CTI 的运营化：从 PIR 到优先 TTP.pdf

1、Operationalizing CTI:From PIRs to Priority TTPsKeith SwaglerOndra Rojk Cascading strategyKeith SwaglerCTI Analyst/Detection Engineer atPreviously:Incident Response at Red HatSOCVulnerability ManagementCompliance Fed.ContractorWindows AdminHelp DeskOndra RojkPrincipal CTI Analyst at Previously :head

2、and co-founder of the strategic CTI function :threat intelligence analystWhat well discuss todayWhat well discuss today Focus on Progress over Perfection!A pretty good report delivered tomorrow is better than a perfect one delivered in 2 years.Minor mistakes are built into the process Using an aggre

3、gate approach tolerates minor mistakes and missing information.US-based New Space telecommunications and geospatial intelligence firm dedicated to redefining orbital connectivity.Founded in 2022Revenue of 1 billion USD Now has 42 satellites in orbit,with plans for 300The rapid growth and involvement

4、 in critical infrastructure have made them a high-interest target for state-sponsored actorsProducts&services:LumeaLink:Providing high-speed orbital internet to maritime,aviation,and rural enterprises.SentinelView:Delivering critical remote critical infrastructure monitoring for energy grids and pip

5、elines via IoT sensors.Intelligence Requirements The threat landscape is a confusing place It is hard to figure out what to focus on So many threats out there,so few people on the teamWhat are the Priority Intelligence Requirements(PIRs)?You are hereWhat are the Priority Intelligence Requirements(PI

6、Rs)?If we collect and analyse everything,we collect and analyse nothingThe PIRs help to identify the most relevant threats for your organisationProvides the focus and direction to your CTI team Intelligence Requirements&Direction Collection Management Monitoring&Alerting Research,Investigation&Analy