◇ OpenCyber Academy
Engineering · Chapter 27 · English

Chapter 27 — Threat intelligence and OSINT: control design

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 27 — Threat intelligence and OSINT: control design

Lesson map

Lesson 27 published. Map, example, EX079.

flowchart TD
  N0["Learning outcomes"]
  N1["27.1 TLP as a control"]
  N2["Lab 5 — dissemination gate"]
  N3["27.2 Reading the gate"]
  N4["27.3 Fail closed"]
  N5["27.4 Approval gates"]
  N6["27.5 Audit"]
  N7["Training the humans"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX079"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["27.1 TLP as a control"]
  N2["Lab 5 — dissemination gate"]
  N3["27.2 Reading the gate"]
  N4["27.3 Fail closed"]
  N5["27.4 Approval gates"]
  N6["27.5 Audit"]
  N7["Training the humans"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX079"]

[Learning outcomes]
    |
    v
[27.1 TLP as a control]
    |
    v
[Lab 5 — dissemination gate]
    |
    v
[27.2 Reading the gate]
    |
    v
[27.3 Fail closed]
    |
    v
[27.4 Approval gates]
    |
    v
[27.5 Audit]
    |
    v
[Training the humans]
    |
    v
[Worked example] --> [Exercise EX079]

Learning outcomes

You will (1) implement TLP 2.0 as an enforceable dissemination control; (2) fail closed on unknown labels; (3) design approval gates for high-impact actions; (4) log control decisions for audit.

27.1 TLP as a control

FIRST TLP 2.0 defines who may receive information: CLEAR without restriction; GREEN within the community; AMBER within the recipient organisation and its clients on a need-to-know basis; AMBER+STRICT within the organisation only; RED to named recipients only. Lantern turns those definitions into a gate on every export and every analyst view.

Kofi's gate reads the label from the object and the audience from the request, then checks the pair against a table derived from the definitions. Keeping the table separate from the code means a reviewer can compare it line by line with the published standard.

Lab 5 — dissemination gate

"""Lab 5 (ch 27): TLP 2.0 dissemination gate for synthetic reports and audiences."""
ALLOWED = {
    "TLP:CLEAR": {"public", "community", "org", "team"},
    "TLP:GREEN": {"community", "org", "team"},
    "TLP:AMBER": {"org", "team"},
    "TLP:AMBER+STRICT": {"team", "org-only"},
    "TLP:RED": {"named-recipients"},
}
requests = [("R-1", "TLP:GREEN", "public"), ("R-2", "TLP:AMBER", "org"),
            ("R-3", "TLP:RED", "team"), ("R-4", "TLP:CLEAR", "public"), ("R-5", "TLP:PURPLE", "team")]
for rid, label, aud in requests:
    if label not in ALLOWED:
        verdict = "BLOCK unknown label"
    else:
        verdict = "ALLOW" if aud in ALLOWED[label] else "BLOCK"
    print(rid, label, "->", aud, verdict)

Run with python3 lab_tlp.py. Verified output:

R-1 TLP:GREEN -> public BLOCK
R-2 TLP:AMBER -> org ALLOW
R-3 TLP:RED -> team BLOCK
R-4 TLP:CLEAR -> public ALLOW
R-5 TLP:PURPLE -> team BLOCK unknown label

27.2 Reading the gate

GREEN to the public is blocked; AMBER to the organisation is allowed; RED to a team is blocked because only named recipients qualify; CLEAR to the public is allowed; an unknown label, TLP:PURPLE, is blocked. The lab simplifies audiences into categories; production rules also check recipient identity.

Those checks matter for RED in particular. A category such as team would let anyone in the team through, while the label allows only the people named. Kofi's production gate looks up the recipient list stored with each RED report and compares it with the person requesting access.

27.3 Fail closed

Unknown or missing labels must block, not allow. A typo in a label should never publish restricted content.

The lab shows this with the invented label, which the gate blocks rather than treating as permissive. Kofi's gate also blocks objects with no label at all, objects whose label has extra spaces and objects with two conflicting labels. Each block writes a reason, so the analyst who hit it can ask the source to correct the label. Allowing on error would turn every data-quality problem into a possible leak, which is the worst way for the gate to fail.

27.4 Approval gates

Pushes to OT firewalls, sharing beyond the community and deleting indicators are high-impact. Each requires a named approver, and the approval is recorded with the object version.

Kofi's approval service shows the approver exactly what will change: the rules to be added or removed, the source of each and the segments affected. Approvers cannot approve their own requests. If the object changes after approval, the approval no longer applies and must be given again, which closes the gap between what was reviewed and what was sent.

27.5 Audit

Every allow and block decision is logged with requester, label, audience and time. Auditors and partners can then verify that agreements were honoured.

Kofi tested the log by asking a colleague to pick ten past decisions at random and trace each one back to the request and the label. All ten could be traced. The log is kept in a store analysts cannot edit, and its retention follows the longest sharing agreement, so a partner's question about how their material was handled can be answered for as long as the material was kept.

Training the humans

Kofi runs a short session for analysts showing the gate's decisions on real-looking synthetic examples. When people understand why GREEN cannot reach the public blog, they ask partners for publishable summaries instead of hunting for workarounds.

Worked example

An analyst tries to post a GREEN partner bulletin to BEN's public blog. The gate blocks it; the analyst asks the partner for permission to publish a CLEAR summary instead, which the partner provides in writing.

Synthetic case. The bulletin and request are invented.

Errors and limits

Labels describe sharing limits, not classification levels in a government sense. Gates cannot stop someone retyping content; training and culture still matter.

Exercises

Synthesis

Encode TLP as a gate, fail closed, require approval for high-impact actions and log every decision.

Continue studying — chapter 27 of 50

← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →