EC-Council Certified Threat Intelligence Analyst (CTIA)

Module 01: Introduction to Threat Intelligence

Understanding Intelligence

• Intelligence Definition and Essential Terminology
• Intelligence vs. Information vs. Data
• Intelligence-Led Security Testing (Background and Reasons)

Understanding Cyber Threat Intelligence

• Cyber Threat Intelligence (CTI)
• Cyber Threat Intelligence Stages
• Characteristics of Threat Intelligence
• Benefits of CTI
• Enterprise Objectives for Threat Intelligence Programs
• How can Threat Intelligence Help Organizations
• Types of Threat Intelligence
  • Strategic Threat Intelligence
  • Tactical Threat Intelligence
  • Operational Threat Intelligence
  • Technical Threat Intelligence
• Threat Intelligence Generation
• Threat Intelligence Informed Risk Management
• Integration of Threat Intelligence into SIEM
• Leverage Threat Intelligence for Enhanced Incident Response
  • Enhancing Incident Response by Establishing SOPs for Threat Intelligence
• Organizational Scenarios using Threat Intelligence

What Organizations and Analysts Expect?

• Common Information Security Organization (CISO) Structure
  • Cyber Threat Analyst Responsibilities
• Threat Intelligence Use Cases

Overview of Threat Intelligence Lifecycle and Frameworks

• Threat Intelligence Lifecycle
• Threat Analyst Roles in Threat Intelligence Lifecycle
• Threat Intelligence Strategy
• Threat Intelligence Capabilities
• Capabilities to Look for in Threat Intelligence Solution
• Threat Intelligence Maturity Model
• Threat Intelligence Frameworks
  • Collective Intelligence Framework (CIF)
  • CrowdStrike Cyber Threat Intelligence Solution
  • NormShield Threat and Vulnerability Orchestration
  • MISP - Open Source Threat Intelligence Platform
  • TC Complete
  • Yeti
  • ThreatStream
• Additional Threat Intelligence Frameworks

Module 02: Cyber Threats and Kill Chain Methodology

Understanding Cyber Threats

• Overview of Cyber Threats
• Cyber Security Threat Categories
• Threat Actors/Profiling the Attacker
• Threat: Intent, Capability, Opportunity Triad
• Motives, Goals, and Objectives of Cyber Security Attacks
• Hacking Forums

Understanding Advanced Persistent Threats (APTs)

• Advanced Persistent Threats (APTs)
• Characteristics of Advanced Persistent Threats (APTs)
• Advanced Persistent Threat Lifecycle

Understanding Cyber Kill Chain

• Cyber Kill Chain Methodology
• Tactics, Techniques, and Procedures (TTPs)
• Adversary Behavioral Identification
• Kill Chain Deep Dive Scenario - Spear Phishing

Understanding Indicators of Compromise (IoCs)

• Indicators of Compromise (IoCs)
• Why Indicators of Compromise Important?
• Categories of IoCs
• Key Indicators of Compromise
• Pyramid of Pain

Module 03: Requirements, Planning, Direction, and Review

Understanding Organization’s Current Threat Landscape

• Identify Critical Threats to the Organization
• Assess Organization’s Current Security Pressure Posture
  • Assess Current Security Team’s Structure and Competencies
  • Understand Organization’s Current Security Infrastructure and Operations
• Assess Risks for Identified Threats

Understanding Requirements Analysis

• ▪ Map out Organization’s Ideal Target State
• ▪ Identify Intelligence Needs and Requirements
• ▪ Define Threat Intelligence Requirements
  • Threat Intelligence Requirement Categories
• Business Needs and Requirements
  • Business Units, Internal Stakeholders, and Third-Parties
  • Other Teams
• Intelligence Consumers Needs and Requirements
• Priority Intelligence Requirements (PIRs)
• Factors for Prioritizing Requirements
• MoSCoW Method for Prioritizing Requirements
• Prioritize Organizational Assets
• Scope Threat Intelligence Program
• Rules of Engagement
• Non-Disclosure Agreements
• Avoid Common Threat Intelligence Pitfalls

