Ten Years of Cyber Threat Intelligence: Retrospectives
summary
Eleven years of CTI are condensed into a claim that intelligence now reduces ignorance by turning data into actionable context: a one-sentence definition is information about threats and threat actors that provide sufficient understanding to mitigate a harmful event. Examples include GhostNet and Operation Aurora as inflection points, APT1 as a standards-setting report, and the Pyramid of Pain showing indicator fragility. Practical tools and trends named are MISP, MITRE ATT&CK, domain/DGA detection, vulnerability intelligence, precursor hunting, and increasing automation and sharing to get left of the bang.
AI-written summary · about
chapters (4)
related talks
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
21mAdvanced Cyber Threat Intelligence Chapter - How to Read the Mind of your Attackers
01mQuick Look: These Aren't the Threats You're Looking For: How Our APT Focus Ruins CTI
51mUsing Critical Threat Intelligence Strategically
26mEvaluating Threat Intelligence Through Velocity
55mDefender Perspectives: Getting ROI from Cyber Threat Intelligence Vendors
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program