Speaker 1: Welcome to the deep dive. Today. We're tackling cyber threat intelligence,
Speaker 1: a really crucial area, and we're.
Speaker 2: Doing that using a great resource you shared with us,
Speaker 2: Visual Threat Intelligence by Thomas Rochia.
Speaker 1: Exactly.
Speaker 2: Yeah. Our goal here is really to pull out the
Speaker 2: key ideas, the essential concepts from the book.
Speaker 1: Right, and the practical applications too, exactly and.
Speaker 2: Make it really clear for you, even if your background
Speaker 2: isn't super technical.
Speaker 1: In this book, Visual Threat Intelligence, it seems perfect for that.
Speaker 1: It's gotten praise from places like the DFIR.
Speaker 2: Report that's Digital Forensics and Incident Response.
Speaker 1: Right and Pulse Dive too. They highlighted its clear explanations,
Speaker 1: its real world focus.
Speaker 2: And the author Thomas Rochia, he definitely knows his stuff.
Speaker 1: Oh yeah, over a decade at Microsoft as a senior
Speaker 1: security researcher. Plus he runs security break dot io shares
Speaker 1: his research there, and.
Speaker 2: He's been involved in some big cyber events, contributes to
Speaker 2: open source projects like the unprotect project.
Speaker 1: So definitely experienced.
Speaker 2: Absolutely so for you, our listener, thinking of you as
Speaker 2: the learner, this should be a good shortcut.
Speaker 1: Yeah, helping understand these important cybersecurity concepts, hopefully getting those aha,
Speaker 1: moments without you know, getting totally bogged down in jargon.
Speaker 2: That's the plan.
Speaker 1: Okay, let's jump right in. Then fundamentally, what is threat intelligence?
Speaker 2: Well, at its core, it's about gathering information on cyber.
Speaker 1: Threats Okay, gathering info, yeah.
Speaker 2: Then analyzing it to really understand those threats, and then
Speaker 2: crucially sharing that understanding so you can improve security.
Speaker 1: So it's kind of like reconnaissance, getting a step ahead
Speaker 1: of attackers by figuring out who they are and what
Speaker 1: they do decisely.
Speaker 2: Now, the book makes it distinction, which is useful. There's
Speaker 2: security intelligence it's broader any security info, right, and then
Speaker 2: there's cyber threat intelligence CTI. Yeah, that's our focus today,
Speaker 2: just like in the book. Often they just call it
Speaker 2: threat intelligence.
Speaker 1: I got it. CTI. It is, So what kind of
Speaker 1: intelligence are we talking thinking about? The book lays out
Speaker 1: three main types it does.
Speaker 2: Yeah, and it's interesting these terms actually come from military
Speaker 2: intelligence originally. So the first one is tactical threat intelligence,
Speaker 2: think immediate.
Speaker 1: Actionable, like what's happening right now exactly?
Speaker 2: Threats targeting you in real time. Security teams use this
Speaker 2: stuff daily for identifying ongoing incidents and responding quickly.
Speaker 1: So spotting some specific malware trying to get in and
Speaker 1: knowing exactly how to stop it right then and there.
Speaker 2: That's a perfect example. Then you've got operational threat intelligence. Okay,
Speaker 2: this goes a bit deeper into the attackers themselves. It
Speaker 2: asks why are they attacking? What are their capabilities, their tools,
Speaker 2: their methods, their tools, techniques, intentions, all of it. This
Speaker 2: is super important for incident response. If you know who
Speaker 2: you're dealing with, you can anticipate their moves better.
Speaker 1: Right, So it's not just seeing the attack, but understanding
Speaker 1: the attackers whole playbook.
Speaker 2: Almost you got it. And the third type is strategic
Speaker 2: threat intelligence.
Speaker 1: Strategic sounds high level.
Speaker 2: It is. It's the big picture view, long term analysis
Speaker 2: of the whole cyber threat.
Speaker 1: Landscape, looking at overall trends.
Speaker 2: Trends, yeah, emerging threats, even how things like geopolitics might
Speaker 2: impact cyber risk. This helps the leadership the execs make
Speaker 2: informed decisions about the overall security strategy long term stuff.
Speaker 1: Okay, that makes sense. So tactical for the now, operational
Speaker 1: for the who and why, and strategic for the long view.
Speaker 1: Each has its place.
Speaker 2: Definitely, a complete security program needs all three working together.
