Intelligence-Driven Incident Response, 2nd Edition

Chapter 1. Introduction

But I think the real tension lies in the relationship between what you might call the pursuer and his quarry, whether it’s the writer or the spy.

John le Carré

Once relegated to the secretive realms of national security and military operations, intelligence has become something that is fundamental to the daily functioning of many organizations around the world. At its core, intelligence seeks to give decision makers the information that they need to make the right choice in any given situation.

Previously, decision makers experienced significant uncertainty because they did not have enough information to make the right decisions. Today they are likely to feel there is too much information, but just as much ambiguity and uncertainty as in the past. This is especially the case with network security, where there are fewer traditional indications that a significant action is actually about to take place. To make decisions about how to prepare for and respond to a network security incident, decision makers need analysts who understand intelligence fundamentals, the nuance of network intrusions, and how to combine the two into an accurate assessment of a situation and what it means for their entire organization. In short, they need analysts who can conduct intelligence-driven incident response.

Before diving into the application of intelligence-driven incident response, it is important to understand the evolution of cybersecurity incidents and their responses, ...