Should We Drop The ‘C’ From CTI? - Bethan

Anyway, thank you very much for coming. Um, today talk about should we drop the C from CTI. Um, so this case the C stands for cyber and CTI is for cyber threat intelligence. Um, the idea is should we just have one overall intelligence question that covers lots of different areas. Um, we'll talk about that. Um, before we go into it, just a couple details about me. Um so I work as a senior cyber threat intelligence analyst. Um I have now over five years experience working in cyber security. Uh my background and I finished university. I worked in call centers and moved into IT help desk and then support for a software company. Um and then I took a 10 year career break

to raise my children. Uh when they were both in full-time education I thought what am I going to do with my life? I need to find something to to do and go back to work. and I think I was into a radio program where they were talking about cyber security and I found that really interesting. Um so I found out more about it and thought this is something I want to do. So I spent the years retraining and looking for opportunities and then my first role was as a junior hunter. The person who hired me is actually the audience today. So thank you very much for the opportunity cuz it's got me where I am today and I

really enjoy working in cyber security and specifically threat intelligence. Um so moving on so first of all what we're going to talk about so first of all what is cyber threat intelligence and we're going to talk about different intelligence functions and different threats that we face and then the idea of one intelligence function and what could be the benefits and disadvantages of this. So the idea came from um seeing different inactivity between different forms of intelligence. So as said I work in cyber threat intelligence but geopolitics has a big impact on what we focus on and where we focus um and also other considerations of this such physical security. So they all interconnected. So what is cyber threat intelligence?

So this find is the collection processing and data of data on threats and adversaries that's I got my words all mixed um analysis of adversaries to help organization defend against attacks. So we need to understand who wants to attack us and why. um understanding the motives can help us and we look at the tactics, techniques and procedures um so known as TTP and we use frameworks such as matt attack framework to communicate this. So when we're talking to other security teams when we're talking to the business it's good to have this shared framework that we can communicate and understand exactly where to look what to share with them. um we share it all across the business, all different kinds

of teams. Um and it helps them prepare amidst against against these threats as best we can. So cyber threats um attempts to damage, disrupt or gain unauthorized access to computer systems. Um threat intelligence when we're looking at this, we're looking at the capability, intent and opportunity of groups um so that we understand what the threat is to the business. So capability would mean maybe um do they have access to malware and tools um intent have they targeted your business before or sector that you're in or do you have data that somebody's interested in and opportunity um vulnerabilities maybe there's a vulnerability in your system that someone could exploit that would give them opportunity um if we looked at this

maybe in terms of a nation state actor they may be well funded um have access to um or their own tools and malware. So they have a high capability. Their intent maybe they have targeted other businesses in your sector maybe for cyber espionage purposes. So they have the high intent an opportunity maybe a vulnerability in a public facing device and they exploit this. Maybe it's one you don't know about one you do you just haven't patched yet. But that's their opportunity. um a group like that we would assess a high threat to our to our business. So that's generally how we how we look at it. So but there are more than just cyber threats.

So physical threats um these can include protests and terrorism and natural threats and disasters and weather events and these are all going to pose a threat to your personnel facilities and your assets. Um there are geopolitical threats. So there's a lot going on in the world at the moment. Uh regional conflicts, there's trade sanctions and political tensions. All of this is impacting global stability. Um and it can indirectly impact your operations and your supply chain, especially if you're a company that has global office. If you're around the world, then definitely need to pay attention to the geopolitical threats. There's also natural crime and fraud. Um this could hit your reputation, cause lots of damage, um hit your profits and

regulatory compliance issues. All of this can be impacted fraud and financial crime. There are lots of threats, lots of other forms of intelligence. Um just going to focus on these at the moment because these assessors having sort of specialized skills and tools that we need to have within the business to be able to look at these. So while they all work independently, they're generally all related. Um there are overlaps between physical geopolitical fraud. Um so physical threats since the middle of change healthcare CEO Brian Thompson there's been increased focus in exe executive protection and physical security looking at their sort of physical locations where they travel to and where they work as well as their online footprint so

social media and then involves dark web monitoring as well. So you're combining the physical with the cyber. So political there are regional conflicts instead quite a few going at the moment. Russia, Ukraine, India, Pakistan, Gaza. All of these can cause um risk to your organization especially if you got ties in these countries, you have offices in the countries or your supply chain is located there. Um this can cause um activist groups to maybe target your company or other cyber attacks. Um there's also physical threats to staff working or traveling in those areas. Again overlapping between physical and cyber. So we also have fraud especially cyber enabled fraud. Um it caused huge losses for businesses and

also customers and the using takes such as business email compromise and employee personation. All of this relies on human trust and it's made even worse by the fact that we share so much information about ourselves on social media. They can then use that against us when they're targeting us and impersonating us. So onto the video then should merge all these together. Um at the moment um and not all companies will have this. You may be lucky enough to have independent functions. I'm hoping you do have a cyber threat intelligence team. I think that is crucial to your business. The impact could be devastating and you really need to know about the threats before they they target your company. Um

physical security again I really hope there is physical security and geopol have have geopoly but again if you're a global company that is really important. But all these teams um generally while they work independently of each other traditionally siloed without talking or sharing um we all do the same sort of things. Um analysts we all collect data we analyze patterns we forecast risk and make recommendations to the business. Um many of the analysts use structured techniques as well uh such as code of plausibility. Um with this you need to identify uh key drivers and um sorry yes so key drivers and to do this you use um tradition of hessle analysis. There are other analyst techniques but

this one specifically focuses on political economic social technological legal and environmental issues. Um and you identify key factors for each of those. Um can be expanded to military and other areas uh depending on what your focus is on. But again, we're using the similar techniques and we're looking at very similar things. So why won't we work together? What you could do is to bring them all to one intelligence function. So rather than being cyber threat intelligence or physical intelligence or geopoly intelligence or business intelligence, something that could have a greater weight of power when working together. So to give a scenario of a scenario where this could possibly work. So earlier in the year um there was

