Chapter 1 — Security foundations for practitioners
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Starting point"]
N2["1.2 Core terms"]
N3["1.3 The cycle as a routine"]
N4["1.4 Models"]
N5["1.5 Standards"]
N6["1.6 Realistic goals"]
N7["1.7 What brokers face"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Starting point"]
N2["1.2 Core terms"]
N3["1.3 The cycle as a routine"]
N4["1.4 Models"]
N5["1.5 Standards"]
N6["1.6 Realistic goals"]
N7["1.7 What brokers face"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Starting point]
|
v
[1.2 Core terms]
|
v
[1.3 The cycle as a routine]
|
v
[1.4 Models]
|
v
[1.5 Standards]
|
v
[1.6 Realistic goals]
|
v
[1.7 What brokers face]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) restate core security concepts in a CTI context; (2) describe the intelligence cycle as a working routine; (3) name the main models and standards; (4) set realistic goals for a part-time CTI role.
1.1 Starting point
Priya has run IT support at Bramwell Insurance Brokers for eight years. She knows the systems, the users and the help desk. Her manager adds CTI to her role: one day a week to turn outside information about threats into better defences. Those eight years matter for CTI work, because Priya already knows which systems hold client data and who owns the CRM, the portal and broker email. What she lacks is a habit of reading outside reports and asking what they mean for BIB. The single weekly day is a hard limit, so every routine in the following chapters is sized to fit it.
1.2 Core terms
Threat: an actor or event that could cause harm. Vulnerability: a weakness. Risk: likelihood combined with impact. Control: a measure that reduces risk. Intelligence informs the threat side so controls are chosen well. At BIB each of these four terms maps onto something Priya can point to. A fraudster sending fake insurer bank details is a threat, and finance staff paying without a check is the vulnerability. The risk is a lost client premium, and call-back verification is the control. Priya's FSSG reading changes the likelihood side of that risk by showing how often brokers are being targeted this quarter.
1.3 The cycle as a routine
Direction (what does BIB need to know?), collection (FSSG, advisories, internal reports), processing (cleaning indicators), analysis (what it means for BIB), dissemination (to whoever acts) and feedback. For Priya it becomes a weekly checklist. Each stage of the cycle has a day or a recurring date attached to it. Direction is the requirements list her manager approves; collection is Monday's FSSG reading; processing and log matching happen on Tuesday; dissemination is the Wednesday help-desk update and the monthly summary. Feedback comes from the quarterly consumer forms and the monthly note to FSSG, and it changes the requirements for the next quarter.
1.4 Models
MITRE ATT&CK names adversary techniques — Phishing is T1566. The Hutchins et al. kill chain shows phases where defenders can act. The Diamond Model describes events by adversary, capability, infrastructure and victim. Priya uses each of the three models to answer a different question about an event. ATT&CK gives her the technique names she tags on FSSG items and later in the fraud case. The kill chain shows where BIB could have stopped an intrusion, which matters when there was no exploitation at all. The Diamond Model lets her describe the lookalike-domain fraud without needing to know who the adversary is.
1.5 Standards
STIX 2.1 for data, TAXII 2.1 for exchange, FIRST TLP 2.0 for sharing limits, NIST SP 800-150 for sharing practice. For Priya the four standards are practical tools she meets every week, not theory. FSSG may deliver items as STIX objects over TAXII, but she mostly reads their summaries and copies indicators into tickets. The TLP label on each item decides whether she may forward it to the help desk, to clients or nobody at all. NIST SP 800-150 shapes how BIB shares sanitised items back to the community.
1.6 Realistic goals
In one day a week Priya can triage FSSG items, match indicators against email and DNS logs, brief the help desk and report monthly. Deep malware analysis and attribution are out of scope. These limits are written down because a part-time role can easily drift into work that cannot be finished well. If FSSG reports a malware family, Priya takes the indicators and the advice and leaves reverse-engineering to the vendor or an external responder. Attribution to a named group would not change any BIB decision, so it stays outside her scope.
1.7 What brokers face
Insurance brokers hold personal and financial client data and move money. Business email compromise, credential phishing against the client portal and ransomware are the main concerns reported in the sector. Those three concerns set the shape of the year that follows. Business email compromise leads to the call-back control and the fraud case in Chapter 8. Credential phishing against the portal leads to the MFA pilot and the failed-login analysis. Ransomware remains a concern Priya tracks through advisories, but no BIB incident of that kind appears in the case.
1.8 Learning plan
Each chapter adds one routine to her week, so the role grows steadily. Chapter 2 adds the requirements list, Chapter 5 the Monday scoring, Chapter 6 the ticket for every item, and Chapter 7 the control register. By Chapter 11 she runs a pre-release check on every brief. The order matters, because each routine depends on the one before it: scoring needs requirements, and tickets need the scores to record. By the portfolio review in Chapter 12, the routines together have produced twelve control changes traced to intelligence, which is the measure of whether this gradual approach worked.
Worked example
Priya's first weekly checklist: Monday, read FSSG items and triage; Tuesday morning, search logs for this week's indicators; Wednesday, send the help desk a short scam update; last Friday of the month, write a one-page summary for her manager.
Synthetic case. BIB and Priya are invented.
Errors and limits
A part-time role cannot cover everything; agree priorities in writing.
Exercises
- EX001 — Define risk. Define risk and explain how CTI contributes to it. Rubric: 3 = likelihood × impact; CTI informs threat/likelihood; 2 = definition; 1 = vague; 0 = none.
- EX002 — Weekly routine. Turn the intelligence cycle into a weekly routine for a part-time role. Rubric: 3 = all stages mapped to days/tasks; 2 = most; 1 = list; 0 = none.
- EX003 — Out of scope. Name two tasks outside Priya's realistic scope. Rubric: 3 = malware analysis, attribution; 2 = one; 1 = log search; 0 = none.
- EX004 — Broker threats. List three threats brokers commonly face. Rubric: 3 = BEC, portal credential phishing, ransomware; 2 = two; 1 = one; 0 = none.
- EX005 — Model purpose. Match ATT&CK, the kill chain and the Diamond Model to what each describes. Rubric: 3 = techniques; phases; event vertices; 2 = two; 1 = one; 0 = none.
Synthesis
CTI informs risk decisions through a steady cycle, shaped by models and standards and sized to the time available.