Advanced Cyber Threat Intelligence Chapter - How to Read the Mind of your Attackers
summary
Level 3 CTI maturity means producing actionable, evidence‑backed assessments not generic themes and the talk shows how to get there: ingest and automate telemetry at scale (100 terabytes daily), move from sweeping to hunting and pivot on unexpected signals like phone background noise and car plate pivoting to localize suspects to towns, use licenses and tax IDs to map hosting businesses, apply link analysis to build a concise executive story, and treat attribution as probabilistic with multi‑source confirmation rather than single reports.
AI-written summary · about
chapters (13)
- 0:00Cyber Threat Intelligence intro
- 1:06CTI maturity levels
- 3:38Combining intelligence sources
- 5:27Cultural context in attribution
- 7:56Limitations in threat reports
- 10:11Right questions in analysis
- 11:59Attacker risk models
- 14:07Modeling frameworks
- 15:12Automating detection
- 16:56Storytelling in briefs
- 17:59Linking to risk management
- 19:03Adversarial tracking
- 20:06Holistic threat approach
related talks
32mTen Years of Cyber Threat Intelligence: Retrospectives
28mCyber Threat Intelligence Analysts and You
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
51mUsing Critical Threat Intelligence Strategically
30mCTI Bake-Off: A Recipe for Measuring, Integrating, and Prioritizing a CTI Program
01mQuick Look: These Aren't the Threats You're Looking For: How Our APT Focus Ruins CTI