![Page 1: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/1.jpg)
1© 2016 ThreatConnect, Inc. All Rights Reserved
March 2016
Threat Intelligence Processes are a Journey; Not a Destination
![Page 2: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/2.jpg)
2
Priorities?
![Page 3: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/3.jpg)
3
David Bianco’s “Pyramid of Pain”Tough
Challenging
Annoying
Simple
Easy
Trivial
![Page 4: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/4.jpg)
4
The Pyramid of Pain (Mirrored)Tough
Challenging
Annoying
Simple
Easy
Trivial
![Page 5: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/5.jpg)
5
The Pyramid of Pain (Mirrored)Tough
Challenging
Annoying
Simple
Easy
Trivial
• TTP’s = Tactics, Techniques & Procedures
• For the “back office” types TTP’s can be translated as “business processes”
• I’m NOT talking about sharing the Adversary TTP’s (while that is always nice)
• I’m talking about Sharing My TTP’s as a Defender how do I do things like:• Create• Enrich• Analyze• Interpret• Decide• Act
![Page 6: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/6.jpg)
6
The Business of Threat Intelligence• Mature businesses have
processes
• Businesses processes should be measurable
• Business processes should demonstrate value (save organizational resources - time & money)
![Page 7: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/7.jpg)
7
The Paleolithic Age of Threat Intel: Tools of the Trade
![Page 8: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/8.jpg)
8
![Page 9: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/9.jpg)
9
![Page 10: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/10.jpg)
10
Demo Videos
![Page 11: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/11.jpg)
11
Conclusion• Threat Intelligence Sharing can
go beyond sharing atomic Indicators
• “Teach a man to fish” applies here
• Where do you place the most value, the process or the product?
• Attach your Threat Intelligence Processes to powerful engines that help security investments scale.
![Page 12: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/12.jpg)
12
Check out the blog post:
www.threatconnect.com/threat-intelligence-processes-are-a-journey-not-a-destination/
Sign up for your free account:www.threatconnect.com/free
![Page 13: Threat Intelligence is a Journey; Not a Destination](https://reader035.vdocument.in/reader035/viewer/2022062503/587db28f1a28abae2f8b64b3/html5/thumbnails/13.jpg)
13
Questions?