Cyber Threat Intelligence

Preface

Cyber Threat Intelligence describes the intelligence techniques and models used in cyber threat intelligence. It provides a survey of ideas, views, and concepts, rather than offering a hands‐on practical guide. It is intended for anyone who wishes to learn more about the domain, possibly because they wish to develop a career in intelligence, and as a reference for those already working in the area.

The origins of this book lie in an awkward dinner conversation. I was on one side of the table, a software engineer who had fallen into the domain of cyber security more or less by accident. On the other was a uniformed senior military intelligence officer. A shared professional interest in cyber threat intelligence led to our being invited to the same event.

Keen to learn how better to analyse the attacks that I was encountering, I tried to learn all that I could about intelligence techniques from my neighbour. Naively, I had hoped that there might be a text book that set out the approaches that I could try to apply to identify attackers. At the very least, I was certain that there must be conceptual models, which I could adapt from the intelligence world to make better use of my data.

Instead, I discovered that military intelligence officers do not impart their knowledge to civilians easily, nor do they particularly appreciate lengthy questioning about the details of their profession. My conclusion was that I would have to develop my own body of knowledge regarding intelligence ...