超越信息流：设计对企业真正重要的 CTI 项目.pdf

1、Beyond the Feed:Designing a CTI Program That Matters to the Business Arun WarikooHead of Cyber Threat Intelligence-CIB Americas,BNP ParibasSydney JonesHead of Cyber Threat Management,CLS-GroupAgenda1.Requirements-Driven Threat Intela)Stakeholder Analysis&Use Casesb)Mapping Use Cases to Intel Require

2、mentsc)Collection Management2.Use Casesa)Threat Informed Cyber Defenseb)Vulnerability Intelligencec)3rd Party Intelligence3.Key TakeawaysWHAT WHAT IS THREAT INTELLIGENCE ANYWAY?IS THREAT INTELLIGENCE ANYWAY?AnalysisProcessingCollectionProvide timely and actionable intelligence on the current and the

3、 evolving cyber threat landscape to support stakeholders in making informed and data driven decisions.Threat intelligence is the process of collecting,analyzing,and sharing information about potential cyber threats to help organizations proactively detect,mitigate,and prevent cyberattacks.It involve

4、s understanding threat actors,their motives,attack methods,and vulnerabilities to enhance an organizations security posture.What is Threat IntelligenceBenefitsShifts organizations from a reactive to a proactive stance in defending against cyber threats.Actionable insights,enable security teams to ma

5、ke informed,data-driven decisionsInstrumental in improving security outcomes,and reducing an organizations attack surfaceDrilling down from all the data availableWHERE DO YOU START?WHERE DO YOU START?START HEREunderstanding on who will consume and benefit from the finished product Prioritize based o

6、n what matters to the business and your organizations security objectivesDefine goals and objectives of the intelligence program1Identify your stakeholders2Translate stakeholder use cases into Intel Requirements3creates structure and purpose for an organizations overall intelligence mission.IRs driv