Spin Your CTI Process Round - FIRST CTI Conference 2023
Title: Spin Your CTI Process Round Short Bio:Andreas Sfakianakis is a Cyber Threat Intelligence professional with over fifteen years of experience in cyber security. He focuses on applying threat intelligence and helping organizations manage threats mostly within the Energy, Technology, and Financial sectors as well as in European Union’s Agencies and Institutions. Andreas has been contributing to the CTI community since 2012 via public reports and presentations, his blog, newsletter, and instructing. His utmost goals are the maturing of threat management programs within organizations as well as the embedding CTI in policy making. Andreas Twitter handle is @asfakian and his website is threatintel.eu. Abstract: Is your CTI team struggling to operationalize the CTI process? Don't worry, your team is not the only one! During the "CTI journey", CTI teams try out approaches and tools, hoping to give value to their organization. This is usually a trial and error process, and when not successful, it costs money and time for organizations and also demotivates CTI analysts. This presentation will discuss some of the basic "baby" steps that CTI teams often neglect. We will be focusing on case management and intelligence workflows. Moreover, we will elaborate on how you can take advantage of the knowledge produced by the CTI team and provide meaningful metrics to the CTI team and the management. Finally, we elaborate on the essential ingredients for CTI teams in the early phases of their "CTI journey". The key takeaway for the audience is the realization of some basic steps that a CTI team has to take to coordinate its workload better, build workflows, and better manage the CTI knowledge it produces. The audience will also be presented with real-world examples and implementations within corporate environments of such approaches. Ideally, we will give you some hints to spin your CTI process round!
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Spin Your CTI Process Round - FIRST CTI Conference 2023
Similar to Spin Your CTI Process Round - FIRST CTI Conference 2023 (20)
Recently uploaded
Recently uploaded (20)
Spin Your CTI Process Round - FIRST CTI Conference 2023
- 1. FIRST CTI Symposium 2023 8 November 2023 Andreas Sfakianakis CTI Professional
- 2. #ctijourney
- 4. § CTI in Financial, Energy, and Technology sectors § SANS, ENISA, FIRST.org, European Commission § Twitter: @asfakian Mastodon: @asfakian@infosec.exchange § Websites: www.threatintel.eu
- 6. Setting the scene Workflow & Case Management Basic Ingredients References used within this presentation: https://bit.ly/firstcti23
- 18. § Tagging § Custom fields § Easy searching and filtering § Source rating § Access control
- 20. § Threats per criticality/impact level § Time spent per PIR § CTI assessments per threat type/threat actor § CTI assessments (or time spent) supporting IR § Quantitative feedback received per PIR § Time spent on RFIs per stakeholder § #hunts / #incidents from CTI assessments
- 21. § Sources mostly used per PIR § CTI deliverables per PIR § CTI deliverables per stakeholder § Average time spent per CTI deliverable § CTI analysts’ workload § Average time spent in each phase of the workflow § Time spent on CTI projects
- 24. Remember § Data into buckets § Consistency is key § Spend time to save time
- 26. *SANS CTI Summit 2021
- 27. Some TIPs Recommendation is to live off the land (at least at the start of your CTI journey)
- 28. § Who you are / Contact Info § Team’s Scope § Intelligence Requirements § CTI Report Library / CTI Blog § Request For Information (RFI)
- 34. §Operationalizing the CTI process is a common challenge §The importance of workflow and case management §The basic ingredients