>> Welcome to Module 3. This module is split into
five lessons which all focus on
the central theme of Operationalizing ATT&CK.
Specifically, we will explore
how we can apply the knowledge we've captured in
[inaudible] attack to various cybersecurity operations
and practices and how this enables us as
defenders to perform what we call
threat-informed defense or the systematic
application of a deep understanding of
adversary trade grab and technology to prevent,
detect, and respond to cyber attacks.
Without further ado, let's dive in.
Welcome to Module 3,
Lesson 1, Cyber Threat Intelligence.
In this lesson, we will explore
the importance of cyber threat intelligence within
security operations and appreciate how attack
can provide a starting point and
structure for tracking this intelligence.
In any battle, intelligence and
knowledge very often separates winners and losers,
and cyber is no different.
A cyber threat intelligence,
or CTI allows us to track,
understand, and maybe even
get ahead of what our adversaries are doing.
Attack provides a great starting point for identifying
what behaviors have been reported
for specific groups or malware.
As you recall, the model allows us to map
adversaries to the behaviors
via techniques or sub techniques,
but also capturing references to
the publicly available cyber threat intelligence
describing these behaviors.
But as we know, CTI comes in various forms.
In this case, we can see impactful and
powerful intelligence captured in the form of blogs,
reported command lines, or even tweets.
But attack allows us to consistently capture,
share, and distribute this intelligence.
Specifically, we can decompose these reports and capture
the associated behaviors and capture
them within the model presented by attack.
If that, we've used the knowledge check for Lesson 1.
Which of the following is not true?
Please pause the video and take a second to
think of the correct answer before proceeding.
In this case, the correct answer was b.
The data in ATT&CK can help us
format and find cyber threat intelligence.
But since the data is already mapped to
publicly available reporting and documentation,
we're probably not going to produce anything new.
With that, we've reached the end of Lesson 1.
In summary, intelligence is critical for decision-making,
as well as providing priorities
and shaping cybersecurity operations.
ATT&CK provides a starting point and means for
structuring this intelligence about adversary behaviors.