Advanced Persistent Security

Chapter 12

What Is Threat Intelligence?

Abstract

Threat intelligence in the cyber space refers to a bleeding-edge technology and operational disciplines that enable the collection, correlation, and analysis and the meaningful use of data on threats or threat actors to inform and adopt security defenses. A threat intelligence program provides a neutral, unbiased lexicon and forum by which security teams can share threat information with one another, interoperate more effectively with compatriots and law enforcement, and avail the expertise of others to improve and coordinate advanced countermeasures. There are a number of accepted classifications of intelligence, but to set the stage, we will highlight those that are most commonly collected and consumed ...