Chapter 15 — Security fundamentals | Engineering Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 CIA for intelligence"]
  N2["15.2 Threat, vulnerability, risk"]
  N3["15.3 CTI in CSF 2.0"]
  N4["15.4 The platform as target"]
  N5["15.5 Kill chain as defensive map"]
  N6["Practice note — Accountability"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 CIA for intelligence"]
  N2["15.2 Threat, vulnerability, risk"]
  N3["15.3 CTI in CSF 2.0"]
  N4["15.4 The platform as target"]
  N5["15.5 Kill chain as defensive map"]
  N6["Practice note — Accountability"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 CIA for intelligence]
    |
    v
[15.2 Threat, vulnerability, risk]
    |
    v
[15.3 CTI in CSF 2.0]
    |
    v
[15.4 The platform as target]
    |
    v
[15.5 Kill chain as defensive map]
    |
    v
[Practice note — Accountability]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) apply confidentiality, integrity and availability to intelligence data; (2) define threat, vulnerability and risk; (3) place CTI within NIST CSF 2.0 functions; (4) explain why the CTI platform is itself a target.

15.1 CIA for intelligence

Confidentiality: TLP:RED reports must reach only named recipients. Integrity: a tampered indicator could block a legitimate supplier or, worse, a safety system's update server. Availability: when a campaign starts, analysts need the platform most.

Kofi writes a short note for each kind of data in Lantern stating which of the three properties matters most. Partner reports are mainly about confidentiality, block lists about integrity, and the matching service about availability. Controls are chosen from that note rather than applied equally everywhere.

15.2 Threat, vulnerability, risk

A threat is a potential cause of harm (an adversary or an accident). A vulnerability is a weakness that could be used. Risk combines likelihood and impact. CTI informs the threat side: which adversaries, which techniques, which targets.

Kofi keeps the terms apart in his reports. A partner bulletin about an actor targeting energy companies is threat information. An unpatched remote-access server at BEN is a vulnerability. The risk is that this actor uses that server, judged by how likely and how damaging that would be. Intelligence changes the likelihood estimate; it does not fix the server.

15.3 CTI in CSF 2.0

NIST CSF 2.0 organises outcomes as Govern, Identify, Protect, Detect, Respond and Recover. Threat intelligence feeds Identify (risk assessment), Detect (rules) and Respond (context), and sharing agreements are a Govern matter.

Placing intelligence work in these functions helps BEN explain its value. A new detection rule written from a partner report is a Detect outcome; a briefing that changes the risk register is Identify. Agreements about what BEN may share, with whom and under what label sit under Govern, because they set obligations for the whole organisation rather than one team. Kofi tags each Lantern output with the function it serves.

15.4 The platform as target

An adversary who poisons Lantern could make BEN block its own suppliers or ignore real threats. Integrity controls — signed feeds where available, source reputation, anomaly checks on volume — protect against poisoning.

Kofi's anomaly checks compare each delivery with that source's history. A sudden jump in volume, many indicators for well-known services or entries that match BEN's allow-list all hold the delivery for review. Source reputation falls when a partner's entries are later found wrong, which lowers the confidence of its future deliveries until the record improves.

15.5 Kill chain as defensive map

Hutchins et al. argued that defenders can act at every phase. Lantern's outputs map to phases: domain blocks to delivery and command and control, behavioural analytics to installation and actions on objectives.

The mapping shows where BEN's defences are thin. When Kofi tallied Lantern's outputs by phase, most fell in delivery and command and control, because indicators are easy to share for those phases. Few addressed what an intruder does after gaining a foothold. That gap became a request to the detection team for behavioural analytics on internal hosts.

Practice note — Accountability

Every automated block must be explainable: which indicator, which source, which confidence, which rule. Lantern stores that chain with the block so that when a supplier complains, the SOC can answer in minutes and correct the source rather than guessing.

Worked example

A partner feed suddenly includes BEN's own payroll provider's domain. Kofi's anomaly check flags it because the domain appears in BEN's allow-list of critical suppliers. Analysts confirm the entry was a partner error; blocking would have stopped salary payments.

Synthetic case. The feed error and supplier are invented.

Errors and limits

Allow-lists can themselves be abused; review them. CIA is a starting vocabulary, not a full risk method.

Exercises

EX043 — Integrity harm. Describe one integrity failure in Lantern and its operational consequence.
Show marking criteria
Rubric: 3 = tampered/poisoned indicator → blocking legitimate service or missing threat; 2 = vague tamper; 1 = confidentiality example; 0 = none.
EX044 — CSF placement. Name two CSF 2.0 functions that CTI supports, with an example each.
Show marking criteria
Rubric: 3 = two functions with matching examples; 2 = two names; 1 = one; 0 = none.
EX045 — Poison check. Why compare feed contents with an allow-list of critical suppliers?
Show marking criteria
Rubric: 3 = catches poisoning/errors that would block critical services; 2 = partial; 1 = speed; 0 = none.

Synthesis

Apply CIA to intelligence itself, place CTI in CSF, and protect the platform from poisoning.

Continue studying — chapter 15 of 50

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →