Thinking Like the Adversary
Cyber Threat Intelligence (CTI) is the practice of collecting and analyzing information about current and potential attacks that threaten an organization. It's about understanding the "who, what, where, when, why, and how" of a threat. Instead of just reacting to alerts, a CTI-driven approach allows organizations to make proactive, evidence-based security decisions and anticipate an adversary's next move.
The Threat Intelligence Lifecycle
Planning & Direction
Defining the intelligence requirements based on the organization's assets, business model, and threat landscape.
Collection
Gathering raw data from internal sources (logs, incidents) and external sources (OSINT, dark web, threat feeds).
Processing
Converting collected raw data into a format suitable for analysis, such as parsing logs or translating languages.
Analysis
Transforming information into intelligence by identifying patterns, correlating data, and creating adversary profiles.
Dissemination
Distributing the finished intelligence to stakeholders in a clear and actionable format (reports, briefings, IOCs).
Feedback
Receiving feedback from stakeholders to refine the intelligence process and improve future outcomes.
My Approach to Threat Intelligence
I treat threat intelligence as the compass for all security operations. My approach is grounded in frameworks like the MITRE ATT&CK® knowledge base to map adversary Tactics, Techniques, and Procedures (TTPs). I am skilled at consuming and analyzing data from various threat feeds, performing open-source intelligence (OSINT) gathering, and correlating findings with internal security data. I use Python to automate the collection and parsing of intelligence, transforming high-volume data streams into prioritized, actionable alerts and reports that empower both technical teams and executive leadership.