Cyber Security FAQ

The Cyber Kill Chain is a seven-stage model that describes the lifecycle of a cyberattack, enabling defenders to interrupt the process at any point.

The Diamond Model is a threat intelligence framework that visualizes intrusions using four vertices: Adversary, Capability, Infrastructure, and Victim, enabling analysts to map relationships and pivot from known facts to uncover further details about an attack.

The Pyramid of Pain ranks security indicators by the disruption they cause attackers, with TTPs (adversary behaviors) at the top being the most painful and costly to change, while hashes at the bottom are trivial.

Threat intelligence is utilized by diverse roles within an organization, including SOC analysts, threat hunters, and executives. Each user consumes intelligence tailored to their needs and operational tempo to make informed security decisions.

Threat intelligence provides foresight, enabling proactive defense. It helps organizations detect attacks earlier, focus resources effectively, and make better decisions, thereby reducing breach costs and impact.

Threat intelligence provides knowledge about attackers, while threat hunting is the active search for them within your environment. Intelligence guides the hunt, and hunting validates and enhances intelligence.

SOC teams leverage threat intelligence to add context to security alerts, enabling faster and more accurate decision-making. It helps distinguish real threats from noise, allowing analysts to prioritize and respond effectively.

IOCs are reactive forensic evidence of past breaches, while IOAs are proactive, real-time signs of ongoing attacks. Both are crucial for comprehensive threat detection and response.

TTPs (tactics, techniques, and procedures) are the structured description of how adversaries operate, focusing on their methods and goals rather than just indicators. They form the basis of threat intelligence and are harder for attackers to change than individual indicators.

Threat intelligence is categorized into four types: strategic, tactical, operational, and technical, each serving different audiences, timeframes, and purposes within an organization's security program.

Threat data is raw, unanalyzed facts like malicious IPs or hashes. Threat intelligence is that data after it's analyzed, contextualized, and tied to actionable decisions, signifying its meaning and the necessary response.

The ROI of threat intelligence is measured by tracking improvements in detection speed, response accuracy, and risk reduction. Key metrics like Mean Time to Detect (MTTD) and dwell time, when improved, can be translated into financial savings and avoided breach costs.

STIX is a language for describing cyber threats structurally, and TAXII is the protocol for automatically exchanging this STIX data between systems, enabling seamless threat intelligence sharing.

A threat intelligence feed provides a continuously updated stream of machine-readable data on cyber threats, enabling security tools to automatically detect and block malicious activity. These feeds offer indicators of compromise (IOCs) to enhance cybersecurity defenses.

Threat intelligence is categorized into four types: strategic, tactical, operational, and technical, each serving a distinct audience and timeframe. A comprehensive approach integrates all four for optimal security posture.