Cyber threat intelligence
Cyber threat intelligence (CTI) is knowledge, skills and experience-based information concerning the occurrence and assessment of both cyber and physical threats and threat actors that is intended to help mitigate potential attacks and harmful events occurring in cyberspace. Cyber threat intelligence sources include open source intelligence, social media intelligence, human Intelligence, technical intelligence, device log files, forensically acquired data or intelligence from the internet traffic and data derived for the deep and dark web. Types. There are three overarching, but not categorical - classes of cyber threat intelligence: Benefits of Cyber Threat Intelligence. Cyber threat intelligence provides  a number of benefits, which include: Key elements. Cyber threat data or information with the following key elements are considered as cyber threat intelligence: Attribution. Cyber threats involve the use of computers, storage devices, software networks and cloud-based repositories. Prior to, during or after a cyber attack technical information about the information and operational technology, devices, network and computers between the attacker(s) and the victim(s) can be collected, stored and analyzed. However, identifying the person(s) behind an attack, their motivations, or the ultimate sponsor of the attack, - termed attribution is sometimes difficult. Recent efforts in threat intelligence emphasize understanding  adversary TTPs. Across industries, organizations have started using the MITRE ATT&CK framework to understand threat actors' TTPs and identify holes in defenses. A number of recent cyber threat intelligence analytical reports have been released by public and private sector organizations which attribute cyber attacks. This includes Mandiant's APT1 and APT28 reports, US CERT's APT29 report, and Symantec's Dragonfly, Waterbug Group and Seedworm reports. CTI Sharing. In 2015 U.S. government legislation in the form of the "Cybersecurity Information Sharing Act" encouraged the sharing of CTI indicators between government and private organizations. This act required the U.S. federal government  to facilitate and promote 4 CTI objectives: In 2016, the U.S. government agency National Institute of Standards and Technology (NIST) issued a publication (NIST SP 800-150) which further outlined the necessity for Cyber Threat Information Sharing as well as a framework for implementation.