Speaker 1: Now, the book talks about a threat intelligence life cycle.
Speaker 1: Why is having a structured process like that important?
Speaker 2: Well, it gives you a systematic way to actually do
Speaker 2: threat intelligence effectively. It's a recognized method turning raw data
Speaker 2: just noise sometimes into insights you can actually use.
Speaker 1: And you mentioned its origins CIA.
Speaker 2: Yeah. Interestingly, a similar structured cycle was first developed by
Speaker 2: the CIA for intelligence work, not just cyber. It's been
Speaker 2: adapted since there.
Speaker 1: Okay, and it has six stages. Let's uh walk through those.
Speaker 2: Sure. It starts with planning and direction. This is crucial.
Speaker 2: It is where you figure out what you actually need
Speaker 2: to know, what threats matter most to.
Speaker 1: Your organization, defining the mission basically exactly.
Speaker 2: Then comes data collection, pretty straightforward, gathering the raw info
Speaker 2: from all sorts of sources.
Speaker 1: Okay.
Speaker 2: Stage three is processing and exploitation. Here you take that
Speaker 2: raw data and make it usable, filter out the noise,
Speaker 2: organize it, format it.
Speaker 1: Like panning for gold, sifting through the dirt to find
Speaker 1: the valuable nuggets.
Speaker 2: That's a great analogy. Actually, yeah. After that, Stage four
Speaker 2: is analysis and production. This is where the real magic.
Speaker 1: Happens, taking sense of it all.
Speaker 2: Exactly, examining the process, data finding, patterns, connecting dots and
Speaker 2: producing actual intelligence reports or briefings. Right then Stage five
Speaker 2: dissemination hugely important, getting the finished intelligence to the people
Speaker 2: who need it, the ones who can act on it.
Speaker 1: No point the analysis if it just sits on a
Speaker 1: shelf precisely, and the final stage six is feedback.
Speaker 2: This closes the loop. Did the intelligence help? Was it useful?
Speaker 2: What can we do better next time? It makes the
Speaker 2: whole process iterative, always improving.
Speaker 1: So it's a continuous cycle, constantly refining based on needs
Speaker 1: and results, not just a one shot deal. The book
Speaker 1: also mentions tailoring this life cycle. Can you give an
Speaker 1: example of how that works?
Speaker 2: Sure, the book uses a good one. Think about a
Speaker 2: bank versus say, a manufacturing plant.
Speaker 1: Okay, different priorities.
Speaker 2: Totally different. The bank, in their planning stage would heavily
Speaker 2: prioritize intelligence on threats targeting financial systems right like buoy
Speaker 2: TOSEL malware. A tax on online banking makes sense, whereas
Speaker 2: the manufacturing company might be much more focused on threats
Speaker 2: to their industrial control systems, the ICs networks that run
Speaker 2: the factory floor.
Speaker 1: So the life cycle structure stays the same, but the
Speaker 1: focus within each stage changes based on the organization's specific risks.
Speaker 2: Exactly, and then tying back to dissemination, that tailored intelligence
Speaker 2: needs to get to the right people for the bank.
Speaker 2: Maybe it's the fraud team and the application security team
Speaker 2: for the factory. Maybe it's the plant operations engineers and
Speaker 2: the OT security group.
Speaker 1: Got it okay, So we understand what the types of
Speaker 1: intelligence and the how the life cycle. Now the book
Speaker 1: moves into more practical aspects. What does that involve?
Speaker 2: Right? Practical threat intelligence? This is where it gets really grounded.
Speaker 2: The book talks about needing to consider real world context.
Speaker 2: Geopolitics is a big one, how so well tensions or
Speaker 2: alliances between countries can directly influence cyberactivity, state sponsored attacks, activism.
Speaker 2: It's often linked to global.
Speaker 1: Events, So you need to look beyond just the technical
Speaker 1: bits of an attack.
Speaker 2: Absolutely. The book suggests not just relying on news, but
Speaker 2: maybe even consulting experts in economics, politics, sociology sometimes to
Speaker 2: get a deeper understanding of a nation's goals and how
Speaker 2: they might play out in cyberspace.
Speaker 1: Interesting, that adds another layer.
Speaker 2: It does, and practically it means gathering info from diverse sources,
Speaker 2: not just your own logs, but security vendor reports, open
Speaker 2: source feeds, but also being aware of vulnerabilities potential weaknesses
Speaker 2: attackers might target. The analyst's job is then to pull
Speaker 2: all that together.
