1. Hurricanes, Earthquakes, and Threat Intelligence
Jonathan Couch, Senior Vice President - Strategy
ThreatQuotient, Inc.
Hurricanes, Earthquakes, and Threat Intelligence

2. Hurricanes Earthquakes
Cybersecurity
In my experience, 2 things organizations face:
Hurricanes: you can see them coming. You know the threats are out there. They test your ability as an organization to protect and defend. Once you’ve encountered a few hurricanes, the challenge becomes to anticipate the threats the hurricane poses.
Earthquakes: this is when you’re network just comes alive. Things are happening that you didn’t anticipate. Earthquakes test your ability to detect, respond, and be resilient.

3. Threat Intelligence and You
Understand what it is
Understand what you need
Define how to use it
Make it your own
Put it all together
Threat Intelligence and You
Today, we will walk through different types of threat intelligence to understand what it is, how it is created, and how you can operationalize it.

4. Understand the Threat
© 2016 ThreatQuotient - Confidential 4

5. AGILITY
OBSERVE
ORIENT
DECIDE
ACT
OODA Loop

6. Fighting the Bad Guys is Hard
Dynamic Threat Landscape
Vendor Overload
Changing Computing Models
Data & Noise
Explosion
Limited Human Resources
Manual Operations
& Analysis

7. Security Operations Decisions
AUTOMATION
NOISE
THREAT
NUISANCE
CONTEXT
ADVERSARY

8. The “Right” Intelligence
Threat Data
Reactive
Contextual Threat Intel
Proactive
Relevant Threat Intel
Anticipatory
Knowledge, Wisdom
Predictive
The “Right” Intelligence
Strategic
Operational
Tactical/Technical

9. ? Transforming Data into Intelligence Context THREAT DATA
THREAT INTELLIGENCE
Context
WHO
WHAT
WHERE
WHEN
WHY
HOW ?

10. Actionability Timely Accurate Relevant The ART of Intelligence
Was the intelligence reliable and detailed?
Relevant:
Does the intelligence apply to you and your mission/business?
Timely:
Did you receive the intelligence with enough time to do something about it?
Actionability

11. Use Case and Stakeholder Analysis
Risk Management
Investigations Team
Business Units
Vulnerability Management
Patch Management
Security
Infrastructure
Executives/
Board of Directors
CISO
Security Operations Center
Incident Response Team
Cyber Threat Intelligence Team
CONTENT, FORMAT, FREQUENCY

12. Data Intel CONSUMPTION Make It Your Own Knowledge Add insight
Understanding
Knowledge
Intel
Data
Add insight
Add business context
Fuse
Make relevant
Interpret
CONSUMPTION
Add context
Verify
Categorize

13. Implementing a Threat Intelligence Program

14. Intelligence Operations and Management
ACQUIRE
AGGREGATE
ANALYZE
ACTION
Commercial
Industry
Open Source
Private
Academic
Network of Peers
Internal
Government
SIEM
Sensor Grid
THREAT DATA FEEDS
Log Repository
Ticketing
Knowledgebase
Tools
Communities
SHARING PLATFORMS
Commercial
Government
ACCURATE
RELEVANT
TIMELY

15. Threat Intelligence and You
Understand what it is
Understand what you need
Define how to use it
Make it your own
Put it all together
Threat Intelligence and You
Today, we will walk through different types of threat intelligence to understand what it is, how it is created, and how you can operationalize it.

16. QUESTIONS? OR