• Online, Instructor-Led
Course Description

This three-day course explains how to apply the discipline of intelligence analysis to the cyber domain. The course covers strategic subjects such as the organizational role of cyber threat intelligence (CTI) and stakeholder analysis, as well as analytic practitioner skills development topics, such as understanding the intelligence lifecycle, developing raw data into minimally viable intelligence, and an introduction to cyber intelligence attribution.

Learning Objectives

After completing this course, learners should be able to: • Understand various definitions of threat intelligence and attribution • Distinguish between tactical, operational and strategic threat intelligence • Use tactical intelligence in the early stages of a cyber attack to evaluate data and correctly identify indicators that can be grouped into a set of related activity and attributed to a threat group • Gain insight into common errors that can occur when analyzing common forensic artifacts and interpreting information presented from various sources • Examine operational and strategic intelligence to determine the attribution and sponsorship of an attack operation • Understand how attribution analysis can provide crucial context to threat activity that enables more informed decisions and improved resource allocation • Understand why attributing cyber operations to a threat group can have significant implications — and even affect geopolitical dynamics • Consider attribution from a threat group’s point of view

Framework Connections

The materials within this course focus on the Knowledge Skills and Abilities (KSAs) identified within the Specialty Areas listed below. Click to view Specialty Area details within the interactive National Cybersecurity Workforce Framework.