>> Hello and welcome to
this new module about analysis and production.
This lesson is an introduction to analysis.
Finally, we have collected the data, made it usable,
and now it is time to use it to answer the questions
that were defined in
the first stage of intelligence cycle.
In this stage, we combine different data sources
that have been gathered and
processed in the previous stages,
and use those to pivot on data points,
recognize patterns, and correlate
information in order to create more context.
In this lesson, we will start with
a quick explanation of analysis and production phase.
We will discover some approaches
that can be used for analysis,
such as structured analytics techniques
, and modeling techniques.
Of course, you will see examples from
each cases and why are
they useful for threat intelligence.
In the analysis step,
threat intelligence teams must
effectively combine data from
several sources and recognize
meaningful patterns to make informed judgment.
Contradictory data must be
>> evaluated against each other,
>> and the patterns and implications of
inconclusive or insufficient data must be considered.
Once the analysis is complete,
threat intelligence teams produce
finished intelligence reports to communicate
their key findings to the decision-makers.
For this task in particular,
good analysts will not be replaced
by automated systems anytime soon.
A good security analyst uses
a portfolio of non-structured techniques,
methods, and skills that
>> support them in their analysis.
>> This allows them to work with
and make sense of large amounts of data.
Before moving to see some examples of
approaches and techniques that are
commonly used for analysis,
let's discover why are they even used.
The main reason behind using
these approaches is to promote rigorous analysis,
lessen the risk of intelligence failure,
and make analysts' reasoning
more transparent to consumers.
In other words, reduce
the impact of the analysts' biases.
The goal of this lesson is
not to compare these techniques,
but to understand the mechanism to
modal cybersecurity threats in
order to provide more security in a system.
To me, these approaches fall into two categories.
The first one is
structured analytics techniques or SATs that will
assist analysts in dealing
with perennial problems of intelligence.
The second category is modeling techniques,
which are not necessarily
>> structured analytics techniques
>> but can help to reduce biases as well.
These approaches provide analysts with
clear and often step-by-step guidance
for conducting analysis of intelligence issues.
The first type is
structured analytics techniques or SATs.
They are methods of organizing and
stimulating thinking about intelligence problems.
These methods aim to make
the analytic process conscious and transparent,
thus reducing the probability of
errors caused by numerous cognitive biases.
We can mention some examples of SATs,
such as analysis of competing hypothesis,
devil's advocacy, team A,
team B, and red team analysis.
We will see some of these methods in
details in their dedicated lessons.
The second category is modeling techniques.
There are a number of
attack modeling techniques that are used to
analyze cyber attacks such as attack graph or tree,
diamond model, attack model,
and cyber kill chain.
We will discover together some of these models
in details in their dedicated lessons as well.
This lesson is only an introduction
to the analysis and production module.
We started with a definition
>> to the module's main focus.
>> Then we introduced the approaches
that can be used in analysis phase,
such as structured analytics techniques
and modeling techniques.
In the future videos,
we will deep dive into
the analysis approaches and techniques
and we will start with
the analysis of competing hypothesis.