Cyber Intelligence Foundations

Course Description

This three-day course explains how to apply the discipline of intelligence analysis to the cyber domain. The course covers strategic subjects such as the organizational role of cyber threat intelligence (CTI) and stakeholder analysis, as well as analytic practitioner skills development topics, such as understanding the intelligence lifecycle, developing raw data into minimally viable intelligence, and an introduction to cyber intelligence attribution.

Learning Objectives

After completing this course, learners should be able to:

• Clearly define cyber intelligence and the difference between intelligence and information, and articulate the role and importance of the cyber threat intelligence (CTI) capability
• Describe how the Intelligence Cycle functions as the working model to operationalize intelligence
• Explain the two modes of analytic thinking and the use of structured analytic techniques
• Detail ways to counter analytic bias
• Explain threat model concepts and why we use them
• State the basics of malware composition
• Describe how intelligence analysts convert raw threat data into actionable intelligence
• Write well-structured intelligence reports and determine improvements to current communications

Who should attend

Managers of technical information security teams and analytic and technical professionals familiar with threat intelligence.

Prerequisites

Working understanding of basic information security principles and general understanding of threat intelligence.

Delivery method

In-classroom, virtual instructor-led or on-demand training

Duration

• 3 days (in-person delivery)
• 4 days (virtual delivery)

What to bring

Learners may find it useful to bring a computer with link analysis software.