- [Instructor] In this segment,
we're gonna take a closer look
at how to design a threat intelligence program
and the associated workflow.
You know, almost every organization I work with
says, yes, threat intelligence is really important
and yet they treat it like it's not.
Threat intelligence programs are often very disorganized,
they're disjointed, they're decentralized,
or worse, just totally ad hoc.
So what do I mean by ad hoc?
Well, ad hoc describes a situation
where everyone is acting on their own,
determining what sources that they wanna use,
how often to review it, how to analyze, and when to act.
This isolated approach is fraught with danger,
it's inconsistent, and it's very duplicative.
And there is a better way.
First, an organization needs to clearly define
the types of threat intelligence they want and the sources.
And one of the best ways to start that planning discussion
is to bring together a cross section of personnel
Be they InfoSec, IT, HR, accounting, fraud,
risk management, physical security, legal and compliance.
And let's find out, what are they using?
What feeds do they subscribe to?
what bulletins do they receive?
What information sharing organizations
are they part of, solicited and unsolicited?
And then make a master list.
And often what you're going to find
is they're duplicated and triplicates,
and then you're gonna rate the usefulness.
And really importantly, identify what might be missing.
Next, you wanna assign a threat intelligence librarian.
Now this sounds like an expensive proposition, but it's not.
This is really a cost savings
even for the smallest of companies.
Instead of having multiple people
spending time on collection,
consolidate the effort.
Generally, this turns into about an hour or so a day.
The librarian will collect the intelligence
and they'll store the intelligence
in a central location that's accessible
to all interested parties.
Now the librarian should also be responsible
for disseminating the information to the right people.
Now, who are the right people?
Well, you'll figure that out
as part of your planning process.
Analysis can be centralized or decentralized
based on the size and structure of the organization.
And of course, any action that's taken
should definitely, definitely be documented
and shared with others
so everyone who needs to be kept in the loop is in the loop.
If you follow this workflow,
you will have a really well-formed,
well-organized threat intelligence program.
And that my friends, is a closer look.