◇ OpenCyber Academy
Bachelor's · Chapter 5 · English

Chapter 5 — Security literacy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Core terms"]
  N2["5.2 The CTI life cycle"]
  N3["5.3 Three levels"]
  N4["5.4 Why healthcare"]
  N5["5.5 Intelligence versus information"]
  N6["Who consumes intelligence at HCHT"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Core terms"]
  N2["5.2 The CTI life cycle"]
  N3["5.3 Three levels"]
  N4["5.4 Why healthcare"]
  N5["5.5 Intelligence versus information"]
  N6["Who consumes intelligence at HCHT"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Core terms]
    |
    v
[5.2 The CTI life cycle]
    |
    v
[5.3 Three levels]
    |
    v
[5.4 Why healthcare]
    |
    v
[5.5 Intelligence versus information]
    |
    v
[Who consumes intelligence at HCHT]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) define threat, vulnerability, risk and control; (2) describe the CTI life cycle; (3) distinguish strategic, operational and tactical intelligence; (4) explain why healthcare is attractive to attackers.

5.1 Core terms

A threat is a potential cause of harm — an actor or event. A vulnerability is a weakness. Risk combines likelihood and impact. A control reduces risk. CTI informs the threat part of that equation so that controls go where they matter.

For HCHT, the threat is a criminal group sending phishing to clinical staff, the vulnerability is an unpatched remote access service and the risk is high because an outage would affect patient care. Intelligence about the group's methods helps decide which controls to strengthen first.

5.2 The CTI life cycle

Direction (what do decision-makers need?), collection, processing, analysis, dissemination and feedback. In practice, direction is often missing; analysts then collect everything and help no one. Priority intelligence requirements fix that.

Amara helps draft HCHT's first requirements with her supervisor: which threats could disrupt clinical services, which suppliers are targeted, and which techniques are seen in health-sector attacks. Each requirement names who needs the answer and how often. Collection then focuses on sources that answer them, and feedback shows whether the answers were useful, so the cycle improves over time.

5.3 Three levels

Strategic: trends and intent for executives — for example, criminal groups targeting hospitals for extortion. Operational: campaigns and timing for incident leads — a phishing wave against health trusts this month. Tactical: indicators and techniques for analysts — sender domains and T1566 Phishing.

Each level reaches a different audience and needs a different style. Amara practises writing the same HSSC report three ways: a short paragraph for the board, a page for incident leads and a list of indicators with techniques for analysts. Mixing levels, such as giving the board indicator lists, wastes the reader's time and hides what they need to decide.

5.4 Why healthcare

Hospitals hold sensitive data, run around the clock and cannot tolerate downtime, which increases pressure to pay extortion. Legacy systems and many suppliers widen exposure. Strategic intelligence helps boards understand this context without sensationalism.

Amara's briefing for HCHT's board uses sector reports to describe the threat accurately and links each point to a decision the board can take, such as funding faster recovery for clinical systems. She avoids alarming language and uses figures only when their source and sample are clear.

5.5 Intelligence versus information

A feed of domains is information. An assessment that a campaign targets laboratory systems and that HCHT should block specific domains and brief laboratory staff is intelligence — analysed and tied to a decision.

Amara checks every product she writes against this test: what decision does it support, and who makes it? A list she cannot connect to a decision is kept as information and stored for later searches, not sent as intelligence. This keeps the security team's inbox for material that asks something of them, and it helps HSSC see which of its shared items were actually used.

Who consumes intelligence at HCHT

Consumers include the service desk, network team, clinical engineering, the data protection officer and the board. Each needs different detail at different speed. Mapping consumers and their decisions is the first practical step in direction, because it shows which questions intelligence must answer and in which format each audience can actually use the answer.

Worked example

HCHT's chief executive asks whether the trust is "a target". Amara's supervisor answers at the strategic level: health organisations in the region have faced extortion campaigns; HCHT's exposure is typical; the main defensive priorities are phishing resistance and backups. Indicators are left out of the executive brief.

Synthetic case. The briefing is invented.

Errors and limits

Fear-driven briefings distort investment. Levels overlap; label the intended audience.

Exercises

Synthesis

Use core terms precisely, start the cycle with direction, match the level to the audience and turn information into intelligence.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →