Book Image

Operationalizing Threat Intelligence

By : Kyle Wilhoit, Joseph Opacki
Book Image

Operationalizing Threat Intelligence

By: Kyle Wilhoit, Joseph Opacki

Overview of this book

We’re living in an era where cyber threat intelligence is becoming more important. Cyber threat intelligence routinely informs tactical and strategic decision-making throughout organizational operations. However, finding the right resources on the fundamentals of operationalizing a threat intelligence function can be challenging, and that’s where this book helps. In Operationalizing Threat Intelligence, you’ll explore cyber threat intelligence in five fundamental areas: defining threat intelligence, developing threat intelligence, collecting threat intelligence, enrichment and analysis, and finally production of threat intelligence. You’ll start by finding out what threat intelligence is and where it can be applied. Next, you’ll discover techniques for performing cyber threat intelligence collection and analysis using open source tools. The book also examines commonly used frameworks and policies as well as fundamental operational security concepts. Later, you’ll focus on enriching and analyzing threat intelligence through pivoting and threat hunting. Finally, you’ll examine detailed mechanisms for the production of intelligence. By the end of this book, you’ll be equipped with the right tools and understand what it takes to operationalize your own threat intelligence function, from collection to production.
Table of Contents (18 chapters)
1
Section 1: What Is Threat Intelligence?
6
Section 2: How to Collect Threat Intelligence
12
Section 3: What to Do with Threat Intelligence

Red and blue teams

Most people we know believe that the origin of the red team versus the blue team concept can be traced back to the Red vs. Blue web series based on the Halo franchise of video games. If so, what an epic beginning! I have even heard that the concept was based on cells within the human body where red blood cells attack a virus while another defends the human. However, in reality, the term originated in the military as a vehicle to evaluate an organization's strength and also the quality of the strategies that they were developing from an external perspective. The red team was the aggressor, while the blue team became the defender.

In the context of cyber intelligence, red teams and blue teams are security functions within an organization that portray different viewpoints of a cyber threat. The red team portrays the offensive viewpoint, while the blue team portrays the defensive. Red teams test the defenses of an organization by utilizing simulated attacks and...