Cyber threat intelligence

According to CERT-UK cyber threat intelligence (CTI) is an "elusive" concept. While cyber security comprises the recruitment of IT security experts, and the deployment of technical means, to protect an organization's critical infrastructure, or intellectual property, CTI is based on the collection of intelligence using open source intelligence (OSINT), social media intelligence (SOCMINT), human Intelligence (HUMINT) or intelligence from the deep and dark web. CTI's key mission is to research and analyze trends and technical developments in three areas:

Those accumulated data based on research and analysis enable states to come up with preventive measures in advance. Considering the serious impacts of cyber threats, CTI has been raised as an efficient solution to maintain international security.

According to UK's Centre for the Protection of National Infrastructure (CPNI), there are four types of threat intelligence:

In the financial sector, the CBEST framework of the Bank of England assumes that penetration testing is no longer adequate to protect sensitive business sectors, such as the banking sector. In response, the UK Financial Authorities (Bank of England, Her Majesty’s Treasury, and the Financial Conduct Authority) recommend several steps to guard financial institutions from cyber threats, including receiving "advice from the cyber threat intelligence providers operating within the UK Government."

Behind any cyber threat there are people using computers, software and networks. During or after a cyber attack technical information about the network and computers between the attacker and the victim can be collected. However, identifying the person(s) behind an attack, their motivations, or the ultimate sponsor of the attack, is difficult. Recent efforts in threat intelligence emphasize understanding adversary TTPs.

Influential geopolitical countries, such as the US, Russia, China and Iran, use cyberspace as an extension of their foreign and intelligence collection policies. To achieve these objectives, they have formed APT units that primarily specialise in the following fields:

A combination of CTI with political risk analysis, which includes a deep understanding of current geopolitical disputes and leadership ulterior political motives, can help analysts understand future cyberwarfare patterns.

...
Wikipedia