从不知所措到产生影响：优先级矩阵.pdf

1、From Overwhelm to ImpactA Prioritization FrameworkTRANGERTHREATSSThe Intelligence of Stranger ThingsAnalyze data and past events to assess the likelihood of future eventsIdentify patterns and changes from various data sources-like electrical signalsCommunicate findings to stakeholders in a format th

2、at is appropriate for their audienceHawkins Resident:Alex Berninger-Sr Manager of Intel at Red Canary-17 years of experience in the intelligence field-MA-Security Policy Studies-My dogs names are Kylo and Kenobi.I like themesAgenda-What are intelligence requirements?-Why are intel reqs hard to do fr

3、om a vendor space?-Prioritization framework is a solution-Lessons learned and next stepsCHAPTER ONEINTELLIGENCE REQUIREMENTSIntelligence requirementsWhat are we trying to achieve?Prioritized topics or questions that guide the collection of data to produce finished intelligence that informs decision

4、makingThe ability to focus attention on important things is a defining characteristic of intelligence.”“Intel requirements focus attentionIntel requirements fit into the Planning and Direction part of the intelligence lifecycleDifferent names all trying to achieve the same thing:Intelligence require

5、mentsPriority Intelligence Requirements(PIR)Threat profiling/modelingPlanning CollectioProcessinAnalysis DisseminatiFeedbac123456But how do we identify the“important things”?There is ample research on how to do this for one organization:1.Understand your organization:network and tech stacks,unique a

6、ssets,and stakeholder concerns2.Build intelligence requirements that will address stakeholder concerns3.Identify the threats that are most likely to target your organization4.Provide actionable intelligence to enable decision makers to protect against those threatsDeveloping intel requirements Ident