Module V – Threat Analysis & Vulnerabilities Assessment

Strategic, operational, and tactical cyber threat intelligence application &
fundamentals
● Open-source intelligence and campaigns
● Intelligence applications and intrusion analysis
● Analysis of intelligence, attribution, collecting and storing data sets
● Kill chain, diamond model, and courses of action matrix
● Malware as a collection source, pivoting, and sharing intelligence

Course Objectives

• Analysis of Intelligence

The candidate will demonstrate an understanding of the techniques employed in
analyzing information. The candidate will also demonstrate an understanding
obstacles to accurate analysis, such as fallacies and bias, and how to recognize and
avoid them.

• Campaigns and Attribution

The candidate will demonstrate an understanding of identifying and profiling
intrusion characteristics and external intelligence into campaigns. The candidate
will demonstrate an understanding of the importance of attribution and the factors
that are considered when making an attribution.

• Collecting and Storing Data Sets

The candidate will demonstrate an understanding of collecting and storing data
from collection sources such as threat feeds, domains, TLS certificates, and internal
sources.

• Intelligence Application

The candidate will demonstrate an understanding of the practical application of
gathering, analyzing, and using intelligence. Additionally, the candidate will
demonstrate an understanding of how well-known cyber-attacks can inform cyber
intelligence professionals today.

• Intelligence Fundamentals

The candidate will demonstrate an understanding of fundamental cyber threat
intelligence definitions and concepts. The candidate will also demonstrate a basic
working knowledge of technologies that provide intelligence analysts with data,
such as network indicators, log repositories, and forensics tools.

• Kill Chain, Diamond Model, and Courses of Action Matrix

The candidate will demonstrate an understanding of the Kill Chain, Diamond
Model, and Courses of Actions Matrix and how they are used together to analyze
intrusions.

• Malware as a Collection Source

The candidate will demonstrate an understanding of malware analysis tools and
techniques to derive intelligence.

• Pivoting

The candidate will demonstrate an understanding of pivoting to expand
intelligence, pivot analysis, the ability to use link analysis tools, and ability perform
domain analysis to expand intelligence collections.

• Sharing Intelligence

The candidate will demonstrate an understanding of methods and practices of
storing intelligence from various sources. The candidate will demonstrate an
understanding of the processes, tools, and techniques used in sharing intelligence.
The candidate will demonstrate an understanding of effectively sharing tactical
intelligence with executives by writing accurate and effective reports and using such
capabilities as assessments.