how to build a cyber intelligence capability - rsa · pdf filetalk contents objective share...
TRANSCRIPT
![Page 1: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/1.jpg)
Session ID:
Session Classification:
Stewart Kenton Bertram
Cyber Recon Manager: Verisign / iDefense
How to Build a Cyber Intelligence Capability
STAR-308
Intermediate
![Page 2: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/2.jpg)
Content taken from iDefense White Paper
“Establishing a Formal Intelligence Program”
Stewart Kenton Bertram June 2011
![Page 3: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/3.jpg)
Talk Contents
Objective
Share some thoughts on what a good model for a cyber intelligence team should look like in the private sector
Lessons learnt over the past years
3
![Page 4: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/4.jpg)
Talk Contents
Objective
Share some thoughts on what a good model for a cyber intelligence team should look like in the private sector
Lessons learnt over the past years
Contents
1.The socio-technical approach to intelligence team design
2.The growth of the influence of the intelligence team within the wider business context
3.Some points to consider – legal and reporting points
4
![Page 5: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/5.jpg)
What is a Socio-technical system?
“an approach to complex organizational work design that recognizes the interaction between people, information and technology in workplaces”
5
![Page 6: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/6.jpg)
People
Technology Information
![Page 7: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/7.jpg)
People
Technology Information
Capability
![Page 8: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/8.jpg)
People
Technology Information
Capability
![Page 9: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/9.jpg)
“Who should staff this theoretical team them?”
9
![Page 10: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/10.jpg)
![Page 11: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/11.jpg)
Computer
Science Folk
![Page 12: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/12.jpg)
Computer
Science Folk
Former
Military
![Page 13: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/13.jpg)
Computer
Science Folk
Former
Military
Social
Science
![Page 14: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/14.jpg)
Computer
Science Folk
Former
Military
Social
Science
![Page 15: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/15.jpg)
15
Counter Insurgency (COIN)
•Battle for hearts and minds
•Human Terrain Analysis
![Page 16: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/16.jpg)
![Page 17: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/17.jpg)
![Page 18: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/18.jpg)
![Page 19: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/19.jpg)
![Page 20: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/20.jpg)
![Page 21: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/21.jpg)
![Page 22: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/22.jpg)
![Page 23: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/23.jpg)
![Page 24: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/24.jpg)
![Page 25: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/25.jpg)
![Page 26: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/26.jpg)
![Page 27: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/27.jpg)
Computer
Science Folk
Former
Military
Social
Science
![Page 28: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/28.jpg)
Computer
Science Folk
Former
Military
Social
Science
![Page 29: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/29.jpg)
29
![Page 30: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/30.jpg)
30 How many possible connections can be made within this
group?
![Page 31: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/31.jpg)
31
Clustering Coefficient
N * (N - 1) / 2
![Page 32: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/32.jpg)
25 * (25 - 1) / 2 = 300
![Page 33: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/33.jpg)
However…consider this
John P. Reed
the utility of large networks, particularly social networks, can scale exponentially with the size of the network.
33
![Page 34: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/34.jpg)
![Page 35: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/35.jpg)
![Page 36: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/36.jpg)
33 Million possible combinations!!!!!!!!!
![Page 37: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/37.jpg)
![Page 38: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/38.jpg)
![Page 39: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/39.jpg)
![Page 40: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/40.jpg)
People
Technology Information
Capability
![Page 41: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/41.jpg)
People
Technology Information
Capability
![Page 42: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/42.jpg)
42
![Page 43: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/43.jpg)
43
Levels of Intelligence product
![Page 44: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/44.jpg)
44
Levels of Intelligence product
Critical Intelligence
“Mr President the missiles are in flight!”
