◇ OpenCyber Academy
Postgraduate · Chapter 5 · English

Chapter 5 — Threat intelligence and OSINT: design alternatives

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Threat intelligence and OSINT: design alternatives

Lesson map

Lesson 05 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Organisational models"]
  N2["5.2 Platform options"]
  N3["5.3 Data model"]
  N4["5.4 Protocols"]
  N5["5.5 Design rationale"]
  N6["5.6 Reversibility"]
  N7["Staffing the design"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Organisational models"]
  N2["5.2 Platform options"]
  N3["5.3 Data model"]
  N4["5.4 Protocols"]
  N5["5.5 Design rationale"]
  N6["5.6 Reversibility"]
  N7["Staffing the design"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]

[Learning outcomes]
    |
    v
[5.1 Organisational models]
    |
    v
[5.2 Platform options]
    |
    v
[5.3 Data model]
    |
    v
[5.4 Protocols]
    |
    v
[5.5 Design rationale]
    |
    v
[5.6 Reversibility]
    |
    v
[Staffing the design]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) compare centralised, embedded and outsourced CTI models; (2) evaluate platform options; (3) choose data models and sharing protocols; (4) document design rationale.

5.1 Organisational models

A centralised team serves everyone from one place and keeps standards consistent but can drift from operational needs. Embedded analysts sit in the security operations centre or risk team and stay close to consumers but may lose common method. Outsourced intelligence brings scale but limited business context. Hybrids are common. NLG chooses a hybrid: a small central CTI function with one analyst embedded in the security operations centre two days a week. The central function keeps method and requirements consistent, while the embedded analyst learns what detection engineers need.

5.2 Platform options

Options range from spreadsheets and a shared mailbox, through open-source threat intelligence platforms, to commercial platforms. Criteria: STIX 2.1 support, TAXII 2.1 client and server, TLP enforcement, integration with detection tools, cost and maintainability. Rafael scores three options against these criteria, with the CTI analyst and an operations centre engineer. Spreadsheets fail on TLP enforcement and sharing; a commercial platform scores highest but costs four times the budget; an open-source platform with STIX and TAXII support scores well enough. He chooses the open-source option and records the scores and reasons in a decision record.

5.3 Data model

Using STIX 2.1 internally keeps sharing simple: indicators, attack patterns, relationships and reports map directly to community exchange. Custom fields should use STIX extensions rather than ad hoc columns. At NLG, storing data in STIX means indicators received from FPSC keep their structure and relationships, and NLG's own reports can be shared back without conversion. It also makes migration to another platform feasible later, which was one reason Rafael accepted an open-source platform. Custom fields, such as a link to NLG's asset inventory, use STIX extensions.

5.4 Protocols

TAXII 2.1 collections let NLG pull from FPSC and publish to it. Email remains necessary for human-readable products, and must carry TLP labels in the subject and body as TLP 2.0 recommends. NLG pulls FPSC collections automatically and publishes sanitised indicators back when it has something useful to share. Human-readable products, such as the monthly leadership brief, go by email with TLP labels in both subject and body. Rafael checks that the platform applies labels consistently, since a missing label is one way restricted material leaks.

5.5 Design rationale

Record options, criteria, scores and the reason for the choice. Future leaders can revisit decisions when conditions change. Rafael's platform decision record lists the three options, the criteria, scores and the reason for choosing the open-source platform. It also notes the conditions that would reopen the decision, such as a large budget increase or the platform failing to keep up with STIX releases. His successor can then revisit the choice without repeating the analysis.

The record sits in the platform beside the requirements that motivated the choice, so anyone reviewing the platform can find it.

5.6 Reversibility

Prefer designs that can be changed cheaply. A standards-based data model allows platform replacement later; proprietary formats lock data in. Choosing STIX for NLG's data means the platform can be replaced without losing years of intelligence or rebuilding relationships between objects. Rafael also avoids custom integrations that only work with one product. Reversibility made the cheaper open-source platform an acceptable risk, since a later move to a commercial product would not strand data.

Rafael checks reversibility again before agreeing any integration that would tie the operations centre's tools to the platform.

Staffing the design

A design needs people to run it. Two analysts can support one community relationship, internal incident review and a modest platform; adding hunting or a public research blog would need more. Match ambition to headcount explicitly in the design document.

Worked example

Rafael scores three options. Spreadsheets fail on TLP enforcement and sharing. A commercial platform scores highest on features but costs four times the budget. An open-source platform with STIX and TAXII support scores well enough, and because data is stored in STIX, migrating later is feasible. He chooses it, embedding one analyst in the security operations centre two days a week.

Synthetic case. The scores and options are invented.

Errors and limits

Open-source platforms need maintenance skills; count staff time as cost.

Exercises

Synthesis

Choose organisational and technical designs against explicit criteria, favour standards and reversibility, and record rationale.

Continue studying — chapter 05 of 12

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →