Cyber Intelligence Foundations

This course explains how to apply the discipline of intelligence analysis to the cyber domain. The course covers strategic subjects such as the organizational role of cyber threat intelligence (CTI) and stakeholder analysis, as well as analytic practitioner skills development topics, such as understanding the intelligence lifecycle, developing raw data into minimally viable intelligence, and an introduction to cyber intelligence attribution.

Prerequisites: Working understanding of basic information security principles and general understanding of threat intelligence.

After completing this course, learners should be able to:

• Clearly define cyber intelligence and the difference between intelligence and information, and articulate the role and importance of the cyber threat intelligence (CTI) capability
• Describe how the intelligence cycle functions as the working model to operationalize intelligence
• Explain the two modes of analytic thinking and the use of structured analytic techniques
• Detail ways to counter analytic bias
• Explain threat model concepts and why we use them
• State the basics of malware composition
• Describe how intelligence analysts convert raw threat data into actionable intelligence
• Write well-structured intelligence reports and determine improvements to current communications

Managers of technical information security teams and analytic and technical professionals familiar with threat intelligence.

In-classroom, virtual instructor-led or on-demand training

• 3 days (in-person delivery)
• 4 days (virtual delivery)

Learners may find it useful to bring a computer with link analysis software.