Information Sharing, Cyber Threat Intelligence, & the U.S. Government Professor: Stacey A. Wright, CISSP [email protected]

On the first page:

Watch one of the following webinars. Summarize the webinar (at least 6 sentences) and briefly answer the following questions (at least 3 sentences each). Receive up to 20 points.

1. Why did you choose this webinar?

2. What did you find most interesting during the webinar?

3. What surprised you the most?

“2022 ICS/OT Cybersecurity Threat Landscape.” Dragos. https://hub.dragos.com/on-demand/2022-ics-cyber-threat-landscape

On the second page: 

• Slide 7 discusses the different types of intelligence. Pick a large cyber incident and provide examples (~2-2 sentences) of each type of intelligence about that incident. (You don’t need to provide actual IOCs, etc. just an example of what would constitute event intelligence, etc.

• Types of intelligence

• Event Intelligence–about an event

• Threat Intelligence–about a threat

• Tactical Intelligence–assesses real-time events, investigations, and other activities to provide day-to-day operational support, such as the development of signatures and Indicators of Compromise (IOCs)

• Operational Intelligence–assesses specific, potential incidents, events, investigations and/or activities and provides insights that can guide and support response operations

• Strategic Intelligence–assesses disparate bits of information to form integrated views for the purpose of informing decision and policy makers on broad or long-term issues and/or providing timely warning of threats

• I describe the 8 reasons you wouldn’t share it. Pick 4 of the reasons and explain, in 1-2 sentences why that reasons not to share is important.

• Reasons you wouldn’t share it:

• Limited by law (lawyers)/ regulations / classification or dissemination markings

• Cyber insurance rules prevent it

• Open yourself up to more vulnerabilities

• Hurt company financials (e.g., stock prices)

• Less valuable–crying wolf, quantity over quality (info not intel)

• Intel shared into the wrong hands

• 0day –too quickly and you tell bad guys about the vulnerabilities before the good guys can fix them, thereby hurting friends

• Pendulum swing– 180* turn based on limited info