◇ OpenCyber Academy
Postgraduate · Chapter 8 · English

Chapter 8 — Threat intelligence and OSINT: difficult cases

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Threat intelligence and OSINT: difficult cases

Lesson map

Lesson 08 published. Map, example, EX036.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Attribution pressure"]
  N2["8.2 Insider cases"]
  N3["8.3 Public claims of breach"]
  N4["8.4 Crisis tempo"]
  N5["8.5 Partner sensitivity"]
  N6["8.6 Wellbeing"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX036"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Attribution pressure"]
  N2["8.2 Insider cases"]
  N3["8.3 Public claims of breach"]
  N4["8.4 Crisis tempo"]
  N5["8.5 Partner sensitivity"]
  N6["8.6 Wellbeing"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX036"]

[Learning outcomes]
    |
    v
[8.1 Attribution pressure]
    |
    v
[8.2 Insider cases]
    |
    v
[8.3 Public claims of breach]
    |
    v
[8.4 Crisis tempo]
    |
    v
[8.5 Partner sensitivity]
    |
    v
[8.6 Wellbeing]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX036]

Learning outcomes

You will (1) handle attribution pressure; (2) manage intelligence about insiders; (3) respond to unverified public claims of breach; (4) work under incomplete information during crises.

8.1 Attribution pressure

Executives and media want a name. For most defensive decisions, the techniques and infrastructure matter more than the identity. When attribution is offered, state the evidence, alternatives and confidence; distinguish "activity cluster resembling public reporting on a group" from "the group did it". The Diamond Model separates adversary from capability and infrastructure precisely because those can be shared or sold. At NLG, leadership wanted a name for the extortion group, but the decisions in front of them concerned supplier access and segmentation, not identity. Rafael's report described the activity, compared it with public reporting at stated confidence, and focused on techniques NLG could defend against. Naming a group would not have changed those decisions, and a wrong name could have misled them.

8.2 Insider cases

Intelligence suggesting an insider must go to human resources and legal under a defined procedure. CTI analysts should not monitor colleagues informally; it may be unlawful and undermines trust. Keep such material on a strict need-to-know basis. At NLG, the ACH matrix kept insider misuse as a hypothesis, but Rafael did not investigate colleagues himself. Evidence relevant to an insider would go to human resources and legal under the defined procedure, and only those with a need to know would see it. This protects any formal investigation and keeps staff trust in the CTI team intact.

8.3 Public claims of breach

A leak-site post claims NLG data. Steps: preserve the claim passively (screenshot from a safe, approved environment or through a contracted provider), assess plausibility from any sample against internal records, inform incident response and legal, and avoid public comment. Do not download large "samples" onto corporate systems without legal advice. When a leak site claimed 200 GB of NLG customs data, the contracted provider retrieved the listing, and the file names matched a decommissioned test environment. Rafael's update gave moderate confidence and said incident response was verifying. Legal handled any notifications, and nobody at NLG commented publicly while the claim was being checked.

8.4 Crisis tempo

During incidents, analysts publish short updates with explicit confidence and time stamps, superseding earlier ones clearly. Wrong early statements are normal; unmarked corrections are not. During the leak-site claim, Rafael's updates each carried a time and confidence level, and later updates said clearly which earlier statement they replaced. Short updates kept leadership informed without waiting for a full assessment. If an early update turns out wrong, the correction states what changed and why.

Each update is stored in order in the incident record, so the sequence of statements can be reviewed afterwards against what was later confirmed.

8.5 Partner sensitivity

If the compromise came through a supplier, coordinate disclosure through FPSC and contracts rather than naming them publicly. Naming a supplier publicly before facts are confirmed could damage a relationship NLG depends on and expose the supplier to unfair blame. Contracts set out how incidents are reported between the parties, and FPSC gives a trusted channel for warning other members. Rafael coordinates with legal on any disclosure, including what FPSC members are told and when.

Supplier names appear only in AMBER+STRICT material until the supplier and legal agree otherwise.

8.6 Wellbeing

Difficult cases are stressful. Rotate on-call duties and debrief afterwards; tired analysts make worse judgments. NLG's CTI team is small, so a long incident can fall on one or two people. Rafael rotates on-call duties, ends each difficult case with a short debrief and makes sure analysts take time off after intense periods. He treats this as part of quality, since tired analysts misjudge evidence.

After the leak-site claim, the debrief covered what went well and what the team would change, and Rafael gave the two analysts on call a day off in lieu.

Worked example

A leak site claims 200 GB of NLG customs data. A contracted provider retrieves the listing. The published file names match an old test environment decommissioned last year. Rafael's update: "Claim likely relates to a legacy test system (moderate confidence); no evidence yet of production data exposure; incident response is verifying." Legal handles notifications.

Synthetic case. The claim and data are invented.

Errors and limits

Absence of evidence early in a crisis is weak; keep assessments provisional.

Exercises

Synthesis

Resist premature attribution, route insider matters properly, assess leak claims carefully and correct openly in crises.

Continue studying — chapter 08 of 12

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →