>> Hello and welcome to
our last module, dissemination and feedback.
This is the first lesson and
it will be an introduction to the module.
In this module, we will discover
together the meaning of dissemination,
the different forms of intelligence products,
the meaning of sharing,
and the importance of
sharing in the cyber threat intelligence.
Finally, we will see what is
the feedback part of the dissemination phase.
Over the last years,
the numbers of IT security incidents
has been constantly increasing among companies.
As single entities are no longer able to
handle the vast amount of possible attack scenarios,
acting collaboratively against such attacks
is an emerging trend.
It is widely believed that
cooperative approaches, in particular,
those based on exchange of
threat intelligence information can contribute
significantly to improve defensive capabilities.
The finished product of this process
must get to the right hands to be effective.
So the intelligence cycle must look back upon itself.
These reports and assessments are delivered to
client or the leadership who
commissioned the cycle in the first place.
Briefly, dissemination involves getting
the finished intelligence output
to the places it needs to go.
In order to derive results and address the risks,
CTI teams must distribute
their finished intelligence reports
to the appropriate stakeholders.
Most of cybersecurity organizations have
at least six teams that
can benefit from threat intelligence.
These individuals typically range from SOC analysts to
senior leadership responsible for allocating
resources and certain strategic priorities.
Security professionals can learn from the way
the US Department of Defense approaches intelligence.
Years ago, the agency was
absolutely overwhelmed with information on
adversarial activity and had to
establish frameworks for dealing with data.
As a result, the military now
considers intelligence at three levels;
strategic, operational, and tactical.
Strategic intelligence
informs the most senior decision makers.
Operational intelligence is aimed
at those making day-to-day decisions,
and tactical intelligence is focused on
units in needs of instantaneous information.
For each of these audience,
you need to ask, what threat intelligence do they need?
How should the intelligence be presented to make it
easily understandable and actionable for that audience?
How often should we provide
updates and other information?
Through what media should
the intelligence be disseminated?
We will see each one of
these three forms in
more details within their corresponding videos.
The speed at which cybercriminals operate can be
worrying for those tasked
with defending networks from attacks.
Threat actors can weaponize
vulnerabilities within days of them being discovered,
and successful exploits or techniques will
rapidly spread among cybercriminal communities.
Companies need to be sharing
more security intelligence with industry peers to
better defend against these threats and
more rapidly adapt to ever-changing threats.
A key factor for realizing
cooperative approaches are
the underlying threat intelligence data formats.
They offer a semi-structured representation of
identified threats and ensure a common
>> understanding of security-related observations.
>> As the document incidents
using general markup languages,
a common characteristic of
these formats is a good machine readability.
Structural threat intelligence is of great value for
experts as it enables
them to understand threats and attacks.
However, this is only possible when
experts are able to read and analyze these information.
I believe that it is critically important to
understand your overall intelligence priorities
and the requirements,
all the security teams that will
be consuming threat intelligence.
The feedback loop is of for the utmost importance in
both classical intelligence
and cyber threat intelligence.
Its main goal is to adjust
the requirements made by the decision-makers,
but it is also used in tactical ways.
In cyber threat intelligence, for example,
feedback on usage of indicators
can be used to understand trends of attacks.
The effectiveness of one cycle
of threat intelligence will
determine the essential elements of
information that is needed for the next cycle,
including what spaces to focus on when collecting
data and how fast action needs to be taken.
Upon receiving
the cyber threat intelligence finished reports,
stakeholders should provide feedback
to help fine-tune future iterations,
all the intelligence distribution,
and inform future intelligence operations.
Dissemination is the timely conveyance of
completed intelligence products in
an appropriate format to the intended consumers.
The frequency of dissemination should match
the time period on which the content is based.
For example, operational material
needs to be delivered frequently,
whereas strategy content will be more intermittent.
In this lesson, we had an overview of dissemination.
We've seen the different forms of
intelligence which are tactical,
operational, and strategic intelligence.
We've also seen an important part of the dissemination,
which is sharing,
and another important part of
the dissemination phase, which is feedback.
This is all for the introduction to the module,
dissemination and feedback.
The next video, we'll cover
the tactical aspect of disseminating intelligence.