You're reading from Mastering Cyber Intelligence Gain comprehensive knowledge and skills to conduct threat intelligence for effective system defense

Product type Paperback

Published in Apr 2022

Publisher Packt

ISBN-13 9781800209404

Length 528 pages

Edition 1st Edition

Concepts

Cybersecurity

Author (1):

Jean Nestor M. Dahj

View More author details

Table of Contents (20) Chapters

Preface

1. Section 1: Cyber Threat Intelligence Life Cycle, Requirements, and Tradecraft

2. Chapter 1: Cyber Threat Intelligence Life Cycle FREE CHAPTER

3. Chapter 2: Requirements and Intelligence Team Implementation

4. Chapter 3: Cyber Threat Intelligence Frameworks

5. Chapter 4: Cyber Threat Intelligence Tradecraft and Standards

6. Chapter 5: Goal Setting, Procedures for CTI Strategy, and Practical Use Cases

7. Section 2: Cyber Threat Analytical Modeling and Defensive Mechanisms

8. Chapter 6: Cyber Threat Modeling and Adversary Analysis

9. Chapter 7: Threat Intelligence Data Sources

10. Chapter 8: Effective Defense Tactics and Data Protection

11. Chapter 9: AI Applications in Cyber Threat Analytics

12. Chapter 10: Threat Modeling and Analysis – Practical Use Cases

13. Section 3: Integrating Cyber Threat Intelligence Strategy to Business processes

14. Chapter 11: Usable Security: Threat Intelligence as Part of the Process

15. Chapter 12: SIEM Solutions and Intelligence-Driven SOCs

16. Chapter 13: Threat Intelligence Metrics, Indicators of Compromise, and the Pyramid of Pain

17. Chapter 14: Threat Intelligence Reporting and Dissemination

18. Chapter 15: Threat Intelligence Sharing and Cyber Activity Attribution – Practical Use Cases

19. Other Books You May Enjoy

PoP, the adversary padlock

The PoP has been mentioned briefly in previous chapters to explain certain concepts of IOCs and adversary behaviors. In this section, we will look at it in detail. The PoP describes the relationships between IOCs and illustrates the amount of pain it will cause adversaries should you block those IOCs. Whenever you deny an IOC, the adversary needs to change one or more of their TTPs to carry on with the attack. In the following subsection, we look at the types of indicators used in the PoP and their application.

PoP indicators

IOCs do not carry the same weight (value or importance) when it comes to security monitoring. Understanding which IOC is a priority in a cyberattack can help CTI analysts reduce threat impact and complicate the adversaries' lives. The PoP, as shown in the following figure, was created by David J. Bianco in 2013 (https://bit.ly/3p2caLJ). It comprises six IOCs associated with the pain index:

Figure 13...