Speaker 1: Okay, and then we get to indicators of compromise IOCs.
Speaker 1: We hear that term all the time. What are they really?
Speaker 2: The IOCs are basically the breadcrumbs left behind by attackers,
Speaker 2: digital footprints, like.
Speaker 1: Clues at a crime scene.
Speaker 2: Exactly like that. They are pieces of data that suggest
Speaker 2: a system or network has been compromised. Could be a
Speaker 2: malicious file hash, its digital fingerprint, or a suspicious IP
Speaker 2: address the malwar talks to a weird domain name, maybe
Speaker 2: unusual network traffic.
Speaker 1: Patterns, things that shouldn't be there.
Speaker 2: Right. They give you a concrete trace of known bad activity. Now,
Speaker 2: the book does point out these IOCs can be fleeting.
Speaker 2: Attackers change their tools their infrastructure to avoid detection.
Speaker 1: So they might not be useful for law.
Speaker 2: They might have a short shelf life, yes, but they
Speaker 2: are still incredibly valuable. Collecting them, analyzing them, you can
Speaker 2: often identify other compromise systems, and if you link those
Speaker 2: IOCs back to that geopolitical context or other operational intelligence
Speaker 2: you start building a bigger picture of the attackers campaign.
Speaker 1: Ah so even a short lived IOC can be a
Speaker 1: key piece of the puzzle, helping.
Speaker 2: Connect dots precisely.
Speaker 1: The book also briefly mentions the Diamond model of intrusion analysis. Here.
Speaker 1: What's the gist of that.
Speaker 2: Right, The Diamond model. It's a framework really for breaking
Speaker 2: down an intrusion. It looks at four key interconnected points,
Speaker 2: the adversary, their capabilities, the infrastructure they use, and the victim.
Speaker 1: They target, like the corners of a diamond.
Speaker 2: Exactly. By analyzing how these four elements relate in this
Speaker 2: specific incident, analysts can get a much clearer picture of
Speaker 2: the attack, who's likely behind it, and maybe what they're after.
Speaker 2: We might touch on it more if other sources cover it.
Speaker 1: Okay, another tool for analysis, Now, this next one sounds
Speaker 1: really interesting. Analysis of competing hypotheses or ACH.
Speaker 2: Yes, ACH is a really powerful technique, especially when you're
Speaker 2: dealing with fuzzy situations, incomplete information, maybe even deliberately misleading
Speaker 2: clues during an investigation.
Speaker 1: Which happens a lot in cyber incidents.
Speaker 2: I imagine it certainly does. ACCH was actually developed by
Speaker 2: a CIA analyst back in the day. Its main purpose
Speaker 2: is to help analysts overcome their own cognitive biases.
Speaker 1: Like confirmation bias, where you just look for evidence that
Speaker 1: confirms what you already think.
Speaker 2: That's the big one, Yeah, confirmation bias. ACH tackles that
Speaker 2: head on by forcing you to consider multiple possible explanations
Speaker 2: hypotheses at the same time.
Speaker 1: Instead of just fixating on one theory.
Speaker 2: Right. And the key thing about ACCH the book stresses
Speaker 2: is that the goal isn't to prove one hypothesis, right,
Speaker 2: It's actually to disprove or eliminate the hypotheses that are
Speaker 2: inconsistent with the evidence.
Speaker 1: Oh, okay, It's about elimination, not confirmation exactly.
Speaker 2: It pushes you to think critically, if hypothesis be We're true,
Speaker 2: what evidence should I be seeing that I'm not. It
Speaker 2: forces a more rigorous objective approach.
Speaker 1: That sounds incredibly useful. How do you actually do it?
Speaker 1: Is there a process?
Speaker 2: There is? The book describes using a matrix. It's pretty straightforward. Conceptually,
Speaker 2: you list your competing hypotheses, your different theories about what
Speaker 2: happened across a top row, ok, and then down the
Speaker 2: left column you list all the relevant pieces of evidence
Speaker 2: or information.
Speaker 1: You have got it evidence versus hypotheses.
Speaker 2: Right, then you go sell by sell For each piece
Speaker 2: of evidence, you evaluate how consistent it is with each hypothesis.
Speaker 2: Does it support it, contradict it, is it irrelevant?
Speaker 1: So you systematically weigh everything against every possibility.
