Chapter 19 — Threat intelligence and OSINT: scope and theory | Bachelor's Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 19 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["19.1 Definitions"]
  N2["19.2 Models"]
  N3["19.3 Sharing standards"]
  N4["19.4 CTI and risk"]
  N5["19.5 Theory and practice"]
  N6["19.6 Choosing a model"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["19.1 Definitions"]
  N2["19.2 Models"]
  N3["19.3 Sharing standards"]
  N4["19.4 CTI and risk"]
  N5["19.5 Theory and practice"]
  N6["19.6 Choosing a model"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX055"]

[Learning outcomes]
    |
    v
[19.1 Definitions]
    |
    v
[19.2 Models]
    |
    v
[19.3 Sharing standards]
    |
    v
[19.4 CTI and risk]
    |
    v
[19.5 Theory and practice]
    |
    v
[19.6 Choosing a model]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) define CTI and OSINT; (2) explain the role of models such as the kill chain and Diamond Model; (3) describe sharing frameworks — STIX, TAXII, TLP; (4) locate CTI in risk management.

19.1 Definitions

Cyber threat intelligence is analysed knowledge about adversaries' intent, capability and activity that supports defensive decisions. OSINT is intelligence derived from publicly available sources, collected lawfully. NIST SP 800-150 frames threat information sharing as a way for organisations to improve defences collectively.

For HCHT, the defining word is "supports": an item that does not help a decision about defending the trust is information, however interesting. Amara keeps the definitions at the front of her notebook and uses them to sort what arrives each day, so that analysis time goes to items that can change what HCHT does.

19.2 Models

Hutchins, Cloppert and Amin's intrusion kill chain (2011) breaks intrusions into phases from reconnaissance to actions on objectives, showing defenders can act at any phase. The Diamond Model (Caltagirone et al., 2013) describes each event by adversary, capability, infrastructure and victim. MITRE ATT&CK catalogues techniques observed in real intrusions.

Each model highlights different things, so Amara uses all three on one HSSC report and compares the results. The kill chain shows that the attack was stopped at delivery; the Diamond Model links its infrastructure to an earlier event; ATT&CK lists the techniques for detection work.

19.3 Sharing standards

STIX 2.1 defines a JSON vocabulary for indicators, threat actors, attack patterns and relationships. TAXII 2.1 defines how to exchange STIX over HTTPS. FIRST TLP 2.0 labels tell recipients how widely they may share.

HCHT receives HSSC material over TAXII and stores it in its own database, mapped to STIX fields where possible. Amara learns that the TLP marking travels with each object, so a script can check whether an object may be shared before it leaves HCHT. Following the standards means HCHT's tools can read what other members send without custom conversion, which saves time in a small team.

19.4 CTI and risk

CTI changes the likelihood estimates in risk assessments and informs which controls to prioritise. Without a link to risk decisions, CTI becomes a news service.

Amara's notes for each item end with the risk it affects: which system, which consequence and how the likelihood may have changed. When the security lead updates HCHT's risk register, these notes are the evidence for each change. Items that change no risk are archived for later searches, which keeps the team's reports focused on decisions rather than news.

19.5 Theory and practice

Models are lenses, not laws. Each simplifies; analysts choose the one that answers the question at hand.

Amara learns this when one HSSC report fits the kill chain poorly: the attacker used a stolen supplier account and skipped delivery altogether. The model still helps, by showing which phases were skipped, but it does not force the event into a shape it does not have. She notes the mismatch in her analysis, which is more honest than forcing every phase to have an entry, and explains which model she relied on instead.

19.6 Choosing a model

Use the kill chain when asking where to interrupt an intrusion, the Diamond Model when asking how events connect through shared infrastructure or capability, and ATT&CK when asking which behaviours to detect. Mixing them is fine if the report says which lens produced each conclusion.

Amara adds a line to each report naming the model used for each conclusion. Readers can then judge each conclusion by the strengths and limits of the lens behind it, and a reviewer can ask whether a different model would have led somewhere else. The line costs a few words and prevents a common confusion.

Worked example

Amara describes one phishing event with the Diamond Model: adversary unknown; capability a credential-harvesting page; infrastructure portal-login.example; victim an HCHT finance clerk. She then places it on the kill chain at delivery and maps it to T1566. Each lens answers a different question.

Synthetic case. The event is invented.

Errors and limits

Kill-chain linearity breaks for insider or cloud attacks. ATT&CK reflects reported behaviour, not the full population.

Exercises

EX055 — Model choice. Which model would you use to ask "where could we have stopped this intrusion"?
Show marking criteria
Rubric: 3 = kill chain, with reason; 2 = name; 1 = TLP; 0 = none.
EX056 — STIX vs TAXII. Distinguish STIX 2.1 from TAXII 2.1.
Show marking criteria
Rubric: 3 = STIX is data format; TAXII is transport protocol over HTTPS; 2 = partial; 1 = same; 0 = none.
EX057 — Without risk. What happens when CTI is not linked to risk decisions?
Show marking criteria
Rubric: 3 = becomes news without action/priority; 2 = partial; 1 = vague; 0 = none.

Synthesis

CTI is decision-support built on models and shared through standards; choose the right lens and link it to risk.

Continue studying — chapter 19 of 40

← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →