CS Mar-Apr 2020

expert insights
THE INTELLIGENT APPROACH TO CYBER THREAT INTELLIGENCE
SEEKING SOMEONE WHO CAN UNDERSTAND VULNERABILITY, EXPLOITATION AND ATTACKER MOTIVATION?
IAN THORNTON-TRUMP, CHIEF INFORMATION SECURITY OFFICER FOR CYJAX, MAY HAVE THE ANSWER
Ian Thornton-Trump, Cyjax.
As soon as you say the word
'Intelligence', everyone seems to
think 1960s East Germany. I don't
know why everyone seems to think that
the words 'Intelligence Analyst' are
exclusively reserved for nation states or
large organisations. I'm here to tell you
that tactical intelligence and strategic
intelligence are easily within the reach
of most organisations - no trench coats
required.
The reality is that an 'intelligence
Analyst Skill' is not learned in university;
it's generally the domain of law
enforcement, military or government
agency service. That's a travesty that
I am going to fix right now. It does not
require some sort of special person,
special forces qualified and of
exceptional intelligence. It does require
a person to be able to embrace a
different way of thinking and writing,
which moves beyond traditional
academic writing or journalism.
Intelligence analysis and the products
that process produces are all about
timely, accurate and actionable content -
a marked departure from 5,000 words
on the fall of the Prussian Empire or an
attempt to sensationalise the latest
celebrity misstep.
When you stick the Cyber word in front
of 'Intelligence Analysis', one may think
that this is even more esoteric profession,
but it is actually applying the 'world's
second oldest profession's' thinking to
a relatively new problem. Despite the
Hollywood and media stereotypes of
excessive gym-based activity 'Blackhat'
or nerdy computer skills 'CSI Cyber', the
actual "Cyber Threat Intelligence Analyst"
needs none of those marksmanship or
hacking skills - it's not to say they may
not help, but realistically it's unlikely to
be needed in day-to day-activity.
So, the question is: What is a Cyber
Threat Intelligence Analyst? An oracle?
A fortune teller? In simple terms,
it's someone that can understand
vulnerability, exploitation and attacker
motivation. An expert at threat
modelling with gifted communication
skills. Folks that have had to stand in
front of a class or defend a dissertation
are generally superior recruits for
executing analysis tasks to protect
organisations. If Park Rangers look for
fires through binoculars, Intelligence
analysts tell them where to look and why
they need to look. That's the essence of
the job.
One can easily understand that, if you
know where to look and why you need
to look, this is a huge cost savings and
a huge time saving - that's the value
of intelligence when it comes to your
organisation. Imagine if a person was
able to look at what you have and tell
you what bad guys have that may take it
away, and what you could do to thwart
them. A 'win', then, is getting in front of
an attack by knowing when, where and
how the attack might come.
Now, truth be told, I've had a lot of
training as an intelligence analyst
(Canadian Forces & RCMP - I was actually
trained by a ex-CIA instructor) and, in the
case of 'Eternal Blue', 'Blue Keep' and the
registration of a fraudulent typosquating
domain, along with issue of a certificate
for that typosquating domain, I'm
very confident that an attack on an
organisation is forthcoming - as that's
what bad guys do. My prediction based
upon analysis comes from experience,
but how I reach that conclusion is an
intellectual process - easily taught and
more accurate over time with analyst
experience.
Good intelligence can help direct a
spoiling attack - something that disrupts
the bad guys from successfully executing
an exploit against you. The information
to protect your organisation is out there
- you just need someone that is trained
in the art of listening and direct your
organisation to take action.
30
computing security Mar/Apr 2020 @CSMagAndAwards www.computingsecurity.co.uk