>> Hello and welcome to the second video
from the module campaign analysis.
This lesson is about
one technique used for campaign analysis,
which is heatmap analysis.
Like we discussed in the introduction to this module,
we will be introducing the concept of
heatmap analysis in the cyber threat intelligence.
I will be explaining how it is used and
how it can be of added value to the organization.
You know that over the past few years,
we've seen quite a few high-profile cyber attacks
occur from small businesses to large organizations.
It's a clear fact too many companies are still
disorganized and unprepared when
it comes to cybersecurity.
It's no longer possible for companies to guarantee
>> that they are completely safe against a breach,
>> not even with the most comprehensive security measures.
It's more important than ever before to
stay ahead of vulnerabilities and threats.
Otherwise, you are setting yourself up to
become another statistics in the world of cybercrime.
For this reason, it's important to learn techniques and
methods that will help you understand your threat,
surface, and adversaries,
and will help you decide which course of
action is more appropriate for your case.
One of these techniques is heatmap analysis.
Let's start with defining what is
heatmap analysis in general
and in cyber threat intelligence.
Heatmaps are basically available everywhere these days,
anywhere there is data to display.
They are increasingly popular in
scientific disciplines where large volume
of data have to be made comprehensible.
That's because they are a great way to see through data
to trends and understand what to do next.
For this reason in particular,
we are using them in cyber threat intelligence.
Heatmap is a graphical representation of data that can
make a complex datasets comprehensible and actionable.
Now heatmaps are the most used tools
for representing complex statistical data.
That's the secret to their success.
Charts have to be interpreted,
tables have to be understood,
but heatmaps are self-explanatory and intuitive.
A heatmap uses a warm to cool
color spectrum to show you your intrusion analytics.
More specifically, the colors indicate
the activity level regarding each intrusion attack.
Here, red means a high level and green means low level.
In this case,
>> you can associate the vertical columns with
>> different campaigns that the organization
is currently working on.
The rows will represent
intrusion attempts for every month.
You will have a column for
>> the non attributed intrusions.
>> The more you have red areas
in these column in particular,
the more intelligence gaps of
unknown risks to your organizations you have.
The heatmap analysis can
tell a lot about your adversaries.
For example, a month that has
the fewest campaigns or intrusion attempts will
be probably a holiday season for
the country from where your adversaries are originated.
Heatmaps are really easy to produce and
will help you identify and highlight trends.
If you are looking for a way to create your heatmaps,
you can use Excel spreadsheets and follow all the steps
described on this slides
or the steps that I will follow right now.
For this example, I created
an Excel spreadsheet containing samples of campaigns.
Keep in mind, these are not related to any real case.
They are just generated for this example.
Here, the rows represents the activities for
each month and the columns
represents the campaigns that targeted the company.
I specifically added the pending attribution column
because it's really important.
First, all these values
should be numbers to be able to get the heatmap.
Now to create our heatmap,
we first select the numbers then we choose
conditional formatting from the home menu,
and we choose from red to green,
where red have the highest activity level.
Then we select separately the grand total column
to see which month has the highest threat activity.
As you can see for our sample,
February has the highest grand total,
which means the highest activity level,
the same as November.
When it comes to attribution,
we have the highest levels impending attribution.
Here in this example,
it means that we have a lot of knowledge gap.
But I hope that in your analysis you
will get more reds here,
which means you have
more knowledge about your adversaries.
As you can see, the lowest activity
can be seen in June and August.
This can be explained by
the summer holidays in
a lot of countries around the world.
This is all for this lesson that we started with
a definition of heatmap and we've seen how it works.
We closed the video with an example of
heatmap building using an Excel spreadsheet.
This analysis technique is helpful to identify
your knowledge gaps and understand
the behavior and nature of your adversaries.
Overall, organizations can use this method to
prioritize and strategically decide
their courses of actions.
I hope that you enjoyed this lesson.
In the next video, we'll discover
another technique used for campaign analysis,
which is visual analysis.