>> We arrive at to the end of
the Advanced Cyber Threat Intelligence course.
This is the last video
and the last module of this course.
In this video, we are going to talk about
the most important parts of each module.
In the introduction to this course,
we introduced the intelligence lifecycle,
and we explained how the course is built
based on each phase of the cycle.
Our first module was
dedicated to the data collection sources,
and here we discussed
the two big categories of data collection sources,
which are the internal
>> sources and the external sources.
>> For the internal sources,
we defined three categories,
which are endpoint resources, network sources,
and finished reports or
reports from previous investigations.
When it comes to external data sources,
we discussed three types which are:
>> private data sources,
>> including feeds,
threat intelligence platforms, and finished reports.
Community sources which are ISACs and ISAOs,
and the public sources,
which includes threat feeds,
threat intelligence platforms, finished reports,
and the next module was
dedicated to processing and data management.
As you've already seen,
almost all raw data
collected needs to be processed in some manners,
whether by humans or machines.
We have also seen that using standard
is an important part of data processing,
because data standard defines how
particular information elements are
represented in files or in communications.
Standards were created to
represent actionable information,
including their contexts to
facilitate their storage and sharing.
In particular, we've seen some of
the common threat intelligence standards
such as TAXII standards, STIX standards.
We have also seen example of
scoring standard, which is CVSS.
After this, I dedicated three modules for
the analysis phase because I believe that
analysts should spend most of their times on this phase
because a good analysis will
help forge proper conclusions.
This is why we started with
the module intrusion analysis
>> and we discovered together
>> some of the techniques that are commonly used such
as ACH or analysis of competing hypothesis,
cyber kill chain, diamond model,
cyber kill chain and diamond model mapped together,
and cyber kill chain and courses of actions.
Then we moved to more complex cases,
including analysis of campaigns using
their proper tools and
methodologies like the heatmap analysis,
visual analysis, and MITRE ATT&CK framework.
For those who just started
their cyber threat intelligence teams
and still lack in real cases,
they can rely on MITRE Threat Group Tracker.
It was also worth noting that while analysis,
cyber threat intelligence teams,
and any security analysts,
especially those with experience,
might find themselves in situation where they
tend to use shortcuts to quickly get conclusion.
Unfortunately,
this behavior may lead to errors in conclusion.
This is why it was unavoidable to
explain cognitive biases and logical fallacies.
We've also seen how to identify them,
and most importantly, how to manage or mitigate them.
Our final module was
dedicated to the last phase of intelligence lifecycle,
which was dissemination and feedback.
We talked about the three forms or
pillars of threat intelligence which are tactical,
operational, and strategic intelligence.
Of course, we talked about
sharing because single entities
are no longer able to handle
the vast amount of possible attacks scenarios.
Then co-operative approaches, in particular,
those based on exchange of
cyber threat intelligence information can contribute
significantly to improve defensive capabilities.
Another part that we discussed was feedback,
as its main goal is to adjust the requirements made by
the decision-makers in the first phase
of the intelligence lifecycle.
Like this, we finished
our course of advanced cyber threat intelligence.
Lastly, here are some references
that helped me to build this course from scratch.
I highly recommend reading these articles, publications,
and books for
better and deeper understanding of the concepts
that I mentioned and
explained during the previous modules.
The list in this slide and
the following one doesn't include all the resources.
This is why I added a doc file as
supplemental reading material that you can
download directly from the description below the video.
Well, we arrived to our finish line.
I hope this course would be helpful for you as
individual and helpful to
enhance the security posture of your organization.
It was a pleasure for me to be
your instructor for this course.
You can contact me on my Twitter
and LinkedIn accounts shared on the slide.
Please feel free to share
your feedbacks or if you have any suggestion,
or even if you just want to pass and say hi.
See you in future courses. Bye bye.