CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE...
Transcript of CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE...
![Page 1: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/1.jpg)
Internal Audit, Risk, Business & Technology Consulting
CYBER THREAT INTEL:A STATE OF MIND
![Page 2: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/2.jpg)
WHO ARE WE?
Randy Armknecht, CISSP, EnCE
Protiviti
Director - IT Consulting
Albin Ahmetspahic
Protiviti
Manager – IT Consulting
![Page 3: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/3.jpg)
WHAT IS CYBER THREAT INTELLIGENCE
![Page 4: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/4.jpg)
CYBER THREAT INTELLIGENCE: A DEFINITION
evidence-based knowledge — including context, mechanisms, indicators, implications and actionable advice — about an existing or emerging menace or hazard to IT or information assets and can be used to inform decisions regarding response to that menace or hazard
“-- Gartner
![Page 5: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/5.jpg)
LET’S THINK ABOUT THAT…
5
Context
DATA WITHOUT CONTEXT IS JUST DATA
INTELLIGENCE REQUIRES CONTEXT
![Page 6: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/6.jpg)
LET’S THINK ABOUT THAT…
6
Mechanism
Context
WHAT ARE THE THREAT MECHANICS
![Page 7: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/7.jpg)
LET’S THINK ABOUT THAT…
7
Mechanism
Indicators
Context
HOW WILL WE KNOW THE THREAT
HAS BEEN REALIZED?
![Page 8: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/8.jpg)
Implications
LET’S THINK ABOUT THAT…
8
Mechanism
Indicators
Context
IF THE THREAT IS REALIZED
WHAT DOES IT MEAN FOR US?
![Page 9: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/9.jpg)
Implications
LET’S THINK ABOUT THAT…
9
Mechanism
Indicators
Actionable Advise
Context
IF THE THREAT IS REALIZED
WHAT ARE THE ACTIONS NECESSARY
TO MINIMIZE THE IMPACT
![Page 10: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/10.jpg)
DOES YOUR CYBER THREAT INTELLIGENCE PROGRAM GENERATE OUTPUT THAT CONTAINS…
10
CONTEXT
MECHANISMS
INDICATORS
IMPLICATIONS
ACTIONABLE ADVISE
REPEATABLE
CONSISTENT
![Page 11: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/11.jpg)
IF YOU SAID “YES”
![Page 12: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/12.jpg)
CONGRATULATIONS!
![Page 13: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/13.jpg)
CURRENT STATE
13
Source: http://www.infosecurity-magazine.com/news/firms-value-threat-intel-but-fail/
don’t look at the threat intel or reports received
don’t use the data for decision making
don’t have necessary staff skills
49%
43%
69%
![Page 14: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/14.jpg)
SO IF YOU’RE LIKE EVERYBODY ELSE….
![Page 15: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/15.jpg)
WHERE CAN WE OBTAIN “INTELLIGENCE” ?
![Page 16: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/16.jpg)
BUT ARE WE BUYING INTELLIGENCE OR JUST DATA?
16
CONTEXT
MECHANISMS
INDICATORS
IMPLICATIONS
ACTIONABLE ADVISE
![Page 17: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/17.jpg)
SO WHAT SHOULD WE DO?
![Page 18: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/18.jpg)
CYBER THREAT INTELLIGENCE IS A STATE OF MIND
18
Take the data from the vendors
Augment it with your own internal data
Mix them thoroughly in the minds of your analysts
Use the results to impart change in the environment
Effective intelligence is the result of a process
![Page 19: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/19.jpg)
THE CYBER THREAT INTELLIGENCE LIFECYCLE
![Page 20: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/20.jpg)
CCIR
THE CYBER THREAT INTELLIGENCE LIFECYCLE
Planning & Direction
Collection
Processing & Exploitation
Analysis & Production
Dissemination & Integration
6
Evaluation
Feedback
20
![Page 21: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/21.jpg)
CCIR – COMMANDER’S (CISO) CRITICAL INFORMATION REQUIREMENTS
Information requirement identified by the commander as being
critical to facilitating timely decision making“-- Joint Publication 1-02
CCIRPIR
21
“
![Page 22: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/22.jpg)
22
Planning & Direction
• Determine intelligence requirements
• Develop a CTI team
• Create a collection plan
• Generate requests for information
Collection
Processing & Exploitation
Analysis & Production
Dissemination & Integration
THE CYBER THREAT INTELLIGENCE LIFECYCLE
CCIR
Feedback
6
Evaluation
![Page 23: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/23.jpg)
CCIR
23
Planning & Direction
Processing & Exploitation
Analysis & Production
Dissemination & Integration
Feedback
6
Evaluation
THE CYBER THREAT INTELLIGENCE LIFECYCLE
Collection
• Collect data to satisfy intelligence requirements using:
All-Source collection:
− Critical Applications
− Network Infrastructure
− Security Infrastructure
![Page 24: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/24.jpg)
24
THE CYBER THREAT INTELLIGENCE LIFECYCLE
Collection
Planning & Direction
Processing & Exploitation
• Interpret raw data
• Convert interpreted data into a usable format (information) for analysis
Analysis & Production
Dissemination & Integration
CCIR
Feedback
6
Evaluation
![Page 25: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/25.jpg)
25
THE CYBER THREAT INTELLIGENCE LIFECYCLE
Collection
Planning & Direction
Processing & Exploitation
Analysis & Production
• Fuse information from Step 3
• Provide facts, findings, and forecasts
• Analysis should be:
− Objective
− Timely
− Accurate
− Actionable
• Use Confidence Method
Dissemination & Integration
CCIR
Feedback
6
Evaluation
![Page 26: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/26.jpg)
26
THE CYBER THREAT INTELLIGENCE LIFECYCLE
Collection
Planning & Direction
Processing & Exploitation
Analysis & Production
Dissemination & Integration
• Deliver the finished product to intelligence consumers at various levels:
− Strategic (CISO)
− Operational (APT)
− Tactical (TTP)
CCIR
Feedback
6
Evaluation
![Page 27: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/27.jpg)
WHAT DOES IT LOOK LIKE IN AN ORGANIZATION ?
