O'Reilly logo

Intelligence-Driven Incident Response by Scott J. Roberts, Rebekah Brown

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Chapter 11. Building an Intelligence Program

“Great things in business are never done by one person. They’re done by a team of people.”

Steve Jobs

Working with an intelligence team can be a game changer for many security operations programs. However, there needs to be system in place to get everyone on the same page, both within the intelligence team and with the customers that the team will be supporting. A structured intelligence program will provide the benefit of a robust intelligence support capability while avoiding many of the struggles teams go through when they are thrown together rather than purposely built. This chapter covers the various elements to consider when building an intelligence team or function at your organization.

Are You Ready?

One question that frequently gets asked is, “What are the prerequisites for forming an intelligence team?” Many things need to be done before a formalized intelligence function will be beneficial. We are not of the mindset that an intelligence program is the last thing that should be created at an organization, but we do view the intelligence function as the glue that holds many other security functions together. If you do not have those existing functions, you will just end up standing around, holding a bottle of glue.

Here are some fundamental questions to ask before beginning to develop an intelligence program, which will require funding, time, and effort:

Is there a security function at the organization?

This seems like ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required