![Page 45: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/45.jpg)
45
Levels of Intelligence product
Critical Intelligence
Significant Intelligence
“Iran may be developing a nuclear
weapons capability ”
![Page 46: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/46.jpg)
46
Levels of Intelligence product
Critical Intelligence
Significant Intelligence
Contextual Intelligence
“Country X’s long term political goals
could bring us into conflict with them in
the next 20 years”
![Page 47: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/47.jpg)
47
Levels of Intelligence product
Critical Intelligence
Significant Intelligence
Contextual Intelligence Intelligence Product
![Page 48: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/48.jpg)
48
Change In Behavior Within The Decision Maker
Critical Intelligence
Significant Intelligence
Contextual Intelligence Intelligence Product
![Page 49: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/49.jpg)
49
Direct Levels of Intelligence Team Effort
Intelligence Product
Behavioral Influence Team Effort
![Page 50: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/50.jpg)
50
Technical Automaton VS Human Talent
Intelligence Product
Behavioral Influence
Trade Craft and Talent
Team Effort
Structures , Procedures
and technology
![Page 51: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/51.jpg)
People
Technology Information
Capability
![Page 52: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/52.jpg)
Data
Information
Intelligence
![Page 53: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/53.jpg)
Data
Information
Intelligence
![Page 54: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/54.jpg)
Data
Information
Intelligence
Collection Collection
![Page 55: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/55.jpg)
Data
Information
Intelligence
Analysis
Collection Collection
![Page 56: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/56.jpg)
Data
Information
Intelligence
Analysis
Collection Collection
Dissemination
![Page 57: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/57.jpg)
Data
Information
Intelligence
Analysis
Collection Collection
Dissemination
![Page 58: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/58.jpg)
Data
Information
Intelligence
Analysis
Collection Collection
Dissemination
Risk: Strategic Surprise!
![Page 59: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/59.jpg)
Data
Information
Intelligence
Analysis
Collection Collection
Dissemination
The Up The Pyramid Principle
![Page 60: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/60.jpg)
Data
Information
Intelligence
Analysis
Collection Collection
Dissemination
![Page 61: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/61.jpg)
People
Technology Information
![Page 62: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/62.jpg)
“Why are we even discussing an intelligence capability in the first place?”
62
![Page 63: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/63.jpg)
“Why are we even discussing an intelligence capability in the first place?”
63
![Page 64: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/64.jpg)
“Why are we even discussing an intelligence capability in the first place?”
64
![Page 65: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/65.jpg)
“Why are we even discussing an intelligence capability in the first place?”
“Is Cyber Threat posing a greater threat than it was 10 years ago?”
65
![Page 66: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/66.jpg)
“Why are we even discussing an intelligence capability in the first place?”
“Is Cyber Threat posing a greater threat than it was 10 years ago?”
66
Contextual Change
![Page 67: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/67.jpg)
“Why are we even discussing an intelligence capability in the first place?”
“Is Cyber Threat posing a greater threat than it was 10 years ago?”
YES
67
![Page 68: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/68.jpg)
“Why are we even discussing an intelligence capability in the first place?”
“Is Cyber Threat posing a greater threat than it was 10 years ago?”
YES
BUT
68
![Page 69: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/69.jpg)
“Why are we even discussing an intelligence capability in the first place?”
“Is Cyber Threat posing a greater threat than it was 10 years ago?”
YES
BUT
Due to the contextual change of the importance of cyber space to Western Society
69
![Page 70: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/70.jpg)
Effect on the intelligence team within the wider business context
![Page 71: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/71.jpg)
Effect on the intelligence team within the wider business context
A Corps – Circa 1990
![Page 72: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/72.jpg)
Effect on the intelligence team within the wider business context
A Corps – Circa 1990
Sales
HR
Marketing
PR
Risk
IT
Physical Security
![Page 73: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/73.jpg)
Effect on the intelligence team within the wider business context
73
A Corps – Circa 1990
Sales
HR
Marketing
PR
Risk
IT
Physical Security
Intelligence Team
![Page 74: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/74.jpg)
Effect on the intelligence team within the wider business context
74
A Corps – Circa 2012
Sales
HR
Marketing
PR
Risk
IT Physical Security
Intelligence Team
![Page 75: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/75.jpg)
Talk Contents
Objective
Share some thoughts on what a good model for a cyber intelligence team should look like in the private sector
Lessons learnt over the past years
Contents
1.The socio-technical approach to intelligence team design
2.The growth of the influence of the intelligence team within the wider business context
3.Some points to consider – legal and reporting points
75
![Page 76: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/76.jpg)
Talk Contents
Objective
Share some thoughts on what a good model for a cyber intelligence team should look like in the private sector
Lessons learnt over the past years
Contents
1.The sociotechnical approach to intelligence team design
2.The growth of the influence of the intelligence team within the wider business context
3.Some points to consider – legal and reporting points
76
![Page 77: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/77.jpg)
![Page 78: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/78.jpg)
https://www.facebook.com/muslimdefenceleague
![Page 79: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/79.jpg)
![Page 80: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/80.jpg)
• Social Media Intelligence
“SOCMINT”
• “SOCMINT is not yet
capable of making a
decisive contribution to
public security and
safety.”
