Chapter 1 — Threat intelligence and OSINT: foundations and decisions
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 What CTI is"]
N2["1.2 Decisions first"]
N3["1.3 Threats to charities"]
N4["1.4 Vocabulary"]
N5["1.5 The cycle in one page"]
N6["1.6 Realistic scope"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 What CTI is"]
N2["1.2 Decisions first"]
N3["1.3 Threats to charities"]
N4["1.4 Vocabulary"]
N5["1.5 The cycle in one page"]
N6["1.6 Realistic scope"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 What CTI is]
|
v
[1.2 Decisions first]
|
v
[1.3 Threats to charities]
|
v
[1.4 Vocabulary]
|
v
[1.5 The cycle in one page]
|
v
[1.6 Realistic scope]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain what cyber threat intelligence is and is not; (2) connect intelligence to small-organisation decisions; (3) recognise the main threats to charities; (4) use the core vocabulary — ATT&CK, the kill chain, the Diamond Model, STIX, TAXII and TLP — at a beginner level.
1.1 What CTI is
Cyber threat intelligence is information about threats that has been checked, interpreted and connected to a decision. A list of bad websites is information; "fraudsters are sending fake donation receipts to our volunteers this week, so we will warn them and block two domains" is intelligence. OSINT — open-source intelligence — is intelligence built from publicly available sources, collected lawfully and ethically.
Sam Okafor treats CCC alerts as intelligence only after he ties them to an EFBN decision — two-step login, a volunteer warning, or a payment hold. A raw URL list without that link stays in the inbox as unread noise.
1.2 Decisions first
Sam's charity has no security team. Its decisions are simple but real: should we turn on two-step login for the donation account? Do we warn volunteers about a scam? Should we pay for a backup service? Intelligence is useful only if it helps answer such questions.
Each trustee question is binary and owned: enable MFA on the donation account this week, or accept the risk in writing. Sam will not collect more OSINT until the decision owner is named, and a named owner with a date turns donation MFA or a volunteer warning into a decision that can be tracked rather than a hallway wish forgotten by Friday.
1.3 Threats to charities
Public sector advisories describe charities facing donation fraud through lookalike websites, phishing for volunteers' email passwords, business email compromise targeting payments to suppliers, and ransomware. Small charities are attractive because they have money flows but little security staff.
Lookalike donation pages, volunteer phishing and payment BEC are the three EFBN-relevant patterns Sam tracks; nation-state malware analysis is out of month-one scope. He keeps a one-line example of each pattern in the log so deputies recognise the next CCC alert without calling him.
1.4 Vocabulary
MITRE ATT&CK catalogues adversary techniques with identifiers — Phishing is T1566; Valid Accounts, using stolen passwords, is T1078. The intrusion kill chain (Hutchins, Cloppert and Amin) breaks an attack into phases so defenders see where to interrupt it. The Diamond Model (Caltagirone, Pendergast and Betz) describes an event by adversary, capability, infrastructure and victim. STIX 2.1 is a format for intelligence data; TAXII 2.1 is a way to exchange it. FIRST TLP 2.0 labels — CLEAR, GREEN, AMBER, AMBER+STRICT, RED — tell you how widely you may share.
1.5 The cycle in one page
Decide what you need to know, collect from a few trusted sources, check and clean, think about what it means for you, tell the people who act, and ask whether it helped.
The one-page cycle — need, collect, check, think, tell, review — hangs above Sam's desk. Friday feedback to CCC closes the loop whether or not anything matched, and the Friday review asks whether last week's warning changed volunteer behaviour. Empty review notes mean the cycle is theatre and the poster is decoration.
1.6 Realistic scope
In one month Sam can join CCC, read alerts weekly, warn volunteers, set two-step login on key accounts and keep a simple log. He will not analyse malware or attribute attacks; attribution and malware reverse engineering wait for later courses.
The scope poster lists those five deliverables and the two non-goals, so trustees do not expect malware write-ups or attribution reports in week four that a one-month volunteer programme cannot deliver. The same list is the yardstick for the month's synthesis in Chapter 4.
Worked example
CCC sends a TLP:GREEN alert: lookalike donation pages imitating food banks. Sam's decision: warn volunteers and add a notice to the real donation page. He writes three lines: what is happening, why it matters to EFBN, and what volunteers should do — check the address bar and use only the link on the official website.
Synthetic case. EFBN and the alert are invented.
Errors and limits
Small organisations cannot follow every threat; choose a few that match your decisions.
Exercises
- EX001 — Information or intelligence. Is "a list of 200 bad websites" information or intelligence? Explain. Rubric: 3 = information; not assessed or tied to decision; 2 = label only; 1 = intelligence; 0 = none.
- EX002 — Define OSINT. Define OSINT in one sentence including the legal condition. Rubric: 3 = public sources, collected lawfully/ethically; 2 = public only; 1 = any data; 0 = none.
- EX003 — Charity decision. Name one decision at EFBN that intelligence could inform. Rubric: 3 = specific decision with link to threat; 2 = decision; 1 = vague; 0 = none.
- EX004 — Sector threats. List three threats charities commonly face. Rubric: 3 = three of lookalike donation fraud, phishing, BEC, ransomware; 2 = two; 1 = one; 0 = none.
- EX005 — Technique ID. What is the ATT&CK identifier for Phishing? Rubric: 3 = T1566; 2 = close; 1 = wrong; 0 = none.
- EX006 — Stolen passwords. Which ATT&CK technique describes logging in with stolen passwords? Rubric: 3 = Valid Accounts T1078; 2 = name; 1 = T1566; 0 = none.
- EX007 — Kill chain purpose. Why is the kill chain useful to defenders? Rubric: 3 = shows phases where attack can be interrupted; 2 = partial; 1 = attribution; 0 = none.
- EX008 — Diamond parts. Name the four parts of the Diamond Model. Rubric: 3 = adversary, capability, infrastructure, victim; 2 = three; 1 = one; 0 = none.
- EX009 — Format and exchange. Which standard is a data format and which an exchange method? Rubric: 3 = STIX format; TAXII exchange; 2 = one; 1 = swapped; 0 = none.
- EX010 — TLP five. List the five TLP 2.0 labels. Rubric: 3 = CLEAR, GREEN, AMBER, AMBER+STRICT, RED; 2 = four; 1 = two; 0 = none.
- EX011 — Cycle steps. Put the intelligence cycle in six short steps. Rubric: 3 = direction, collection, processing, analysis, dissemination, feedback; 2 = four; 1 = two; 0 = none.
- EX012 — Out of reach. Name two tasks outside Sam's one-month scope. Rubric: 3 = malware analysis, attribution; 2 = one; 1 = warning volunteers; 0 = none.
- EX013 — Three-line warning. Write the three-line volunteer warning for the lookalike alert. Rubric: 3 = what, why it matters, what to do; 2 = two; 1 = one; 0 = none.
Synthesis
CTI is checked information tied to decisions; learn the vocabulary, stay within realistic scope and act on a few relevant threats.