I’m currently leading the Threat Intelligence program within Adobe, having been within the cybersecurity community for almost a decade, being part of Security Operations, Incident Response, and Security engineering teams.

I’m genuinely passionate about security intelligence and always eager to connect with other peers to share knowledge and ideas.

Intelligent Threat Intel – ‘LEAD’ Framework

‘Doing’ threat intelligence is important – but doing it right is critical. We have been using Threat Intelligence for many years as part of the SOC, Incident Response and Threat Hunting teams; these are some of the uses cases the most have mastered it. Applying threat intelligence outside of these use cases is where it can get problematic.

To tackle this problem, I created a Treat Intel framework that takes you out of your comfort zone and will LEAD you to the next level of using Threat Intelligence.

The LEAD framework is based on four fundamental principles:
• ReLevant
• Efficient
• Analysis Driven
• Deliverable

In this talk, I will cover how to tailor the Threat Intelligence for your needs; having relevant intelligence is the first step in making your Threat Intel program successful.  Then we will dive into the details on how to make it efficient by applying suitable scoring and categorization mechanisms, and this will help us in building a reliable Threat Intel database that we can deliver to the stakeholders.

Something that we don’t want from Threat Intelligence is being passive, and this is where we apply our ‘Analysis Driven’ principle, in other words, we want to get as much feedback as possible and use it for making our Threat Intelligence effective.

We will go into details on how to build an engine for a dynamic Threat database by using automation and machine learning.

At last, we can have the best Threat Intelligence, but if we cannot deliver it to our stakeholders is useless. The LEAD framework will help us tackle this area and provide the best of our threat intelligence.