• “SOCMINT does not fit
easily into the existing
systems we have
developed to ensure
intelligence collected can
be confidently acted on.”
![Page 81: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/81.jpg)
• Social Media Intelligence
“SOCMINT”
• “SOCMINT is not yet
capable of making a
decisive contribution to
public security and
safety.”
• “SOCMINT does not fit
easily into the existing
systems we have
developed to ensure
intelligence collected can
be confidently acted on.”
![Page 82: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/82.jpg)
• “SOCMINT does not fit
easily into the existing
systems we have
developed to ensure
intelligence collected can
be confidently acted on.”
![Page 83: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/83.jpg)
• “SOCMINT does not fit
easily into the existing
systems we have
developed to ensure
intelligence collected can
be confidently acted on.”
Legal
Reporting
![Page 84: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/84.jpg)
![Page 85: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/85.jpg)
![Page 86: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/86.jpg)
![Page 87: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/87.jpg)
![Page 88: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/88.jpg)
![Page 89: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/89.jpg)
![Page 90: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/90.jpg)
Public Place?
Private Place?
Something Else? Expectation of privacy?
1st Question 2nd Question
![Page 91: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/91.jpg)
• “SOCMINT does not fit
easily into the existing
systems we have
developed to ensure
intelligence collected can
be confidently acted on.”
Legal
Reporting
![Page 92: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/92.jpg)
Some Thoughts on SOCMINT
SOCMINT is a combination of two intelligence disciplines
Signals Intelligence (SIGINT): the communication element of the medium
Human Intelligence (HUMINT): the message element of the medium
The 5 x 5 x 5 intelligence grading system is ideal for SOCMINT reporting
SO WHAT?: If done write then OSINT based intelligence can have a far greater penetration rate within an organization than other closed sources of inelligence
![Page 93: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/93.jpg)
5x5x5 according to the NIM
![Page 94: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/94.jpg)
5x5x5 according to the NIM
![Page 95: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/95.jpg)
5x5x5 according to the NIM
![Page 96: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/96.jpg)
5x5x5 according to the NIM
![Page 97: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/97.jpg)
5x5x5 according to the NIM
![Page 98: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/98.jpg)
5x5 example
1/ A 2/ B 3/ C 4/ D 5/ E
Intel Evaluation
Source Evaluation
Grade: Not know to the source but externally corroborated, Unreliable
![Page 99: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/99.jpg)
Some concluding though on Open Source Intelligence
OSINT Is not for the “new guy”
Established models of best practice in other intelligence disciplines
99
![Page 100: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/100.jpg)
Final concluding point on developing a cyber intelligence capability
100
![Page 101: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/101.jpg)
Final concluding point on developing a cyber intelligence capability
“If today is the information age then tomorrow will be the intelligence age”
101
![Page 102: How to Build a Cyber Intelligence Capability - RSA · PDF fileTalk Contents Objective Share some thoughts on what a good model for a cyber intelligence team should look like in the](https://reader031.vdocuments.net/reader031/viewer/2022022418/5a700fcb7f8b9a93538b9f67/html5/thumbnails/102.jpg)
Questions?