Chapter 32 — Threat intelligence and OSINT: interdisciplinary interfaces | Bachelor's Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 32 — Threat intelligence and OSINT: interdisciplinary interfaces

Lesson map

Lesson 32 published. Map, example, EX094.

flowchart TD
  N0["Learning outcomes"]
  N1["32.1 Legal"]
  N2["32.2 Privacy"]
  N3["32.3 Clinical leadership"]
  N4["32.4 Communications"]
  N5["32.5 Procurement"]
  N6["32.6 Shared vocabulary"]
  N7["Human resources and insiders"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX094"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["32.1 Legal"]
  N2["32.2 Privacy"]
  N3["32.3 Clinical leadership"]
  N4["32.4 Communications"]
  N5["32.5 Procurement"]
  N6["32.6 Shared vocabulary"]
  N7["Human resources and insiders"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX094"]

[Learning outcomes]
    |
    v
[32.1 Legal]
    |
    v
[32.2 Privacy]
    |
    v
[32.3 Clinical leadership]
    |
    v
[32.4 Communications]
    |
    v
[32.5 Procurement]
    |
    v
[32.6 Shared vocabulary]
    |
    v
[Human resources and insiders]
    |
    v
[Worked example] --> [Exercise EX094]

Learning outcomes

You will (1) work with legal, privacy, clinical and communications colleagues; (2) translate CTI for each; (3) recognise their constraints; (4) avoid overstepping roles.

32.1 Legal

Lawyers advise on data protection, contracts with intelligence providers and obligations to report incidents. They need facts and uncertainty stated clearly, not jargon.

Amara learns to write for lawyers by stating what is known, what is assumed and what is unknown, each in plain sentences. When a credential dump was reported, her note to the legal team listed the number of accounts, the source's reliability grade and the date, so they could decide on reporting duties without needing to understand the technical detail. The lawyers asked two clarifying questions and decided quickly.

32.2 Privacy

The data protection officer decides on personal-data processing, retention and breach notification. CTI involving personal data — credential dumps, phishing samples — goes through them.

Amara involves the officer early rather than after the work is done. When she proposed storing redacted phishing samples for research, the officer agreed a purpose, a retention period and access limits before any were kept. The officer also reviews the redaction script's tests, which gives both teams confidence that personal data is not shared through HSSC.

32.3 Clinical leadership

Clinicians decide on patient-safety trade-offs. If intelligence suggests isolating a laboratory system, the clinical lead weighs that against delayed test results. CTI provides the threat picture; clinicians decide.

Amara's role in such decisions is to describe the threat clearly, with its likelihood and confidence, and to list the options with their security effect. She does not recommend overriding clinical judgment. In one case, the clinical lead chose to keep a laboratory system online with extra monitoring rather than isolate it, and the CTI team arranged the monitoring that afternoon.

32.4 Communications

If an incident becomes public, communications staff need accurate, approved facts. CTI analysts should never speak to media or post publicly about incidents.

Amara supplies facts to the communications team only through her supervisor and the incident lead, who approve what is released. She avoids speculation in anything that might be passed on, such as guesses about who was responsible. If a journalist contacts her directly, she refers them to the communications team without comment, as HCHT's policy requires. Accuracy protects HCHT's reputation.

32.5 Procurement

Supplier risk assessments benefit from intelligence about supplier compromises. Procurement needs short, sourced summaries they can include in contracts and reviews.

Amara writes these summaries in a page or less, citing public sources and avoiding restricted material unless its TLP label allows it. Each summary states what happened at the supplier, whether HCHT uses the affected product and what questions procurement could ask. Procurement uses the questions in contract renewals, and two suppliers have since added incident notification clauses. The summaries are filed with each supplier record.

32.6 Shared vocabulary

Words carry different meanings across professions. "Incident" for clinicians may mean patient harm; for security, any policy breach. "Confidential" has a legal meaning for lawyers that differs from a TLP label. Agree a small glossary for joint work and define terms on first use in every cross-team note.

Amara keeps a joint glossary with the legal and clinical teams. It has about twenty terms, each with the meaning used by each team where they differ. Amara links it from every cross-team note, and when a misunderstanding happens she adds the term that caused it. The glossary has already prevented one confusion over the word incident.

Human resources and insiders

When intelligence touches staff behaviour — a pattern of policy breaches or suspected insider activity — human resources and legal lead, under employment law and fair procedure. CTI analysts provide facts on request and avoid informal investigations of colleagues, which can be unlawful and destroy trust. Keep such matters out of routine briefs and share them only with the people formally assigned.

Worked example

A ransomware advisory names a pathology supplier used by HCHT. Amara briefs procurement (contract clauses on incident notification), the clinical lead (contingency for manual reporting) and the data protection officer (possible patient-data exposure if the supplier is hit). Each brief is one paragraph in that audience's terms.

Synthetic case. The advisory and supplier are invented.

Errors and limits

Translation can drop uncertainty. Keep likelihood and confidence in every version.

Exercises

EX094 — Who decides. Who decides whether to isolate a laboratory system, and what does CTI contribute? Rubric: 3 = clinical/system owner decides; CTI provides threat picture; 2 = partial; 1 = CTI decides; 0 = none.
EX095 — Media call. A journalist calls Amara about an incident. What should she do? Rubric: 3 = not comment; refer to communications; 2 = decline; 1 = answer; 0 = none.
EX096 — Word clash. Give one term that means different things to clinicians and security staff. Rubric: 3 = e.g. "incident" with both meanings; 2 = term only; 1 = vague; 0 = none.

Synthesis

Serve each profession in its language, respect their decisions and keep uncertainty intact in translation.

Continue studying — chapter 32 of 40

← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →