Introduction to Threat Intelligence and Attribution

After completing this course, learners should be able to: • Understand various definitions of threat intelligence and attribution • Distinguish between tactical, operational and strategic threat intelligence • Use tactical intelligence in the early stages of a cyber attack to evaluate data and correctly identify indicators that can be grouped into a set of related activity and attributed to a threat group • Gain insight into common errors that can occur when analyzing common forensic artifacts and interpreting information presented from various sources • Examine operational and strategic intelligence to determine the attribution and sponsorship of an attack operation • Understand how attribution analysis can provide crucial context to threat activity that enables more informed decisions and improved resource allocation • Understand why attributing cyber operations to a threat group can have significant implications — and even affect geopolitical dynamics • Consider attribution from a threat group’s point of view