Cyber Threat Intelligence,Threat intelligence Analyst.pptx

Cyber threat intelligence introduction

1. Presented by M.Sri Soundharyaa Asst.Prof Department of CS with Cyber Security SRCAS

2. UNIT 1 Introduction to Threat Intelligence

3. What is Threat? The possibility of trouble or danger. In cyber security , a threat refers to any potential danger that could harm systems , data, or operations.  These threats can be malicious acts, such as cyber attacks or data breaches, or unintentional occurrences, like system errors.

4. Cyber Threat intelligence It is the process of gathering, analyzing, and sharing information about CYBER threats to help organizations proactively defend against attacks.  It aims to help organizations understand and mitigate risks by providing insights into threat actors, their motivations, and attack techniques.

5. Why is threat intelligence important ? Threat intelligence plays a critical role in keeping organizations one step ahead of attackers . With the rise of advanced persistent threats ( APTs ), threat intelligence offers invaluable insight into tactics , techniques, and procedures (TTPs), helping defenders anticipate and preempt potential attacks.

6. While many organizations understand the importance of threat intelligence, they often use it in a limited capacity typically by integrating -----threat data feeds into existing tools like firewalls, intrusion prevention systems (IPS), and security information and event management systems (SIEMs). This basic application only scratches the surface of what threat intelligence can offer.

7. Advanced Persistent Threats (APT ) An advanced persistent threat is an attack in which an unauthorized user gains access to a network system and remains there for a long time without being detected. Advanced persistent threats are highly menacing for organizations, as attackers have continuous access to the company’s data. Advanced persistent threats are carried out in phases which involve hacking the network, hiding themselves to access as much information as possible, planning an attack, studying organization’s information systems, searching for easy access to sensitive data, and exfiltrating that data.

8. What Does Threat Intelligence Do? Threat intelligence helps organizations with valuable knowledge about these threats , build effective defense mechanisms, and mitigate the risks that could cause financial and reputational damage. Threat Intelligence is the predictive capability to defend the future attacks that the organization is exposed to so they can proactively tailor their defenses and preempt future attacks.

9. Who is A Cyber Threat Intelligence Analyst ? A cyber intelligence analyst is a security professional who monitors and analyzes external cyber threat data to provide actionable intelligence . These experts triage data of security incidents collected from different threat intelligence sources and study the pattern of attacks, their methodology, motive, severity, and threat landscape .

10. This data is then analyzed and filtered to produce threat intelligence feeds and reports that help management (security officer) in making decisions concerning organizational security. Often , these individuals are Certified Threat Intelligence Analysts who come with both the knowledge and skills needed for the job role.

11. Creating a Cyber Threat Intelligence Program What is a Cyber Threat Intelligence Program ? Cyber Threat Intelligence program  combines thousands of Threat Intelligence Feeds into a single feed, instead of viewing them separately to enable consistent characterization and, categorization of cyber threat events, and identify trends or changes in the activities of cyber adversaries . The program consistently describes cyber threat activity in a way that allows efficient information sharing and threat analysis. It assists the threat intelligence team by comparing the feed with internal telemetry and creates alerts.

12. Rules for Implementing a Cyber Threat Intelligence Program Create a Plan Involve the right people Understand the difference between Threat Data and Threat Intelligence Communication Know who all need the Intelligence Implement the right TTP (Tools, Techniques and Procedures) Integrate with the Organization security technology

13. The Benefits of Threat Intelligence Early Threat Detection Helps Mitigate Attacks Understanding Threat Actors for Proactive Defense Prioritizing Vulnerability Management Informing Strategic Decisions for Business Success

14. C hallenges in Threat Intelligence 1: Data Overload Organizations often face an overwhelming amount of data from various sources, making it difficult to filter and analyze relevant threat information .  2: Lack of Contextual Information Raw threat data often lacks context, making it challenging for security teams to understand the relevance and potential impact of a threat.

15. 3: Timely Threat Detection and Response Delays in detecting and responding to threats can lead to significant damage. Traditional methods often fail to provide real-time insights . 4: Integration with Existing Security Tools Integrating threat intelligence platforms with existing security infrastructure can be complex and resource-intensive.

16. Types of Cyberthreat Intelligence Strategic Threat Intelligence   Tactical Threat Intelligence   Operational Threat Intelligence   

17. Strategic Threat Intelligence  - an executive-level intelligence that gives an overall view of the threat landscape, including threat actors, their capabilities, motivations, and attack trends. It enables organizations to make informed security decisions.

18. Tactical Threat Intelligence  - helps detect threats in networks by analyzing indicators like IP addresses, file hashes, and domains . Operational Threat Intelligence  - real-time monitoring of networks and systems to identify vulnerabilities and threats. Analysts and responders use this intelligence to detect and respond to cyber threats quickly.

19. Thank You….