What is Cyber Threat Intelligence and how is it used?
Cyber threat intelligence is the range of data and information available within your organisation about past, current and potential cyberattacks on your business. The process involves building a detailed and documented understanding of cyber threats and the motives, tactics, and procedures used by malicious actors. This knowledge is what helps you create robust security defenses, and appropriate incident response.
E-Book
Get an in-depth view of the range of cyber threats out there.
We put together a compilation of:
-
The major cyberattacks in Australia last year, across a number of industries including, healthcare, financial services, technology, and e-commerce
-
How they impacted the businesses
-
How they could have been prevented
Why Invest in Cyber Security Threat Intelligence?
3 Types of Cyber Threat Intelligence
Tactical Threat Intelligence
Aimed at identifying simple indicators of compromise (IOCs) like malicious IP addresses, URLs or domain names. It is machine-readable and typically automated through various security software and tools. However, it’s important to note that tactical intelligence is actionable for a few hours or days at best because cyber criminals are continuously changing their tools and methods.
Operational Intelligence
Refers to the collection of knowledge about cyberattacks, events, or campaigns. It helps incident response teams understand the nature, intent, and timing of specific attacks. Unlike tactical intelligence, machines alone cannot collect operational intelligence and human personnel are required to analyse raw data and convert it into a format that is easy to understand and use.
Strategic Intelligence
Documents how events on a global scale - foreign policies, and other long-term movements - can potentially impact the cybersecurity of an organisation. Strategic intelligence provides clarity to an organisation’s threat landscape and is intended to inform high-level decisions made by executives and other decision-makers at an organisation. It is generally less technical and presented through reports or briefings.
Combined, they create an information repository to empower stakeholders
Executive Management
Provides context to the risks the organisation faces and what the options are to address their impact
Security Operations Centre
Evaluate which incidents need to be prioritised based on risk and impact on the organisation
Incident Response Team
Accelerate incident investigations, management, and prioritisation
Security / IT Analyst
Improve prevention and detection technology in the effort to strengthen defences