Cyber threat intelligence

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search

Cyber threat intelligence is information about threats and threat actors that helps mitigate harmful events in cyberspace.[1] Cyber threat intelligence sources include open source intelligence, social media intelligence, human Intelligence, technical intelligence or intelligence from the deep and dark web.


There are three overarching types of threat intelligence:[1]

  • Tactical: technical intelligence (including Indicators of Compromise such as IP addresses, file names, or hashes) which can be used to assist in the identification of threat actors
  • Operational: details of the motivation or capabilities of threat actors, including their tools, techniques and procedures
  • Strategic: intelligence about the overarching risks associated with cyber threats which can be used to drive high-level organizational strategy

Benefits of cyber threat intelligence[edit]

Cyber threat intelligence provides a number of benefits, including:

  • Empowers organisations to develop a proactive cybersecurity posture and to bolster overall risk management policies
  • Drives momentum toward a cybersecurity posture that is predictive, not just reactive
  • Enables improved detection of threats
  • Informs better decision-making during and following the detection of a cyber intrusion

Key elements[edit]

Cyber threat data or information with the following key elements are considered as cyber threat intelligence:[2]

  • Evidence-based: cyber threat evidence may be obtained from malware analysis to be sure the threat is valid
  • Utility: there needs to be some utility to have a positive impact on a security incident's outcome or organization
  • Actionable: the gained cyber threat intelligence should drive security control action, not only data or information


Cyber threats involve the use of computers, software and networks. During or after a cyber attack technical information about the network and computers between the attacker and the victim can be collected. However, identifying the person(s) behind an attack, their motivations, or the ultimate sponsor of the attack, is difficult. Recent efforts in threat intelligence emphasize understanding adversary TTPs.[3] Across industries, organizations have started using the MITRE ATT&CK framework to understand threat actors' TTPs and identify holes in defenses.

A number of reports have been released by public and private sector organisations which attribute cyber attacks. This includes Mandiant's APT1 and APT28 reports, US CERT's APT29 report, and Symantec's Dragonfly, Waterbug Group and Seedworm reports. [4]

CTI Sharing[edit]

In 2015 U.S. government legislation in the form of the "Cybersecurity Information Sharing Act" encouraged the sharing of CTI indicators between government and private organizations. This act required the U.S. federal government to facilitate and promote 4 CTI objectives:[5]

  1. Sharing of "classified and declassified cyber threat indicators in possession of the federal government with private entities, nonfederal government agencies, or state, tribal, or local governments";
  2. Sharing of "unclassified indicators with the public";
  3. Sharing of "information with entities under cybersecurity threats to prevent or mitigate adverse effects";
  4. Sharing of "cybersecurity best practices with attention to the challenges faced by small businesses.

In 2016, the U.S. government agency National Institute of Standards and Technology (NIST) issued a publication (NIST SP 800-150) which further outlined the necessity for Cyber Threat Information Sharing as well as a framework for implementation.[6]

See also[edit]


  1. ^ a b "Understanding Cyber Threat Intelligence Operations" (PDF). Bank of England. 2016.
  2. ^ GerardJohansen (2017-07-24). Digital Forensics and Incident Response. Packt Publishing Ltd, 2017. p. 269. ISBN 9781787285392.
  3. ^ Levi Gundert, How to Identify Threat Actor TTPs
  4. ^ PrivacySavvy
  5. ^ Burr, Richard (2015-10-28). "S.754 - 114th Congress (2015-2016): To improve cybersecurity in the United States through enhanced sharing of information about cybersecurity threats, and for other purposes". Retrieved 2021-06-09.
  6. ^ Johnson, Christopher S.; Badger, Mark Lee; Waltermire, David A.; Snyder, Julie; Skorupka, Clem (October 2016). "Guide to Cyber Threat Information Sharing". doi:10.6028/nist.sp.800-150. Cite journal requires |journal= (help)

Further reading[edit]