Planning Threat Intelligence Program

• Prepare People, Processes, and Technology
• Develop a Collection Plan
• Schedule Threat Intelligence Program
• Plan a Budget
• Develop Communication Plan to Update Progress to Stakeholders
• Aggregate Threat Intelligence
• Select a Threat Intelligence Platform
• Consuming Intelligence for Different Goals
• Track Metrics to Keep Stakeholders Informed

Establishing Management Support

• Prepare Project Charter and Policy to Formalize the Initiative
  • Establish Your Case to Management for a Threat Intelligence Program
  • Apply a Strategic Lens to the Threat Intelligence Program

Building a Threat Intelligence Team

• Satisfy Organizational Gaps with the Appropriate Threat Intelligence Team
  • Understand different Threat Intelligence Roles and Responsibilities
  • Identify Core Competencies and Skills
  • Define Talent Acquisition Strategy
  • Building and Positioning an Intelligence Team
  • How to Prepare an Effective Threat Intelligence Team

Overview of Threat Intelligence Sharing

• Establishing Threat Intelligence Sharing Capabilities
• Considerations for Sharing Threat Intelligence
• Sharing Intelligence with Variety of Organizations
• Types of Sharing Partners
• Important Selection Criteria for Partners
• Sharing Intelligence Securely

Reviewing Threat Intelligence Program

• Threat Intelligence Led Engagement Review
• Considerations for Reviewing Threat Intelligence Program
• Assessing the Success and Failure of the Threat Intelligence Program

Module 04: Data Collection and Processing

Overview of Threat Intelligence Data Collection

• Introduction to Threat Intelligence Data Collection
• Data Collection Methods
• Types of Data
• Types of Threat Intelligence Data Collection

Overview of Threat Intelligence Collection Management

• Understanding Operational Security for Data Collection
• Understanding Data Reliability
• Ensuring Intelligence Collection Methods Produce Actionable Data
• Validate the Quality and Reliability of Third Party Intelligence Sources
• Establish Collection Criteria for Prioritization of Intelligence Needs and Requirements
• Building a Threat Intelligence Collection Plan

