Chapter 22 — Threat intelligence and OSINT: data and dependencies
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Source catalogue"]
N2["22.2 Dependencies"]
N3["22.3 Terms and licences"]
N4["22.4 Single points of failure"]
N5["22.5 Coverage gaps"]
N6["22.6 Source evaluation over time"]
N7["Internal sources"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Source catalogue"]
N2["22.2 Dependencies"]
N3["22.3 Terms and licences"]
N4["22.4 Single points of failure"]
N5["22.5 Coverage gaps"]
N6["22.6 Source evaluation over time"]
N7["Internal sources"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Source catalogue]
|
v
[22.2 Dependencies]
|
v
[22.3 Terms and licences]
|
v
[22.4 Single points of failure]
|
v
[22.5 Coverage gaps]
|
v
[22.6 Source evaluation over time]
|
v
[Internal sources]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) catalogue HCHT's intelligence sources and their dependencies; (2) assess single points of failure; (3) evaluate source licences and terms; (4) plan for source loss.
22.1 Source catalogue
For each source record: provider, content type, format, delivery method, licence or terms, TLP, cost and owner. HSSC (STIX over TAXII 2.1, membership agreement), a national advisory service (public web pages), a commercial feed (contract), and internal incident records.
Amara builds the catalogue in a shared spreadsheet that is reviewed each quarter. Several fields were unknown at first, such as the commercial feed's exact redistribution terms, and finding them out took longer than recording everything else. The catalogue now answers most questions about a source in seconds.
22.2 Dependencies
The commercial feed depends on a contract renewal; HSSC depends on volunteer staff; the import scripts depend on one analyst's knowledge. Each is a dependency that can fail.
Amara adds each dependency to the catalogue with what would happen if it failed and how quickly the team would notice. The contract renewal date goes into the team's calendar with a reminder two months ahead. For HSSC, she notes the backup contact the community provides. The script dependency is the one the team controls most directly, which leads to the work on documentation and training described next.
22.3 Terms and licences
Commercial feeds often forbid redistribution. Before sharing an indicator learned from a paid feed with HSSC, Amara checks the licence. Public advisories may permit reuse with attribution.
When the licence forbids sharing, Amara shares only HCHT's own observation, for example that the domain was seen in its logs, if the licence allows that, and otherwise tells HSSC only that a paid feed lists the item. She records each decision in the catalogue entry for the source, so the same question is answered consistently.
22.4 Single points of failure
If the only person who understands the import script leaves, the pipeline stops. Documentation, a second trained person and simple code reduce that risk.
Amara writes a short guide to the import script, explaining each step and the common errors, and trains a colleague to run it. The colleague runs the import for two weeks while Amara watches, which reveals two undocumented steps that are now in the guide. Simplifying the code also made it easier to review and test.
22.5 Coverage gaps
Sources cover some threats better than others. National advisories may underweight medical-device threats; vendor feeds may focus on commodity malware. A coverage table shows gaps.
Amara builds the table with threat types as rows and sources as columns, marking where each source provides useful coverage. The empty cells show where HCHT relies on chance. Medical-device threats are the clearest gap, so the team asks clinical engineering whether device manufacturers publish advisories that could be added as a source. Two manufacturers do, and their notices are added to the catalogue with an owner.
22.6 Source evaluation over time
Sources change: a once-excellent feed may degrade after an acquisition, or a volunteer group may stop publishing. A quarterly check — volume, timeliness, proportion of items leading to action — catches decline before analysts notice that a source has quietly become noise.
Amara records the check results in the catalogue next to each source. Over a year the checks show the commercial feed's timeliness worsening after a change of owner, while the manufacturers' notices prove more useful than expected. The team uses the figures at contract renewal, asking the vendor to explain the decline, and adjusts how much weight each source gets in triage.
Internal sources
HCHT's own incidents are its most relevant intelligence: they show what actually reached the trust. Service-desk tickets about suspicious email, endpoint alerts and lessons-learned notes should flow into the catalogue as sources, with the same care for personal data as external material.
Worked example
The commercial contract lapses for a week due to a procurement delay. Amara's catalogue shows which detections depend on that feed. The team switches those to HSSC data temporarily and raises the dependency in the risk register.
Synthetic case. The lapse is invented.
Errors and limits
Catalogues go out of date; review quarterly.
Exercises
- EX064 — Licence check. Why must Amara check before sharing a paid-feed indicator with HSSC? Rubric: 3 = licence may forbid redistribution; 2 = partial; 1 = no check needed; 0 = none.
- EX065 — Human dependency. Give two ways to reduce the single-analyst dependency. Rubric: 3 = documentation; second trained person (or simpler code); 2 = one; 1 = vague; 0 = none.
- EX066 — Catalogue fields. List four fields of a source-catalogue entry. Rubric: 3 = four of provider/format/delivery/licence/TLP/cost/owner; 2 = three; 1 = one or two; 0 = none.
Synthesis
Know your sources, their terms and dependencies, and plan for their failure.
Continue studying — chapter 22 of 40
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →