Using a well-conceived incident response plan in the aftermath of an online security breach enables your team to identify attackers and learn how they operate. But, only when you approach incident response with a cyber threat intelligence mindset will you truly understand the value of that information. With this practical guide, you’ll learn the fundamentals of intelligence analysis, as well as the best ways to incorporate these techniques into your incident response process.
Each method reinforces the other: threat intelligence supports and augments incident response, while incident response generates useful threat intelligence. This book helps incident managers, malware analysts, reverse engineers, digital forensics specialists, and intelligence analysts understand, implement, and benefit from this relationship.
In three parts, this in-depth book includes:
- The fundamentals: get an introduction to cyber threat intelligence, the intelligence process, the incident-response process, and how they all work together
- Practical application: walk through the intelligence-driven incident response (IDIR) process using the F3EAD process—Find, Fix Finish, Exploit, Analyze, and Disseminate
- The way forward: explore big-picture aspects of IDIR that go beyond individual incident-response investigations, including intelligence team building
Table of Contents
- I. The Fundamentals
- Intelligence as Part of Incident Response
- Incident Response as a Part of Intelligence
- What Is Intelligence-Driven Incident Response?
- Why Intelligence-Driven Incident Response?
- 2. Basics of Intelligence
3. Basics of Incident Response
- Incident-Response Cycle
- Kill Chain
- Diamond Model
- Active Defense
- Picking the Right Model
- Scenario: GLASS WIZARD
- II. Practical Application
- Actor-Centric Targeting
- Asset-Centric Targeting
- News-Centric Targeting
- Targeting Based on Third-Party Notification
- Prioritizing Targeting
- Organizing Targeting Activities
- The Request for Information Process
- 5. Fix
- 6. Finish
- 7. Exploit
- The Fundamentals of Analysis
- What to Analyze?
- Conducting the Analysis
- Analytic Processes and Methods
- Intelligence Consumer Goals
- The Writing Process
- Intelligence Product Formats
- Establishing a Rhythm
- III. The Way Forward
- 10. Strategic Intelligence
11. Building an Intelligence Program
- Are You Ready?
- Planning the Program
- Stakeholder Personas
- Tactical Use Cases
- Operational Use Cases
- Strategic Use Cases
- Strategic to Tactical or Tactical to Strategic?
- Hiring an Intelligence Team
- Demonstrating Intelligence Program Value
- A. Intelligence Products
- Title: Intelligence-Driven Incident Response
- Release date: August 2017
- Publisher(s): O'Reilly Media, Inc.
- ISBN: 9781491934944