<p><em>This is the second blog in a series titled, "What is Threat Intellignece?". Continue with the series at the bottom of this page. </em><br/> <br/> Maintaining a strong security posture requires developing and answering many questions specific to the organization. Many of these questions must be answered continually as situations and environments evolve. Will bringing in additional security solutions really provide that much more additional protection? Is it worth the cost to update each and every legacy system? Who are my adversaries and how might they attack me? Many organizations choose to tackle these questions and make more informed decisions with context from threat intelligence. This curated information is generally divided into three subsets:</p><ul><li>Strategic intelligence - who/why</li><li>Operational intelligence - how/where</li><li>Tactical intelligence - what</li></ul><p>Strategic intelligence (who/why) is the 100,000 foot view, providing a big picture look at how threat and attacks are changing over time. Strategic intel may be able to identify historical trends, motivations, or attributions as to who is behind an attack. Who is attacking you and why? Who might attack organizations in your sector? Why are you within scope for an attack? What are the major trends happening? What kind of things do you need to do to reduce your risk profile? Knowing the who and why of your adversaries also provides clues to their future operations and tactics. This makes strategic intelligence a solid starting point for deciding which defensive measures will be most effective.</p><p>Strategic intelligence might include information on the following topic areas:</p><ul><li>Attribution for intrusions and data breaches</li><li>Actor group trends</li><li>Targeting trends for industry sectors and geographies</li><li>Mapping cyber attacks to geopolitical conflicts and events (South China Sea, Arab Spring, Russia-Ukraine)</li><li>Global statistics on breaches, malware and information theft</li><li>Major attacker TTP changes over time</li></ul><p>If you are in the education sector, you may wonder what nation states and what groups you should be concerned about. Where do you need to focus your resources to reduce risk of an intrusion and theft of intellectual property? Or perhaps if you know you’re in an industry or region that is frequently targeted by the actor APT29.</p><h3>Strategic Intelligence for the Education Sector</h3><ul><li>Educational IT infrastructure has a diverse user base and is thus typically comprised of a myriad of operating systems, computer types, software, and tons of servers and websites that are publicly accessible from the internet. This makes universities and academic research facilities prime targets for attackers as both places from which to steal valuable data and also as hop points for further intrusion operations.</li><li>The education industry will continue to see cyber espionage activity in the foreseeable future. We expect threat actors from China, Russia, Iran and other countries to conduct espionage operations for data theft, trade information, economic intelligence and for monitoring of diaspora.</li><li>Several groups have been observed conducting intrusion operations that have affected academic institutions including universities and research centers:<ul><li>APT10 aka “MenuPass Group”</li><li>APT22 aka “Barista Team”</li><li>APT29 aka “The Dukes”</li></ul></li></ul><h3>Strategic Intelligence for APT29</h3><ul><li>APT29 is a Russia-based actor that typically engages in cyber espionage with the purpose of data theft.</li><li>APT29 victims include many global organizations in government, education, high-technology, finance, non-profit, pharma, and the Defense Industrial Base.</li><li>APT29 is an adaptable, sophisticated group with the ability to develop custom attack tools, convoluted command-and-control infrastructure, and unlike historical behaviors of Russian state-sponsored actors, this group has the audacity to continue to operate long after they have been detected.</li><li>APT29 has been historically tasked to pursue operations surrounding foreign government policy issues, especially those involving the Russia-Ukraine conflict. Furthermore, the group has targeted several Western national government agencies, defense and government contractors, and academic institutions.</li></ul><h3>Using Strategic Threat Intelligence</h3><p>Strategic threat intelligence is built upon a huge body of knowledge and includes expert opinions and insights that are based on aggregating both operational and tactical intelligence from known cyber attacks.</p><p>There are many uses for strategic intel including, but not limited to, the following:</p><ul><li>Inform your executive leadership about high risk threat actors, relevant risk scenarios, and threat exposure in the public-facing technology sphere and criminal underground.</li><li>Perform a thorough risk analysis and review of entire technology supply chain.</li><li>Learn which commercial ventures, vendors, partner companies, and technology products are most likely to increase or decrease risk to your enterprise environment.</li></ul><p>Check out the other blogs in our series for a deeper look into the types of threat intelligence and how they are used. <br/> <br/> <a href="https://www.anomali.com/blog/what-is-threat-intelligence">What is Threat Intelligence? </a><br/> <a href="https://www.anomali.com/blog/what-is-operational-threat-intelligence">What is Operational Threat Intelligence?</a><br/> <a href="https://www.anomali.com/blog/what-is-tactical-threat-intelligence">What is Tactical Threat Intelligence? </a></p>