Executive Summary
Strengthening Cyber Intelligence
Intelligence dates to ancient times when early civilizations used it to protect their assets and gain an advantage over their adversaries. Although the ways we perform the work of intelligence have changed, it remains as critical as ever. And this can be no truer than in the cyber domain. In performing cyber intelligence, we collect, compare, analyze, and disseminate information about threats and threat actors
seeking to disrupt the cyber ecosystem, one of our most critical assets. Through cyber intelligence, we know ourselves and our adversaries better. And with that knowledge, we can proactively take steps to better understand risks, protect against threats, and seize opportunities.
In 2013, the Software Engineering Institute (SEI) at Carnegie Mellon University conducted a study on behalf of the U.S. Office of the Director of National Intelligence to understand the state of cyber intelligence practices at organizations throughout the country. We conducted a similar study in 2018, and this report details our most recent findings.
We built on outcomes from the 2013 study to develop foundational concepts that drive the 2018 study. First, we define cyber intelligence as acquiring, processing, analyzing, and disseminating information that identifies, tracks, and predicts threats, risks, and opportunities in the cyber domain to offer courses of action that enhance decision making. Second, we propose a framework for cyber intelligence;
based on the intelligence cycle, its components provide for Environmental Context, Data Gathering, Threat Analysis, Strategic Analysis, and Reporting and Feedback. During the 2018 study, we interviewed 32 organizations representing a variety of sectors to understand their best practices and biggest challenges in cyber intelligence. During conversations guided by questions designed to elicit descriptive answers, we noted organizations’ successes and struggles and how they approached each component of the Cyber Intelligence Framework. We also provided an informal assessment of how well each organization was performing for certain factors within each component. We aggregated and analyzed these answers, grouping what participants told us into themes. This report moves through the Cyber Intelligence Framework, detailing our findings for each component.
Three companion implementation guides provide practical advice about artificial intelligence and cyber intelligence, the internet of things and cyber intelligence, and cyber threat frameworks.
Views: 1
