Intelligence Driven Security

The US Special Operations Forces pioneered a methodology called F3EAD, which enabled amongst other things the ability to take out insurgent and terrorist networks. This methodology focuses on 'Finding' the adversary, 'Fixing' their location, 'Finishing' their operational utility, and collecting the materials associated with the target. This material is then 'Exploited' or used to extract operational details of the network they are associated with, 'Analyzed' for intelligence which is useful to find other targets, and 'Disseminated' for other friendly forces to conduct operations. This class focuses on modifying the F3EAD methodology for utility in Cyber Defense Operations to allow cyber defenders to incorporate intelligence practices into their daily operations and focus not only on one off indicators but the overall threat factor. Intelligence enables cyber defense teams to look at the cyber battlefield from the 50,000-foot view and piece together all aspects of the cyber adversary's operations. From what altitude are you viewing the cyber battlefield?

In this class, you will learn the importance of Threat Intelligence, how to consume intelligence, and how to integrate it into your enterprise. This integration will focus on real time integration to allow threat intelligence to be processed at 'line speed'. Students will learn how to leverage intelligence for defense as well as investigative purposes. A key focus will be on identifying intelligence sources and exploiting them to extract intelligence. We will then explore how to enrich this intelligence and feed it into enterprise security solutions to enhance defensive postures. There will be technical hands-on activities exploring data visualization, forensic analysis, malware analysis, and dynamic memory analysis. Students will leave with a competence in identifying intelligence sources and incorporating them into automated solutions. This will include extensive hands-on work using numerous tools across several different disciplines. While not exhaustive or specifically deep in any one area, students will leave with an arsenal of tools and techniques to apply intelligence to enterprise defense.

SOC analysts who want to learn to use Cyber Threat Intelligence to make their actions more impactful against adversaries, anyone interested in reverse engineering for intelligence value, and managers who want a more technical understanding of what goes into the use of intelligence and analysis of that data.

A basic understanding of networking, computer hardware, and security concepts.

Trainer will provide materials on USB stick, this will include all tools covered in class, relevant documentation, and additional materials such as cheat sheets for the tools.