Cyber Threat Intelligence is far more than ingesting IoCs into your SIEM. It takes an application of analyzed threat surfaces against the threat landscape compared to defensive measures to inform decision makers of risk acceptance for secure courses of action of the network.
In laymen's terms (*cough* in management speak *cough*), an adversary targeting X company employs Y capability, that accomplices Z action. We can take A defensive action to prevent B from occuring provided we make C change or patch D infrastructure.
The interrelationships between Incident Response, Forensics, Security Research and Reverse Engineering is what enables Cyber Threat Intelligence to be applicable and relevant in security environments. If you silo these functions from interacting with each other, you are failing.
My personal opinion,the biggest threats to secure networks is internal politics, poor messaging of threats to decision makers and risk acceptance authorities, flawed processes, and the perception that security is a cost center not a money maker. BECs are as much a threat as APTs.
Admitting there is a problem in defenses is not the same as admitting that you are pissing away money for no reason. The Cyber Threat Landscape is an ever evolving, complex environment unique to each business that requires cooperation, analysis, and communication to succeed.
I am more than willing to assist anyone that wants/needs assistance in understanding their threat landscape and how to communicate that to management. The better we help each other learn and grow, the better our community and industry becomes to defend our charges.
