sharing
• Disseminate Threat Intelligence Internally
• Building Blocks for Threat Intelligence Sharing
• Begin Intelligence Collaboration
• Establish Information Sharing Rules
• Information Sharing Model
• Information Exchange Types
• TI Exchange Architectures
• TI Sharing Quality
• Access Control on Intelligence Sharing
• Intelligence Sharing Best Practices

Participating in Sharing Relationships

• Why Sharing Communities are Formed?
• Join a Sharing Community
• Factors to be Considered When Joining a Community
• Engage in Ongoing Communication
• Consume and Respond to Security Alerts
• Consume and Use Indicators
• Produce and Publish Indicators
• External Intelligence Sharing
• Establishing Trust
• Organizational Trust Models

Overview of Sharing Threat Intelligence

• Sharing Strategic Threat Intelligence
• Sharing Tactical Threat Intelligence
• Sharing Operational Threat Intelligence
• Sharing Technical Threat Intelligence
• Sharing Intelligence using YARA Rules
• IT-ISAC (Information Technology - Information Security and Analysis Center)

Overview of Delivery Mechanisms

• Forms of Delivery
• Machine Readable Threat Intelligence (MRTI)
• Standards and Formats for Sharing Threat Intelligence
• Traffic Light Protocol (TLP)
• MITRE Standards
• Managed Incident Lightweight Exchange (MILE)
• VERIS
• IDMEF

Understanding Threat Intelligence Sharing Platforms

• Information Sharing and Collaboration Platforms
• Blueliv Threat Exchange Network
• Anomali STAXX
• MISP (Malware Information Sharing Platform)
• Cyware Threat Intelligence eXchange (CTIX)
• Soltra Edge
• Information Sharing and Collaboration Platforms

Overview of Intelligence Sharing Acts and Regulations

• Cyber Intelligence Sharing and Protection Act (CISPA)
• Cybersecurity Information Sharing Act (CISA)

Overview of Threat Intelligence Integration

• Integrating Threat Intelligence
• How to Integrate CTI into the Environment
• Acting on the Gathered Intelligence
• Tactical Intelligence Supports IT Operations: Blocking, Patching, and Triage
• Operational Intelligence Supports Incident Response: Fast Reaction and Remediation
• Strategic Intelligence Supports Management: Strategic Investment and Communications