The document details the first CTI Symposium held on November 8, 2023, with a presentation by Andreas Sfakianakis that focuses on the challenges and strategies for Cyber Threat Intelligence (CTI) in financial, energy, and technology sectors. Key themes include the importance of workflow, case management, and various metrics for effective CTI processes. Recommendations for operationalizing CTI and managing intelligence requirements are also discussed.

1. FIRST CTI Symposium 2023
8 November 2023
Andreas Sfakianakis
CTI Professional

2. #ctijourney

3. Problem Statement

4. § CTI in Financial, Energy, and Technology sectors
§ SANS, ENISA, FIRST.org, European Commission
§ Twitter: @asfakian
Mastodon: @asfakian@infosec.exchange
§ Websites: www.threatintel.eu

6. Setting the scene Workflow & Case
Management
Basic Ingredients
References used within this presentation: https://bit.ly/firstcti23

7. Image from gatewaytotheclassics.com

9. Brian
Warehime

12. Image from bestofspain.es

16. Workflow, Coordination, and
Collaboration
Knowledge
Management
Metrics

18. § Tagging
§ Custom fields
§ Easy searching and filtering
§ Source rating
§ Access control

20. § Threats per criticality/impact level
§ Time spent per PIR
§ CTI assessments per threat type/threat actor
§ CTI assessments (or time spent) supporting IR
§ Quantitative feedback received per PIR
§ Time spent on RFIs per stakeholder
§ #hunts / #incidents from CTI assessments

21. § Sources mostly used per PIR
§ CTI deliverables per PIR
§ CTI deliverables per stakeholder
§ Average time spent per CTI deliverable
§ CTI analysts’ workload
§ Average time spent in each phase of the workflow
§ Time spent on CTI projects

23. Image from heritage-history.com

24. Remember
§ Data into buckets
§ Consistency is key
§ Spend time to save time

26. *SANS CTI Summit 2021

27. Some TIPs
Recommendation is to live off the land (at least at the start of your CTI journey)

28. § Who you are / Contact Info
§ Team’s Scope
§ Intelligence Requirements
§ CTI Report Library / CTI Blog
§ Request For Information (RFI)

33. Image from elladocomicodedonquijote.wordpress.com

34. §Operationalizing the CTI process is
a common challenge
§The importance of workflow and
case management
§The basic ingredients

35. https://bit.ly/firstcti23

36. Planning
Collection
Processing
Analysis
Dissemination
Feedback
Your CTI Process

37. Andreas Sfakianakis
@asfakian
threatintel.eu