Overview of Threat Intelligence Feeds and Sources

• Threat Intelligence Feeds
• Threat Intelligence Sources

Understanding Threat Intelligence Data Collection and Acquisition

• Threat Intelligence Data Collection and Acquisition
• Data Collection through Open Source Intelligence (OSINT)
  • Data Collection through Search Engines
    • Data Collection through Advanced Google Search
    • Data Collection through Google Hacking Database
    • Data Collection through ThreatCrowd
    • Data Collection through Deep and Dark Web Searching
  • Data Collection through Web Services
    • Finding Top-level Domains (TLDs) and Sub-domains
    • Data Collection through Job Sites
    • Data Collection through Groups, Forums, and Blogs
    • Data Collection through Social Networking Sites
    • Data Collection related to Blacklisted and Whitelisted Sites
  • Data Collection through Website Footprinting
    • Data Collection through Monitoring Website Traffic
    • Data Collection through Website Mirroring
    • Extracting Website Information from https://archive.org
    • Extracting Metadata of Public Documents
  • Data Collection through Emails
    • Data Collection by Tracking Email Communications
    • Data Collection from Email Header
    • Data Collection through Emails: eMailTrackerPro
  • Data Collection through Whois Lookup
  • Data Collection through DNS Interrogation
    • Data Collection through DNS Lookup and Reverse DNS Lookup
    • Fast-Flux DNS Information Gathering
    • Dynamic DNS (DDNS) Information Gathering
    • DNS Zone Transfer Information Gathering
  • Automating OSINT effort using Tools/Frameworks/Scripts
    • Maltego
    • OSTrICa (Open Source Threat Intelligence Collector)
    • OSRFramework
    • FOCA
    • GOSINT
    • Automating OSINT effort using Tools/Frameworks/Scripts
• Data Collection through Human Intelligence (HUMINT)
  • Data Collection through Human-based Social Engineering Techniques
  • Data Collection through Interviewing and Interrogation
  • Social Engineering Tools
• Data Collection through Cyber Counterintelligence (CCI)
  • Data Collection through Honeypots
  • Data Collection through Passive DNS Monitoring
  • Data Collection through Pivoting Off Adversary’s Infrastructure
  • Data Collection through Malware Sinkholes
  • Data Collection through YARA Rules
• Data Collection through Indicators of Compromise (IoCs)
  • IoC Data Collection through External Sources
    • Commercial and Industry IoC Sources
      • IT-ISAC
    • Free IoC Sources
      • AlienVault OTX
      • Blueliv Threat Exchange Network
      • MISP
      • threat_note
      • Cacador
    • IOC Bucket
    • Tools for IoC Data Collection through External Sources
  • IoC Data Collection through Internal Sources
  • Tools for IoC Data Collection through Internal Sources
    • Splunk Enterprise
    • Valkyrie Unknown File Hunter
    • IOC Finder
    • Redline
  • Data Collection through Building Custom IoCs
  • Tools for Building Custom IoCs
    • IOC Editor
  • Steps for effective usage of Indicators of Compromise (IoCs) for Threat Intelligence
• Data Collection through Malware Analysis
  • Preparing Testbed for Malware Analysis
  • Data Collection through Static Malware Analysis
  • Data Collection through Dynamic Malware Analysis
  • Malware Analysis Tools
    • Blueliv Threat Exchange Network
    • Valkyrie
  • Tools for Malware Data Collection

Understanding Bulk Data Collection

• Introduction to Bulk Data Collection
• Forms of Bulk Data Collection
• Benefits and Challenges of Bulk Data Collection
• Bulk Data Management and Integration Tools

Understanding Data Processing and Exploitation

• Threat Intelligence Data Collection and Acquisition
• Introduction to Data Processing and Exploitation
• Structuring/Normalization of Collected Data
• Data Sampling
  • Types of Data Sampling
• Storing and Data Visualization
• Sharing the Threat Information

Module 05: Data Analysis

Overview of Data Analysis

• Introduction to Data Analysis
• Contextualization of Data
• Types of Data Analysis

Understanding Data Analysis Techniques

• Statistical Data Analysis
  • Data Preparation
  • Data Classification
  • Data Validation
  • Data Correlation
  • Data Scoring
  • Statistical Data Analysis Tools
    • SAS/STAT Software
    • IBM SPSS
• Analysis of Competing Hypotheses (ACH)
  • Hypothesis
  • Evidence
  • Diagnostics
  • Refinement
  • Inconsistency
  • Sensitivity
  • Conclusions and Evaluation
• ACH Tool
  • PARC ACH
• Structured Analysis of Competing Hypotheses (SACH)
• Other Data Analysis Methodologies

Overview of Threat Analysis

• Introduction to Threat Analysis
• Types of Threat Intelligence Analysis

Understanding Threat Analysis Process

• Threat Analysis Process and Responsibilities
• Threat Analysis based on Cyber Kill Chain Methodology
• Aligning the Defensive Strategies with the Phases of the Cyber Kill Chain Methodology
• Perform Threat Modeling
  • Asset Identification
  • System Characterization
  • System Modeling
  • Threat Determination and Identification
  • Threat Profiling and Attribution
  • Threat Ranking
  • Threat Information Documentation
• Threat Modeling Methodologies
  • STRIDE
  • PASTA
  • TRIKE
  • VAST
  • DREAD
  • OCTAVE
• Threat Modeling Tools
  • Microsoft Threat Modelling Tool
  • ThreatModeler
  • securiCAD Professional
  • IriusRisk
• Enhance Threat Analysis Process with the Diamond Model Framework
• Enrich the Indicators with Context
• Validating and Prioritizing Threat Indicators