killings in India controlled Kashmir uh which escalated conflict between India and Pakistan. Um there's been tensions between companies countries for years. Um this escalation caused issues there. there is missile strikes, drone attacks um against each other's military organizations and with that then causes uh concerns for businesses who have operations in that country. Um now lots of companies use organizations or have offices in India. So you have your physical security teams and need to think about are the offices safe? Are your staff safe to go to the office? Uh do we need to think about warning people about traveling to the country? So they're really looking at what's going on on the ground, sending out communications to

the business to advise what's best for staff and officers to keep everyone safe. So what they would need is know what's going to happen. Is there likely to be an escalation or is it likely to fade away? So your geopolitical analysts would they generally have history of they know the history of what goes on between these two countries. They'd be monitoring new sites. They'd have their own tools and be able to do the analysis to say to business there's going to be we're predicting going to be an escalation. We think we should take these steps to protect everybody. So alongside that there would be social moni uh social media monitoring and dark monitoring. So social media say your CEO

post on X support for one side of conflict or maybe you have a supplier who works um in one of countries. So linking you to the conflict and maybe they have military ties or ties to the government. You need to know about all these things because it could make you a target. So your cyber teams they would then they' be looking things like dark web see if anyone's talking about your company. They'd be looking what groups could potentially be involved in the conflict from a cyber angle. So are there any nation state groups that will be involved? Are there any activist groups that might be carrying out attacks or are there any new groups that

have been spun up uh because of the conflict? That happens quite a lot especially activist groups um who become active when there's a conflict going on. Uh also then there is sometimes out between nation state and activists trying to maybe use advantage of the situation to hide activity. So your intelligence team will be reviewing all this, looking at who's most likely to be involved, who's a threat to our organization, sharing that information with the business. So these teams are all could all work together, share this information and do it quickly and get that notice and information to the business so that decisions can be made quickly. So benefits. So we talked about a couple of the

benefits in that scenario. they were able to gain a fuller picture and share that with the business. So it wasn't a fragmented view. Um the um cos they weren't getting cyber picture and then separately they weren't getting information from physical teams and gore teams. They were getting the whole story. So they knew exactly what action to take. Um due to that they were able to improve response time. So other benefits could be a better return on investment. So it could be sharing of tools and data sources. If you had separate teams and they emerged, you may have more people using these tools. So you're getting better value for money. You're able to use them better. Also there could be strategic

value especially at a board level and helping on decisions that the organization is making. So would there be any disadvantages? Um there may be disadvantages. um data classification access could be difficult if you're the merging teams trying to share things between people. Um some tools built for cyber security might not be um suitable for physical and geopoly teams. There are lots of tools that do incorporate geopol or you do have to pay extra for it. So it is possible. Um but then the other teams they might have really better tools specifically suited for their area. You may um try to cover too much suitable resources. So if you have a small team and you then trying to

incorporate your physical security and geopol into that team, it may just be too much. You may have four people and one of them then trying to cover the cyber security role and do geopol. So you may just be trying to do too much. It really depends on the resources that you've got and also then uh competing priority intelligence requirements. Um in threat intelligence we all have requirements so we know exactly what the focus for the business is what everyone's interested what stakeholders require from us. Uh but if you were having one team between different areas there may be conflict there. So it's really neat to understand and set out right from the beginning exactly what the one requirement is and

what the priority is for the the organization. So to wrap up um it seems to be more of an overlap between all these different areas. Um world's changing there is lots going on in the world and we really need to be aware of it. If you definitely you're a global organization there's going to impact to you somewhere. um even for smaller organizations there's going to be an impact. It could be through your supply chain and not you specifically. So you really need to look global and look at different areas where you could be impacted. Um as said before business strategy could be impacted more by threat intelligence. So you need to provide information to business and make

sure they've got the whole picture. Um well there could be different solutions depending on your organization. Obviously large organizations might be able to grow this kind of function a lot easier when one it may be a lot harder to cover lots of different areas. Um could be that you merge teams together could just retrain some staff or maybe just try and work closer with other teams. So maybe working groups that meet regularly and then in escalation they would meet more often just to make sure they're looking at things quickly. Um so it doesn't really matter how it's done. I think it's just more important that all these different functions start working together um so we can get that

bigger picture. So as a takeaway really want you to think about how this is done in your organization. um hopefully do have some of these intelligent teams and how you could all work together better to better protect your organization. That's it for me. Thank you

questions. >> Yeah, questions. Hi. >> When you got here intelligence requirement context, what what would that >> Yeah. So um when we work with different areas of business, um different teams, we need to know what what they're interested in. Um the way that we do it, we kind of have a catalog. So it's like are you interested in malware? Are you interested in global threats? Are you interested in just specific areas? Or we sort of break it down into different sections so we know where to focus and what information to give that part of the organization. So it could be a threat handing team who just really wants protections and know what what threats there are within just

global really. Um or maybe a vulnerability team where we let them know what's being exploited so that they can patch quicker. So it's really just knowing the specifics of what everybody wants. That's what priority intelligence requirements are. So hopey

stand out. Um, I've only really got experience of ones I've either used or s to me. Um, if you Well, depends also depends on your budget. If you had the budget to have things like maybe recorded features, you do try and cover a wide area and are expanding a lot. Since they got bought by Mastercard, they've been able to do that. So, they cover physical geoc. Um, but there are other little more specific ones. Um trying to think of if there are any that cover as well. There are some that sort of like things like data miner and stuff that gather information from everywhere. Um they can sort of give you a picture but um

it's quite hard to say exactly what

you