>> Hello and welcome to
the second video from
the module, dissemination and feedback.
In this lesson, we'll discover
the first pillar of the intelligence forums,
which is tactical intelligence.
In this video, we will focus on tactical intelligence.
We will start with
a quick understanding
>> of what is technical intelligence,
>> then we will see tactical decisions,
we will see the benefits of
tactical intelligence and their shortcomings,
and we will finish with discovering what
is the appropriate audience for tactical intelligence.
The tactical intelligence is
also called technical intelligence,
and it is basically
technical and comparatively short term.
It might be as simple as looking for IOCs,
but it's not to underestimate its importance.
Its main focus is to deliver
meaningful information to those
in need of it immediately.
In other words,
tactical threat intelligence is information from
known attacks as a result
of direct action by cybercriminals,
which have potential to
immediately influence cybersecurity decision-making.
It supports daily operations and events,
and it is limited in analysis.
Basically, real-time solutions or
threat feed providers are
common providers of these sort of intelligence.
They are providing IOCs like file hashes,
malicious domains, email subjects,
links and attachments, registry keys, filenames,
DLS, etc, that can
be easily integrated with security product.
Tactical intelligence can lead to
conclusions about what adversaries want,
which can help you make rapid decisions
>> on what to block,
>> what to allow, and at times what to shut down.
Unfortunately,
lack of tactical intelligence often
leads to businesses making the wrong decisions,
resulting in adversaries either
getting all the information
they want or forcing key services to be taken offline.
Better tactical intelligence can
ensure that decisions are optimized.
Increasingly, organizations are putting
policies in place to enable automated responses.
This is a great use of tactical intelligence,
but this approach is only effective when
both good strategic and operational intelligence
are also optimized.
All the three levels must come together to enable
organizations to operate at network speeds.
When it comes to the benefits of
tactical cyber threat intelligence,
this type of intelligence provides
context and relevance to a tremendous amount of data.
Many large organizations have access to
terabytes of data without the ability to understand it,
fill it, and make it useful.
At the tactical day-to-day level,
filtering out the noise is crucial.
Tactical cyber intelligence introduces
methodical processes that help
manage incoming desperate datasets,
turning them into insightful
>> and actionable intelligence
>> that meets the organization's threat information needs.
Also, tactical cyber intelligence empowers
organizations to develop
a proactive cybersecurity posture.
Cyber intelligence at the tactical level
>> must be specific
>> enough to support
an organization's ability to minimize risk.
By identifying network and
organizational vulnerabilities,
as well as patterns of adversarial behavior,
tactical cyber intelligence can
provide insights into an attack model,
revealing the areas of highest risks.
It also can identify technical, business,
or mission weaknesses and help
define and mitigate and
organization's and enterprise risk.
Tactical cyber intelligence also informs
better decision-making during and
following the detection of cyber intrusion.
Indicators of compromise, or IOCs,
include various signature and malware files,
IP addresses,
and all our technical clues of
abnormal network activity that
can help reveal an adversary's TTP,
as well as what data have been accepted.
IOCs could help reveal
an adversary's identity, intentions, and motivations.
Tactical cyber intelligence can drive as well momentum
towards cybersecurity posture that
is productive, not just reactive.
A more mature, inclusive,
and agile cybersecurity framework will
allow the organization to collect and
analyze more datasets while
complementing the tactical cyber intelligence process.
Despite the multiple benefits
of a tactical cyber intelligence,
there are several shortcomings
when it comes to tactical threat intelligence.
First, it is relatively short term
in nature due to the fact that some IOCs,
such as malicious domains,
can become obsolete very quickly.
Furthermore, the ever evolving
>> threat landscape dictates
>> that sources must be timely and of high-quality.
If not, this category of
intelligence tends to generate
>> a lot of false positives.
>> When it comes to audience,
tactical threat intelligence is intended for
a technical audience and
usually includes some technical contexts.
In particular,
tactical threat intelligence is consumed by
personnel directly involved in
the defense of an organization,
such as system architects,
administrators, and security staff.
Although, it does also play a role
in higher level security decision-making.
In short, tactical cyber threat intelligence is
an important component of
your overall intelligence capability.
Certainly, it can provide you with
the specifics around the technical aspects of
an attack and help you
identify areas within your environment to shore up.
In this lesson, we focused on the tactical decisions,
we've seen the benefits of tactical intelligence,
while the available shortcomings,
and rediscovered what audience is the most
appropriate for this type of cyber intelligence.
This was all for this lesson
>> about tactical intelligence.
>> The next video will be about another form,
which is operational intelligence.