About Cyber Threat Intelligence - Part 2 | Types of Cyber Threat Intelligence

 

There are four categories of threat intelligence, and while they overlap in certain areas, understanding them will help you comprehend the various types of threat intelligence.

1. Strategic Threat Intelligence is an analysis and information on trends over time that can be used to inform decision-making, particularly pertinent for Board and C-suite stakeholders. Common information sources for strategic threat intelligence consist of:

• State and nongovernmental organizations' policy documents
• Information from local and national media, industry- and subject-specific publications, and subject-matter specialists.
• White papers, research reports, and additional content generated by security organizations
• Effective strategic threat intelligence begins with the formulation of intelligence requirements through the formulation of focused, specific queries. It also necessitates analysts with knowledge beyond typical cybersecurity skills, specifically a solid grasp of sociopolitical and business concepts.

2. Operational Threat Intelligence refers to the information of cyber attacks or campaigns. It provides intelligence from ongoing and incoming attacks, including intelligence of actors and campaign details, enabling organizations to respond to cyber incidents based on the nature, intent, and timeline of specific attacks.

3. Tactical Threat Intelligence is intelligence regarding the tactics, techniques, and procedures (TTPs) of threat actors. It describes the techniques, tactics, and procedures (TTPs) of threat actors. It should help cyber defenders comprehend, in specific terms, how their organization could be attacked, as well as the most effective ways to defend against or mitigate such attacks. It typically incorporates technical context and is used by personnel directly involved in an organization's defense, such as system architects, security analysts, and IT security personnel.

4. Technical Threat Intelligence derived primarily from internal sources and heavily reliant on indicators of compromise (IOCs). Technical threat intelligence is typically used in malware research and detection to catalog malware families according to their characteristics, such as malicious domains, phishing email headers and malware hash checksums.

I will explain on the evolution of threat intelligence on the next post. Stay tuned :-)