Introduction to Threat Intelligence

Threat intelligence is the information used to provide context and aid decision making to ultimately stop cyber attackers taking advantage of the organization.

So a threat intelligence program is all about processes, and procedures, and the people who are associated with it.

So it's taking data and make it actionable for our company.

So for example, we'll use a phishing email.

Somebody sends out this information that a bad guy is using a phishing email.

A solid threat intelligence program will take that information in, determine if that is a threat to that company, then they'll take that information and push it out to the endpoints, or whatever the product.

They'll take that and make it actionable.

Threats are originating, now, in cyberspace.

So having threat intelligence to understand the risks, to understand what's happening in the world, how things are evolving as well as just understanding technology, which is a big key aspect of threat intelligence, ensures that companies, organizations, people, countries can be resilient and address those threats when they need.

Cyber threat intelligence and consumption and production is hugely important in building secure posture for enterprise and government.

There is a large spectrum of maturity in the industry.

But certainly there's been a lot of growth recently in terms of how it's been used and best practice around it.

So hopefully we will continually to vocalize the good ways of adopting CTI, and ultimately, and bring more success and make the good guys win.

Ultimately, the goal is to reduce the amount of risk per the company.

So therefore, you need to identify what threats are relevant for you.

So a risk is a threat that realizes a vulnerability.

And vulnerabilities can come in a variety of different pieces.

It can be the personnel, it can be technical vulnerabilities.

So once you identify the vulnerabilities and the threat, you can ultimately reduce your company's risk.

Threat intelligence is going to consistently evolve, whether it's in cybersecurity, whether it's in general security, tactical security, on like, a military level, there's always a need for threat intelligence, because you need to know what is your risks and threats to your organization, to your country, to your users, whatever it is, threat intelligence is ubiquitous.

And it's not going away.

And if anything, there's going to be a growing necessity for it.

Back in the old days, you'd send a scout out beyond your walls of your castle, and you'd go and you'd put your hands on the ground, and you'd feel the rumblings of the ground.

They're gathering data.

So that's really not any different than the solution that we have today.

You want to send that scout out and you want to have your hand outside of your enclave, feeling that data to identify what potential threats are coming in.

In the old days it was the knights.

You could feel the horses coming.

Nowadays, those knights are on the wire.

So it's drastically different, but the concepts are the same.

And so the companies with a more mature security model, they have their hands out there.

They have their hands listening to the ground and trying to identify what the threats that that are coming to them.