Speaker 2: You do, and this matrix visually shows you which hypotheses
Speaker 2: are most consistent with the bulk of the evidence, and crucially,
Speaker 2: which ones are clearly contradicted and can likely be ruled out.
Speaker 2: The book even points to a template for this matrix
Speaker 2: by Pasquale Sterparro, which is available online Hindi. Yeah, while
Speaker 2: this chapter doesn't go into all eight steps of the
Speaker 2: full eighth process, it gives you the core idea, the
Speaker 2: core value.
Speaker 1: Yeah, that structured thinking seems vital for complex investigations avoiding
Speaker 1: those mental traps. Okay, Moving on, the book talks about
Speaker 1: intelligence gathering disciplines. Sounds like different ways to get the
Speaker 1: information in the first place.
Speaker 2: Exactly, These are the various methods, the i iNTS as
Speaker 2: they're often called. Each gives you a different perspective, a
Speaker 2: different type of data.
Speaker 1: So what are the main ones?
Speaker 2: The book highlights several key ones. First up is open
Speaker 2: source intelligence ohcent probably the most well known.
Speaker 1: That's using publicly available stuff right the Internet.
Speaker 2: Right, Internet searches, public databases, social media, news reports, academic papers,
Speaker 2: even accessible parts of the dark web, anything publicly accessible.
Speaker 1: Okay, what else?
Speaker 2: Then there's human intelligence human seuman tea. This is gathering
Speaker 2: info from people, interviews, conversations, maybe even things like social engineering,
Speaker 2: though that gets ethically tricky.
Speaker 1: Right, talking to people yep.
Speaker 2: Then geospatial intelligence GUI in t uses imagery, satellite photos,
Speaker 2: aerial picks plus mapping data can be useful for pinpointing
Speaker 2: physical locations related to threats, like.
Speaker 1: Where servers might be hosted.
Speaker 2: Potentially yeah, or identifying physical infrastructure. Then you have signals
Speaker 2: intelligence SIGANT. This is about intercepting electronic signals like communications,
Speaker 2: recepting communications yeah, or analyzing network traffic metadata like NetFlow
Speaker 2: to understand communication patterns without seeing the content. And the
Speaker 2: book also mentions financial intelligence fem dietarian focusing on money
Speaker 2: trails analyzing transactions. This is obviously huge for tracking things
Speaker 2: like ransomware payments, often involving cryptocurrency these days.
Speaker 1: That's quite a list ocent human joint singant finite. The
Speaker 1: book mentions others too, like socent recon.
Speaker 2: Yeah, they're more specialized ones like social media intelligence, sobsince,
Speaker 2: imagery intelligence. I am in reconnaissance recon. The point the
Speaker 2: book makes is that you rarely rely on just one.
Speaker 2: You need a mix exactly. Combining insights from multiple disciplines
Speaker 2: gives you a much richer, more comprehensive understanding of the
Speaker 2: threat randscape that leads to better analysis and more effective responses.
Speaker 1: Makes sense, build a fuller picture from different angles. Okay.
Speaker 1: One last foundational concept from this part of the book,
Speaker 1: the Traffic Light Protocol TLP. What's that about?
Speaker 2: TLP is all about sharing information safely. It's a simple
Speaker 2: standardized system for classifying sensitive information to indicate how widely
Speaker 2: it can be shared.
Speaker 1: Standardize is key, I guess. So everyone's on the same
Speaker 1: page absolutely.
Speaker 2: It was developed by first that's the form unsend response
Speaker 2: and security teams to create a common language. It helps
Speaker 2: organizations share threat intel with partners, but with clear rules
Speaker 2: to prevent misuse or leaks.
Speaker 1: Okay, so it's like a handling label. What are the levels?
Speaker 1: The book mentions four colors.
Speaker 2: Right four cash KELP r ED is the most restrictive,
Speaker 2: basically for your eyes only or only the specific people
Speaker 2: it was directly sent to. No further sharing.
Speaker 1: Got it. Red means stop sharing, pretty much.
Speaker 2: Than TLP dot amb This means you can share it
Speaker 2: within your own organization on a need to know basis,
Speaker 2: but not outside your org.
Speaker 1: Okay, internal sharing allowed correct.
Speaker 2: Next is TLP green. This allows sharing with trusted partners
Speaker 2: or within a specific community like an industry group. But
Speaker 2: it shouldn't be posted publicly on the Internet.
