Intelligence-Driven Incident Response

Chapter 11. Building an Intelligence Program

“Great things in business are never done by one person. They’re done by a team of people.”

Steve Jobs

Working with an intelligence team can be a game changer for many security operations programs. However, there needs to be system in place to get everyone on the same page, both within the intelligence team and with the customers that the team will be supporting. A structured intelligence program will provide the benefit of a robust intelligence support capability while avoiding many of the struggles teams go through when they are thrown together rather than purposely built. This chapter covers the various elements to consider when building an intelligence team or function at your organization.

Are You Ready?

One question that frequently gets asked is, “What are the prerequisites for forming an intelligence team?” Many things need to be done before a formalized intelligence function will be beneficial. We are not of the mindset that an intelligence program is the last thing that should be created at an organization, but we do view the intelligence function as the glue that holds many other security functions together. If you do not have those existing functions, you will just end up standing around, holding a bottle of glue.

Here are some fundamental questions to ask before beginning to develop an intelligence program, which will require funding, time, and effort:

Is there a security function at the organization?

This seems ...