Cyber Threat Intelligence (CTI) in a nutshell

Cyber Threat Intelligence (CTI) involves gathering and analysing information about cyber threats and malicious actors. It draws from a variety of sources to help detect, prevent, and respond to harmful events and potential attacks in the digital space

The Three Ps of Threat Intelligence

To be effective, threat intelligence must be:

1. Proactive
   Actively seeking out potential threats before they manifest, allowing security teams to stay ahead of attackers.

2. Predictive
   By analysing historical data and trends, predictive intelligence enables teams to anticipate future attacks based on known patterns.

3. Preemptive
   Beyond predicting threats, preemptive intelligence involves taking action to neutralize threats before they become incidents, often through techniques such as patching vulnerabilities or blocking malicious IP addresses.

Sources of Threat Intelligence

CTI comes from various sources, categorized into three broad types:

Internal Sources

• Vulnerability assessments
• Penetration testing reports
• Incident response findings
• Logs (SIEM data)
• Training reports on employee awareness

External Sources

• Closed-source threat feeds (from vendors like Mandiant, Recorded Future)
• Open-source intelligence (OSINT), such as public threat feeds
• Public resources like CERTs or government advisories (e.g., NCSC)

Community Sources

• Security forums
• Dark web intelligence
• Information-sharing communities like ISACs

CTI Frameworks

Several frameworks guide the structuring of threat intelligence:

• MITRE ATT&CK: A widely used knowledge base that maps adversary TTPs across different attack stages.
• Cyber Kill Chain: A model developed by Lockheed Martin that outlines the stages of a cyberattack, from reconnaissance to exfiltration.
• The Diamond Model: Focuses on the relationships between adversaries, capabilities, 

The CTI Lifecycle

• The lifecycle of Cyber Threat Intelligence follows several key stages:

  1. Direction and Planning
     Set clear objectives: What assets are at risk? What data is needed? Which tools (e.g., EDR) should be employed to defend and monitor these assets?

  2. Data Collection
     Gather intelligence from internal, external, and community sources.

  3. Data Processing
     Use SIEM and other tools to compile, filter, and process collected data (logs, reports).

  4. Data Analysis
     Study the processed data for patterns, IOCs, and TTPs to create actionable intelligence.

  5. Dissemination and Sharing
     Present findings to stakeholders, ensuring they are clear and actionable.

  6. Feedback and Continuous Improvement
     Stakeholders review the intelligence and suggest further actions. The cycle repeats, continuously improving infrastructure, and victims.

The Meaning of Cyber Threat Intelligence (CTI) to a Blue or Red Team

In cybersecurity, we often hear about the Blue and Red teams. The Blue team focuses on defense, safeguarding the "crown jewels"—the business’s critical assets, data, and secrets—while the Red team simulates attackers, attempting to breach these defenses.

CTI for the Blue Team
For the Blue team, Cyber Threat Intelligence (CTI) is vital for understanding how attackers operate. It involves the collection and analysis of Tactics, Techniques, and Procedures (TTPs) used by attackers to build better defenses. By studying TTPs and Indicators of Compromise (IOCs), the Blue team can gain insights into how an attack was executed and then design detection strategies. This proactive study of an adversary’s playbook strengthens the organization’s security posture and enhances the resilience of systems.

CTI for the Red Team
Conversely, the Red team emulates the actions of adversaries. They use CTI to replicate attackers' methods, focusing on how well the Blue team can detect and respond. By leveraging CTI, the Red team can develop tools that mimic real-world hacking groups, helping to simulate these attacks in engagements. This adversarial emulation tests the efficacy of the Blue team’s defenses, leading to continuous improvement in detection capabilities and overall cybersecurity readiness.

The Role of CTI in Blue Teams

When it comes to Blue team CTI, the following questions guide their focus:

• Who is attacking us? (Threat actor attribution)
• What are their motivations? (Financial gain, espionage, etc.)
• What are their capabilities? (Technical sophistication, tools used)
• What Indicators of Compromise (IOCs) and artefacts should we monitor?

By answering these questions, Blue teams can craft better strategies for detection and response.

The Importance of the Pyramid of Pain

The Pyramid of Pain, created by David J. Bianco, visually depicts the increasing difficulty of detecting and countering cyber threats as you move from simple IOCs (like file hashes) to more complex attacker behaviors (like TTPs). Here’s a breakdown:

• Hash Values (Easy): Attackers can quickly change file hashes, making them easy to bypass.
• IP Addresses & Domain Names (Moderate): Changing these requires slightly more effort from the attacker, involving reconfiguration of infrastructure.
• TTPs (Hard): The most challenging for attackers to alter. TTPs describe how an attacker achieves their objectives, and identifying them provides defenders with the most robust protection against future attacks.

Blue teams strive to detect TTPs, as doing so forces attackers to significantly alter their approach, increasing their cost and reducing their chances of success.

---

Conclusion
Cyber Threat Intelligence (CTI) plays a critical role for both Blue and Red teams. For defenders, CTI allows the proactive identification and mitigation of threats. For attackers (or Red team members), CTI provides the knowledge needed to mimic real-world adversaries and enhance testing and detection efforts. The key to success in both roles is a continuous cycle of intelligence gathering, analysis, and adaptation—helping organizations stay one step ahead of adversaries.