>> Hello. This is Alyssa Berriche.
Welcome again to the Advanced Cyber Threat Intelligence
course This is the second part of the introduction,
fully dedicated to the Intelligence Lifecycle.
In this video, we will learn the
>> philosophy behind using
>> the intelligence cycle in order to build and
organize the advanced cyber threat intelligence course.
We will learn what is intelligence cycle,
then the different steps of the intelligence cycle,
and why are we even introducing
>> this cycle in cyber threat intelligence context.
>> Let me ask a quick question.
Do you think the intelligence cycle was
created for cyber threat intelligence context?
The answer is false.
The traditional intelligence cycle was built
for government and military context,
like multiple Cyber Threat Intelligence Concepts.
Before introducing the intelligence cycle,
I want to emphasize that
data is different from intelligence.
Through the whole course,
we mean by intelligence,
the result of analysis and data,
the result of collection.
Now, let's move to
our main focus of this video,
>> the Intelligence Lifecycle.
>> According to the Federation of American Scientists,
the intelligence cycle is the process
of developing raw information into
finished intelligence for policymakers
to use in decision-making and action.
Basically, the intelligence cycle
is an effective way of processing
information and turning it into
a relevant and actionable intelligence.
The intelligence cycle is also
called the intelligence process
by the US Department of Defense
and the uniformed services.
The intelligence cycle is made of five steps,
starting from the planning and direction,
then the collection of data,
then processing, then analysis and protection,
and finally, the dissemination.
Let's start with the first phase of
the Intelligence Cycle; planning and direction.
This phase involves setting
goals for the threat intelligence program.
It is the beginning and the end of the cycle.
Beginning because it consists of
defining the requirements for the collection phase,
the end, because finished intelligence will support
decision-makers in order to make new requirements.
This step, planning and direction,
also includes setting priorities.
The second phase is collection.
In response to the requirements,
the collection is the gathering of
data needed to produce a finished intelligence.
They will use it to provide
enough context so actions can be taken.
Gathering data can occur from a variety of sources,
like for example, logs from
the internal IT infrastructure.
It can be firewall logs, IPS logs,
end point clogs,
etc., thread that data feeds from the industry.
You can automate receiving feeds from different
paid or public free sources
and publicly available information that can be report,
forums based, social media, etc.
Keep in mind that the data collected will be
a combination of finished intelligence
like reports and raw data
like logs or malware signatures.
The third phase is processing.
Processing is the transformation of collected data
into a format that will be usable by the organization.
In some cases, collecting data
from different sources requires
different ways of processing to
get a normalized set of information.
Technically, processing will require extracting
IOCs or indicators of compromise from threat reports,
emails, or threat feeds.
If you don't know the term
IOCs or indicators of compromise,
I highly recommend you to go back to
the course intro to the cyber threat intelligence.
The fourth step is analysis and production.
This phase involves the evaluation and
enrichment of the processed information in order to
understand that the analysis phase
is all about thinking about
the information collected and
applying different lenses in order to derive meaning.
This phase concludes by drawing
conclusion from the available information,
and provide an assessment in
the form of advice or recommendations.
The final phase is dissemination.
Dissemination involves getting
>> the finished intelligence
>> and assessment distributed to the appropriate audience.
This includes the frequency of providing this output.
Now that we know the intelligence cycle
and its the steps,
why are we particularly interested in
introducing this cycle in CTI context?
To answer this question,
there is this diagram created by Recorded Future,
that I really like.
It explains how intelligence cycle can be.
Not only applied to the traditional intelligence,
but also in a cyber threat intelligence environment.
For this reason, we wanted to
build and organize our course,
basically inspired by this cycle,
in order to make each of the module be
a logical continuation of the previous ones.
Now, I will summarize what
we've seen so far in this video.
We started by defining what is the intelligence cycle.
Then we've learned the different steps
of the intelligence cycle.
Finally, we explained how this process can also
be applied in cyber threat intelligence environment,
and how we were inspired by
the intelligence cycle in order to make our course.
I hope you liked this video
and the full introduction to this course.
In the next video, we will start the first module,
data collection. See you later.