In this episode we discuss leading a large-scale threat intelligence program in the financial institution space and how to make intelligence absorbable by multiple consumers. We also talk about how intelligence teams can build processes and technology at scale to increase investment costs to criminals. Finally, we touch on large enterprises being a value-add to small and medium-sized businesses.
Here are the 2 Topics We Cover in This Episode:
1) Intelligence is Valued Differently By Different Stakeholders:
- Tactical, operational, and strategic intelligence gains can fill many gaps in business, inside and outside the security operations function.
- Good intelligence analysis should make business stakeholders rethink their assumptions about risk and address realities regarding specific scenarios around the state of the organization’s risk posture.
2) Begin with the SOC, then Spread Across All Business Sectors:
- Cyber threat intelligence is a journey and it takes time to realize a return on investment. Find coverage gaps that complement existing controls that have current metrics leveraged against them and leverage them.
- User Metrics to help, such as:
- For SOC/CIRT Teams: The number of incidents and issues remediated, quantity of vulnerabilities patched, and most importantly, enumerate or outline the loss that could have occurred from those exploited vulnerabilities.
- For Outside the SOC: Inform the business of any type of risk through tactical, strategic, and operational intelligence.