Beyond technical data - a more comprehensive situational awareness fed by available intelligence information

Abstract

P. Brangetto, M.Maybaum, J.Stinissen (Eds.) 2014 © NATO CCD COE Publications, Tallinn Permission to make digital or hard copies of this publication for internal use within NATO and for personal or educational use when for non-profi t or non-commercial purposes is granted providing that copies bear this notice and a full citation on the first page. Any other reproduction or transmission requires prior written permission by NATO CCD COE.The views and opinions expressed in this article are those of the authors and do not necessarily refl ect the offi cial policy or position of any agency of the government. Examples within this article are based only on very limited and dated open source information. Assumptions made within the analysis are not refl ective of the position of any government entity.

Automated Dataset Generation System for Collaborative Research of Cyber Threat Analysis

“…During the analysis and production step, all processed information is integrated, evaluated, analyzed, and interpreted to produce intelligence. Kornmaier and Jaouën insisted that, to generate operational or strategic intelligence beyond tactical information, which is technical in nature, the threat data should be fused with data collected from different disciplines such as Human Based Intelligence (HUMINT), Imagery Intelligence (IMINT), Signal Intelligence (SIGINT), and Geographic Intelligence (GeoINT) [21].…”

Business Process Reengineering of an Information Exchange Management System for a Nationwide Cyber Threat Intelligence

“…The three level of intelligence is translated into three different activities in the decomposition because they are carried out by different level of analyst and also produces three different outputs. The pyramid also shows that the to produce strategic intelligence, the decision makers cannot consume CTI directly, they need aggregated high level data, therefore before any CTI can be consumed by the top level managements it must be sorted, grouped, fusion and present it in a visual manner [14]. To accommodate those needs a CTI visualization, fusion and presentation activity to be added before the CTI is passed to the strategic CTI analysis.…”

“…The quality checking and acceptance activity is the only activity that is not in the intelligence lifecycle that is included in the business process, the reason behind adding an extra activity is that interoperability and automation is one of the biggest challenge in CTI information sharing [14] that needs to be addressed. The nationwide CTI information exchange has to accommodate various security tools and products that the actors uses, the CTI that it disseminates must be a true actionable intelligence that could be used to auto configure security products for a fast mitigation of a cyber security threat.…”

Architecture for the Cyber Security Situational Awareness System

“…The intelligence information might offer early warning information about incoming threats or information needed for incident response. Paper [20] states that pure technical data is just a part of bigger situational awareness fused with intelligence information.…”