Discover and read the best of Twitter Threads about #sansfire
Most recents (1)
Teaching @sansforensics Threat Intelligence at #SANSFire this week. At first break, I had a chance to talk to students. The number of orgs with threat intelligence "programs" where program requirements are a complete unknown is always astounding to me. 1/n
If you don't know your #CTI requirements, you can't possibly build a good program. You may think you know the "requirements" but at the end of the day, those are determined by stakeholders (e.g. the "customer" aka whoever is in charge of funding the program). 2/n
If you aren't focusing on their concerns, you don't have an intelligence program. At best, you have some analysts wagging the dog with some analysis of potentially irrelevant (to the organization) intelligence information. It's not a professional operation, it's amateur hour. 3/n
