Intelligence-Driven Incident Response

Chapter 1. Introduction

“But I think the real tension lies in the relationship between what you might call the pursuer and his quarry, whether it’s the writer or the spy.”

John le Carre

Before diving into the application of intelligence-driven incident response, it is important to understand the reasons that cyber threat intelligence is so important to incident response. This chapter covers the basics of cyber threat intelligence, including its history and the way forward, and sets the stage for the concepts discussed in the rest of this book.

Intelligence as Part of Incident Response

As  long as there has been conflict, there have been those who studied, analyzed, and strove to understand the enemy. Wars have been won and lost based on an ability to understand the way the enemy thinks and operates, to comprehend their motivations and identify their tactics, and to make decisions—large and small—based on this understanding. Regardless of the type of conflict, whether a war between nations or a stealthy intrusion against a sensitive network, threat intelligence guides both sides. The side that masters the art and science of threat intelligence, analyzing information about the intent, capability, and opportunities of adversaries, will almost always be the side that wins.

History of Cyber Threat Intelligence

In 1986, Cliff Stoll was a PhD student managing the computer lab at Lawrence Berkley National Laboratory in California when he noticed a billing discrepancy in the amount ...