![Page 28: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/28.jpg)
COMMON INFORMATION SECURITY ORGANIZATION STRUCTURE
28
CISO
Governance
Compliance
Security
Engineering
Security
Operations
Center (SOC)
Vulnerability
Management
CTI
![Page 29: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/29.jpg)
29
ANALYST ROLES & RESPONSIBILITIES
Threat Feeds, Alerts
IOCs
Incident Reporting
Collection
Analysis &
Production
Dissemination
& Integration
Collection
Processing &
Exploitation
Indexing Raw Data
Sorting Raw Data
Organizing Raw Data
Integrating, Evaluating
Information
Analyzing Information
Assessing Courses of Action
Strategic Consumers
Operational Consumers
Tactical Consumers
![Page 30: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/30.jpg)
AN EXAMPLE…
![Page 31: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/31.jpg)
Collect IntelCollect Intel,
Net FlowsCollect Intel
Filtering, Correlation, Analytics, Analysis, Reporting, Prevention, and Response
Monitoring, Triage, Analysis, Escalation, Prevention, Counter, and Response
Critical Applications Network Infrastructure Security Infrastructure
• Risk Analysis and Assessment
• Business Processes and Data
• Existing Architecture and Infrastructure
• Threat Definition and Threat Intelligence
Mission and Security Mapping Definition
TOP DOWN, DEFINE THE MISSION
31
![Page 32: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/32.jpg)
Routers
Endpoint
Devices
DMZ
Organic Infrastructure
Internal Resources
Network Storage Servers
OS /
HypervisorsApplicationsDatabases
Middleware
FW FW
Security devices, Software, Services, and Processes
APPLYING THE INTELLIGENCE CYCLE TO CTI
32
![Page 33: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/33.jpg)
Routers
Endpoint
Devices
DMZ
Organic Infrastructure
Network Storage Servers
OS /
HypervisorsApplicationsDatabases
Middleware
FW FW
Syslog / Eventlog / WMI / Logfile / SNMP / SMTP / SQL / API / Custom
Intel collection layer
Log
Collectors
Event
CollectorsNet FlowsSecurity
Processes
Threat Intel
CTI Vendors
OSINT
Govt sources
Common
Groups
Managed Device Layer
Security Devices, Software, Services, and Processes
APPLYING THE INTELLIGENCE CYCLE TO CTI
Internal Resources
Social Media
News
Dark Web
Media and Web
33
![Page 34: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/34.jpg)
Routers
Endpoint
Devices
DMZ
Organic Infrastructure
Network Storage Servers
OS /
hypervisorsApplicationsDatabases
Middleware
FW FW
Intel collection layer
Log
Collectors
Event
Collectors
Analytical Layer
Correlation Layer
• Correlation engine, filtering and analysis
• Operations , Security, and User Behavior
Analytics
• Workflow automation
• Config and Problem Management
• Security process intel
• AV, IDS/IPS, DLP, Content Security, Data
& DB Security, App Security, FIM, FW …
Net FlowsSecurity
Processes
Threat Intel
T Intel Vendors
OSINT
Govt sources
Common
Groups
Security Devices, Software, Services, and Processes
APPLYING THE INTELLIGENCE CYCLE TO CTI
Internal Resources
Syslog / Eventlog / WMI / Logfile / SNMP / SMTP / SQL / API / CustomManaged Device Layer
Social Media
News
Dark Web
Media and Web
34
![Page 35: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/35.jpg)
Routers
Endpoint
Devices
DMZ
Organic Infrastructure
Network Storage Servers
OS /
hypervisorsApplicationsDatabases
Middleware
FW FW
Intel collection layer
Log
Collectors
Event
Collectors
Analytical Layer
Correlation Layer
• Correlation engine, filtering and analysis
• Operations , Security, and User Behavior
Analytics
• Workflow automation
• Config and Problem Management
• Security process intel
• AV, IDS/IPS, DLP, Content Security, Data
& DB Security, App Security, FIM, FW …
Net FlowsSecurity
Processes
Threat Intel
T Intel Vendors
OSINT
Govt sources
Common
Groups
Security Devices, Software, Services, and Processes
APPLYING THE INTELLIGENCE CYCLE TO CTI
Internal Resources
Syslog / Eventlog / WMI / Logfile / SNMP / SMTP / SQL / API / CustomManaged Device Layer
Presentation layer
Reports Security Management IT Operations Compliance Business
Social Media
News
Dark Web
Media and Web
35
![Page 36: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/36.jpg)
WHAT DID WE LEARN?
![Page 37: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/37.jpg)
WHAT WE’VE LEARNED
37
Data != Intelligence
![Page 38: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/38.jpg)
38
CYBER THREAT INTELLIGENCE
A STATE OF MIND
![Page 39: CYBER THREAT INTEL: A STATE OF MIND - Chapters Site · 2016-11-10 · CYBER THREAT INTEL: A STATE OF MIND. WHO ARE WE? Randy Armknecht, CISSP, EnCE Protiviti ... CCIR THE CYBER THREAT](https://reader033.fdocuments.us/reader033/viewer/2022041603/5e3254fc29a4576ea40a05d5/html5/thumbnails/39.jpg)
© 2016 Protiviti Inc. An Equal Opportunity Employer M/F/Disability/Veterans. Protiviti is not licensed
or registered as a public accounting firm and does not issue opinions on financial statements or
offer attestation services. All registered trademarks are the property of their respective owners.