> For the complete documentation index, see [llms.txt](https://abrahamreyes9.gitbook.io/cysa+/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://abrahamreyes9.gitbook.io/cysa+/1.0-threat-and-vulnerability-management/1.1-explain-the-importance-of-threat-data-and-intelligence.md).

# 1.1 Explain the importance of threat data and intelligence

* Intelligence sources:
* Open-source intelligence: publicly available information
* Proprietary/closed-source intelligence: info with restricted access (e.g. police record)
* Timeliness: tim ely receipt/operationalisation (impact > intelligence cost)
* Relevancy: mustaddress a threat and allow for effective action; usable delivery format
* Accuracy: must save organisations more in success than errors/mistakes
* Confidence levels
* Indicator management:
  * STIX: describes cyber threat information (motivation, abilities, capabilities, response)
  * TAXII: describes how threat info (STIX) can be shared (hub-and-spoke; source/subscriber; peer-to-peer); discovery, collection management, inbox, poll
  * OpenIOC: standard format for defining/recording/sharing artifacts
* Threat classification:
  * Known threat vs unknown threat: external/removable media, attrition, web, email, impersonation, improper usage, equipment loss/theft etc.
  * Zero-day: unknown vulnerabilities that have no patches
  * APT: skilled attackers supported by extremely large resources
* Threat actors:
  * Nation-state: geopolitically motivated groups with dedicated resources/personnel, extensive planning & coordination
  * Hacktivist: ideologically motivated groups that rely on widely available tools
  * Organised crime: profit-driven groups that target PII, credit cards etc.
  * Insider threat:
    * Intentional: disgruntled or profit-driven employee stealing/damaging/exposing systems
    * Unintentional: personal negligence/poor security practices
* Intelligence cycle:
  * Requirements: determine exact customer requirements (IRs), how it should be collected
  * Collection: gather data from wide array of desired/reliable/timely sources
  * Analysis: raw info + other sources => intelligence; assess importance/accuracy/reliability
  * Dissemination: timely conveyance of intelligence in appropriate format to customers
  * Feedback: solicit feedback from customer, refine existing IRs
* Commodity malware: widely available paid/free malware used by many threat actors
* Information sharing and analysis communities:
  * Healthcare: H-ISAC, Healthcare Ready
  * Financial: FS-ISAC
  * Aviation: A-ISAC
  * Government: EI-ISAC (elections), DIB-ISAC (defense), NEI (nuclear)
  * Critical infrastructure: E-ISAC (electricity), ONG-ISAC (oil & gas), PT-ISAC (public transit)