Intelligence-Driven Incident Response, 2nd Edition

Preface

Welcome to the exciting world of intelligence-driven incident response! Intelligence—specifically, cyber threat intelligence—has a huge potential to help network defenders better understand and respond to attackers’ actions against their networks.

With the first edition of Intelligence-Driven Incident Response, our goal was to demonstrate how intelligence fits into the incident-response process and make the case for taking what seemed to be at the time, a novel approach to understanding adversaries and reducing the time it takes to detect, respond to, and remediate intrusions. In the years that have passed since the first edition was released, we have seen tremendous growth in the field, both in numbers and capabilities. Our goal in this second edition is to continue to grow along with the community, adding in additional techniques, methods, lessons learned, and case studies to help more seamlessly integrate these concepts into the critical work that is being done every day to secure the technology that we rely on every day.

Wherever you are in your journey, whether you are just starting in cybersecurity, are transitioning from another security domain into cyber threat intelligence, or are a seasoned professional, we hope you find this book a valuable tool to help you in your mission of making the world a more secure place.

Why We Wrote This Book

In recent years, we have seen a transition from approaching incident response as a standalone activity to viewing it as an ...