>> Hello and welcome to
the Advanced Cyber Threat Intelligence course.
My name is Alyssa Berriche,
and this video is an introduction to the course.
Let me start by introducing myself.
My name is Alyssa Berriche.
I currently work as senior Cyber Threat Analyst.
I am also a college instructor for more than two years.
I teach Cyber Threat Intelligence and Malware analysis.
I founded my online magazine on 2016,
where I write technical articles about cybersecurity,
but not only this,
I also write about events and conventions that I visit,
as well as other parts of my personal life,
such as trips,
animals, especially cats, or even funny stuff.
If you are curious about my magazine,
you can visit it at Digitalys-mag.net.
I hold few cybersecurity certifications
such as GX Cyber Threat Intelligence,
ISO ISMS implementer, and ISO Cyber Security Manager.
If you have any question or feedback,
please feel free to contact me on LinkedIn and Twitter.
If you wonder who should take this course.
Basically, this course has an interesting material
for Security Practitioners, SOC Analysts,
Threat Intelligence Analysts, Threat Hunters,
Incident Response teams,
Digital Forensic and Malware Analysts.
Briefly, any cybersecurity professionals who want to
enrich their skills and knowledge
in the field of Cyber Threat Intelligence.
As you can understand from the title,
this course is an advanced one,
and to fully take advantage,
you need to be familiar with networking essentials,
familiar with security terminologies such as Firewall,
SIEM, IPS, et cetera.
You need also to complete the intro to
Cyber Threat Intelligence course
and basic OSINT knowledge,
basic understanding of Cyber Kill Chain,
basic understanding of data analysis
are highly recommended and of course,
don't forget to bring
your willingness to learn something new.
In this course, we will go
step-by-step through the different types of
collection sources and the importance of
data collection in Cyber Threat Intelligence program.
We will see the steps of
processing and management of the collected data.
We will see also examples of
Threat Intelligence Platforms or TIPs.
We will discover together
methodologies used for Intrusion Analysis,
such as the Cyber Kill Chain and the Diamond Model,
and other ones that are used for campaign analysis,
such as visual analysis using tools like Maltego.
We will discuss as well,
one of the challenges facing
Threat Intelligence Analysts,
which are their biases and
logical fallacies that might
lead to errors in conclusions.
Lastly, we will see the importance of dissemination in
Cyber Threat Intelligence and how is it
done based on the appropriate audience.
This course is structured as the following,
there are videos containing the presentation.
Assessment will be included in some videos and as
separate quizzes and as supplemental reading material,
there is a doc file containing links to
interesting books and articles
that helped me to create this course.
The link to the file can be
found attached to the description.
Now, let's get an overview of the modules.
In this course, we will have six modules
after the introduction and before the summary module.
The first module is about Data Collection.
In this module, we will deep dive into
the different types of data collection starting from
the internal data sources and going through
the different categories of external data sources.
In this module as well,
we will get to discover how we can leverage OSINT.
The second module will be
dedicated to data management and processing.
We will start with a quick definition of
what is processing and how is it useful.
Then we will discover some of
the common standards used in
Cyber Threat Intelligence in order
to normalize collected data
and make it easier to integrate
within your IT infrastructure
or to store it and share it.
We will also see
some examples of Threat Intelligence Platforms.
In the third module,
we will focus on Intrusion Analysis.
In this module, we will define
analysis phase and why is it
important in Cyber Threat Intelligence.
We will discover multiple methods
that can be used for analysis,
such as analysis of competing hypothesis,
a combination of Cyber Kill Chain and Diamond model,
or a combination of
Cyber Kill Chain and Courses of Actions.
Our fourth module will be
fully dedicated to Campaign analysis.
We will start with a definition of
>> campaign and you will
>> see some of the methods that
can be used in campaign analysis,
like the heatmap analysis or
visual analysis using different tools like Maltego.
We will go through the MITRE ATT&CK framework and
we will see how we can
leverage the MITRE threat group tracker.
We will see as well what are
the best options to name
the campaign that you are analyzing.
The fifth module is about Attribution.
We will start with a good definition of attribution.
We will see some of the challenges that can
be facing analysts in the face
of attribution and some of
these challenges are cognitive
>> biases and logical error.
>> We will see how we can identify
these challenges and how to manage them.
We will see what is a Nation-state attribution as well.
The final module will be
dedicated to Dissemination and Feedback.
We will start as usual with a definition
of dissemination, sharing, and feedback.
Next, we will discover the difference between
the three pillars constituting
Cyber Threat Intelligence,
which are Tactical, Operational,
and Strategic intelligence based
on their appropriate audience.
I hope this introduction gave you
an overview of what we are going
>> to learn in this course.
>> In the next video,
we will start with
a quick introduction to the Intelligence Lifecycle.