OpenCyber Academy
Professional · Chapter 2 · English
Course code: OCA-041Chapter 02: OCA-041-C002

Chapter 2 — Threat intelligence and OSINT: service and stakeholder context

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Consumers"]
  N2["2.2 Requirements"]
  N3["2.3 Products"]
  N4["2.4 Expectations"]
  N5["2.5 Business email compromise"]
  N6["2.6 Feedback"]
  N7["2.7 Saying no"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Consumers"]
  N2["2.2 Requirements"]
  N3["2.3 Products"]
  N4["2.4 Expectations"]
  N5["2.5 Business email compromise"]
  N6["2.6 Feedback"]
  N7["2.7 Saying no"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 Consumers]
    |
    v
[2.2 Requirements]
    |
    v
[2.3 Products]
    |
    v
[2.4 Expectations]
    |
    v
[2.5 Business email compromise]
    |
    v
[2.6 Feedback]
    |
    v
[2.7 Saying no]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) identify BIB's intelligence consumers and their decisions; (2) write priority intelligence requirements; (3) match products to consumers; (4) manage expectations.

2.1 Consumers

The managing director decides budgets. The operations manager decides on process changes such as payment verification. The IT team configures email and network controls. The help desk talks to staff. The compliance officer handles regulators and data protection. Each consumer needs different evidence for the decision they own. The managing director will fund a control only if she sees its cost against the risk; the operations manager needs to know which fraud method is active before changing payment steps. IT needs domains, software versions and dates it can turn into blocks and patches. The help desk needs one example of each current scam, written in plain words.

2.2 Requirements

Priya interviews each and writes requirements: "Which fraud methods target brokers' payment processes this quarter?" (operations); "Which vulnerabilities in our CRM and portal are being exploited?" (IT); "Are BIB credentials or client data exposed publicly?" (compliance). Each requirement is written as a question that one consumer can act on within a set period. That wording lets Priya test every FSSG item against the list on Monday morning. An item about manufacturing ransomware answers none of the three questions, which is why Q2 in the scoring lab is logged only. The list is reviewed every quarter with the consumers who own each question.

2.3 Products

Managing director: quarterly half-page. Operations: alerts when a fraud method appears. IT: indicator lists and vulnerability notes. Help desk: weekly scam update. Compliance: notices of data exposure. Products differ in length and timing as much as content. The managing director's half-page arrives each quarter, while an operations alert goes out the same day a new fraud method appears. IT's indicator lists carry domains and dates ready to block, and the help desk's update carries one example per scam, not indicators. Compliance hears from Priya only when BIB credentials or client data are found exposed publicly.

2.4 Expectations

Priya explains that CTI reduces surprise but cannot predict every attack. She agrees what "urgent" means: active exploitation of a system BIB runs, or a fraud method targeting BIB by name. Writing the definition down protects both Priya and her consumers. Without it, every alarming FSSG headline could become a phone call, and real urgent items would lose their force. With it, the CRM exploitation report in Chapter 6 clearly qualifies, because BIB runs that version. A ransomware wave against manufacturers, however serious elsewhere, waits for the normal Monday routine.

2.5 Business email compromise

Fraudsters impersonate clients or insurers to redirect payments. The operations manager's decision — whether to require call-back verification for changed bank details — depends on intelligence about how common this is in the sector. For the operations manager, the decision weighs a cost to every payment change against a risk. Call-back verification adds work to every bank-detail change, so the operations manager wants evidence that the fraud is common enough to justify it. FSSG's report of three brokers losing client premiums supplies that evidence, and the manager introduces the call-back step the same week. Chapter 8 later shows what happens when it is skipped.

2.6 Feedback

Each consumer gets a two-question form quarterly. The two questions are short on purpose: 'What helped you decide something this quarter?' and 'What could we stop sending?'. Short forms get answered, while long surveys sit in inboxes. The answers feed the quarterly requirements review, and later they lead to the help desk's request that moved scam updates from Wednesday to Monday, recorded in the improvement log in Chapter 10. Priya keeps the completed forms with the requirements list, so each review can see which consumer asked for which change and why.

2.7 Saying no

Requests outside requirements, such as researching a difficult client's personal life, are declined politely. Priya declines by pointing to the approved requirements list, which avoids a personal argument with the requester. Researching a client's private life serves no BIB decision, intrudes on that person's privacy and would expose BIB if it became known. If a consumer believes a new need is genuine, Priya invites them to raise it at the quarterly requirements review instead. The refusal and its reason go into her log, which protects her if the request is repeated later by someone more senior.

2.8 Writing it down

A one-page requirements list, approved by the manager, guides what Priya collects. The single page lists each requirement, its consumer, the product that answers it and how often. Because her manager approved it, Priya can point to it when she declines a request or drops a low-scored item. The list also tells the IT manager what to collect when he covers her routine, so absence does not change the role's direction. Without the written list, collection would follow whatever looked interesting each Monday rather than what BIB's consumers decide.

Regulatory context

Financial regulators expect firms to manage operational and cyber risk. Showing that intelligence informed controls — such as call-back verification — helps the compliance officer evidence good practice during reviews.

Worked example

FSSG reports that three brokers lost client premiums through fake insurer bank-detail changes. Priya alerts the operations manager with the method and two sender domains. The manager introduces call-back verification for any bank-detail change the same week.

Synthetic case. The losses and change are invented.

Errors and limits

Requirements change; review them every quarter.

Exercises

Synthesis

Know your consumers, write requirements with them, match products to decisions and manage expectations.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →

Worked answers

EX006. The managing director sets budgets; the operations manager sets payment processes; the IT team configures controls.

EX007. "Each month, for the compliance officer, are any BIB staff credentials or client records being offered or published on public sites?"

EX008. Introducing call-back verification before acting on any change to bank details.

EX009. Active exploitation of a system BIB runs, or a fraud method that targets BIB by name.

EX010. It is outside CTI's requirements and would intrude on the client's privacy without lawful purpose.