Speaker 1: Wider sharing, but still within a defined community.
Speaker 2: Yes. And finally, TLP clear, no restrictions, share it freely
Speaker 2: publicly whatever.
Speaker 1: Red ambergreen clear seems pretty straightforward, and the book says
Speaker 1: it's the sender's job to label it correctly.
Speaker 2: Yes, the originator labels the information it needs to make
Speaker 2: sure the recipients understand what those labels mean and respect
Speaker 2: the sharing boundaries.
Speaker 1: And these labels get used in sharing platforms.
Speaker 2: They do. Platforms like MISP and OPENCTI often have built
Speaker 2: in TLP support, making it easier demand how intelligence is
Speaker 2: distributed based on its classification. The book briefly outlines the
Speaker 2: steps for senders using TLP, like being clear about recipients
Speaker 2: for each level.
Speaker 1: Clarifies TLP isn't the same as the Chatham House.
Speaker 2: Rule, right, important distinction. Yeah, Chathamhouse Rule is about anonymity
Speaker 2: of speakers at meetings. TLP is about the dissemination rules
Speaker 2: for the information itself, different purposes.
Speaker 1: Okay, that clears that up. So wow, that's a lot
Speaker 1: of ground covered for the fundamentals it really is. We've
Speaker 1: talked about what threat intelligence is, the different types tactical, operational, strategic.
Speaker 1: We've looked at the structured life cycle for producing.
Speaker 2: It, right, the six stages.
Speaker 1: Then the practical side gathering info, considering context like geopolitics,
Speaker 1: using IOCs as.
Speaker 2: Clues, and critically analyzing things with frameworks like ACH to avoid.
Speaker 1: Bias exactly, plus the different gathering disciplines ocent, human, et cetera.
Speaker 1: And finally how to share information responsibly using TLP.
Speaker 2: That's a really solid foundation from this first part of
Speaker 2: visual threat Intelligence.
Speaker 1: It definitely feels like it, and the book hints there's
Speaker 1: more detail to come on things like specific threat actors,
Speaker 1: diving deeper into IOCs and the tools used.
Speaker 2: This initial exploration using visual threat intelligence has really set
Speaker 2: the stage well, covering those core concepts and the structured
Speaker 2: thinking behind CTI. You know, thinking about IOCs. Again, it's
Speaker 2: not just finding one.
Speaker 1: Clue, right, you said, it's like puzzle pieces exactly.
Speaker 2: The real value is connecting them. Imagine security team sees
Speaker 2: a weird file in IOC. Using ACH, they might brainstorm, okay,
Speaker 2: hypothesis one, it's known malware X hypothesis Two, it's a
Speaker 2: legit file acting weirdly hypothesis three it's something totally new.
Speaker 1: Okay.
Speaker 2: Then they gather more evidence network logs, process activity and
Speaker 2: test it against each hypothesis. Using that matrix idea which
Speaker 2: ones did the evidence contradict, which seem more likely? It
Speaker 2: helps them focus their investigation effectively.
Speaker 1: That practical application really helps solidify it. So for you listening,
Speaker 1: we hope this deep dive has given you a clearer
Speaker 1: picture of how threat intelligence works and frankly, why it's
Speaker 1: so essential in today's cybersecurity world.
Speaker 2: Yeah. Absolutely, and maybe it sparks a broader thought too.
Speaker 2: These principles we've discussed, gathering diverse information, carefully weighing competing explanations,
Speaker 2: being aware of bias. How amight applying that kind of
Speaker 2: thinking be useful elsewhere in how you consume news, make
Speaker 2: decisions just navigating the sheer amount of information we all
Speaker 2: face every day.
Speaker 1: That's definitely interesting food for thought, thinking like an intelligence
Speaker 1: analyst in everyday life sort of.
Speaker 2: Yeah.
Speaker 1: Well, if this has piqued your interest, definitely consider exploring more.
Speaker 1: Maybe check out those resources the book mentions like Security
Speaker 1: break dot io or the unprotect project.
Speaker 2: Or feel free to share other species with us for
Speaker 2: future deep dives if there are specific areas you want
Speaker 2: to explore further.
Speaker 1: Absolutely, and thank you again for sharing this source visual
Speaker 1: threat intelligence with us. It's been a fantastic starting point.
Speaker 2: It really has a great way to understand these crucial
Speaker 2: foundations