Overview of Fine-Tuning Threat Analysis

• Fine-Tuning Threat Analysis
• Identifying and Removing Noise
• Identifying and Removing Logical Fallacies
• Identifying and Removing Cognitive Biases
• Automate Threat Analysis Processes
• Develop Criteria for Threat Analysis Software
• Employ Advanced Threat Analysis Techniques
  • Machine Learning based Threat Analysis
  • Cognitive based Threat Analysis

Understanding Threat Intelligence Evaluation

• Threat Intelligence Evaluation
• Threat Attribution

Creating Runbooks and Knowledge Base

• Developing Runbooks
• Create an Accessible Threat Knowledge Repository
• Organize and Store Cyber Threat Information in Knowledge Base

Overview of Threat Intelligence Tools

• Threat Intelligence Tools
  • AlienVault USM Anywhere
  • IBM X-Force Exchange
  • ThreatConnect
  • SurfWatch Threat Analyst
  • AutoFocus
  • Additional Threat Intelligence Tools

Module 06: Intelligence Reporting and Dissemination

Overview of Threat Intelligence Reports

• Threat Intelligence Reports
• Types of Cyber Threat Intelligence Reports
  • Threat Analysis Reports
  • Threat Landscape Reports
• Generating Concise Reports
• Threat Intelligence Report Template
• How to Maximize the Return from Threat Intelligence Report
• Continuous Improvement via Feedback Loop
• Report Writing Tools
  • MagicTree
  • KeepNote

Introduction to Dissemination

• Overview of Dissemination
• Preferences for Dissemination
• Benefits of Sharing Intelligence
• Challenges to Intelligence Sharing
• Disseminate Threat Intelligence Internally
• Building Blocks for Threat Intelligence Sharing
• Begin Intelligence Collaboration
• Establish Information Sharing Rules
• Information Sharing Model
• Information Exchange Types
• TI Exchange Architectures
• TI Sharing Quality
• Access Control on Intelligence Sharing
• Intelligence Sharing Best Practices

Participating in Sharing Relationships

• Why Sharing Communities are Formed?
• Join a Sharing Community
• Factors to be Considered When Joining a Community
• Engage in Ongoing Communication
• Consume and Respond to Security Alerts
• Consume and Use Indicators
• Produce and Publish Indicators
• External Intelligence Sharing
• Establishing Trust
• Organizational Trust Models

Overview of Sharing Threat Intelligence

• Sharing Strategic Threat Intelligence
• Sharing Tactical Threat Intelligence
• Sharing Operational Threat Intelligence
• Sharing Technical Threat Intelligence
• Sharing Intelligence using YARA Rules
• IT-ISAC (Information Technology - Information Security and Analysis Center)

Overview of Delivery Mechanisms

• Forms of Delivery
• Machine Readable Threat Intelligence (MRTI)
• Standards and Formats for Sharing Threat Intelligence
  • Traffic Light Protocol (TLP)
  • MITRE Standards
  • Managed Incident Lightweight Exchange (MILE)
  • VERIS
  • IDMEF

Understanding Threat Intelligence Sharing Platforms

• Information Sharing and Collaboration Platforms
  • Blueliv Threat Exchange Network
  • Anomali STAXX
  • MISP (Malware Information Sharing Platform)
  • Cyware Threat Intelligence eXchange (CTIX)
  • Soltra Edge
  • Information Sharing and Collaboration Platforms

Overview of Intelligence Sharing Acts and Regulations

• Cyber Intelligence Sharing and Protection Act (CISPA)
• Cybersecurity Information Sharing Act (CISA)

Overview of Threat Intelligence Integration

• Integrating Threat Intelligence
• How to Integrate CTI into the Environment
• Acting on the Gathered Intelligence
• Tactical Intelligence Supports IT Operations: Blocking, Patching, and Triage
• Operational Intelligence Supports Incident Response: Fast Reaction and Remediation
• Strategic Intelligence Supports Management: Strategic Investment and Communications