{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/threat-intelligence","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/threat-intelligence/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/threat-intelligence/"},"term":{"en":"Threat intelligence","da":"Threat intelligence"},"aka":{"en":["cyber threat intelligence","CTI"],"da":["trusselsefterretninger"]},"domain":["security"],"cluster":"risk-management","layer":"governance","status":"current","summary":{"en":"Up-to-date knowledge about current attackers and their methods, gathered so attacks can be stopped before they land.","da":"Opdateret viden om aktuelle angribere og deres metoder, indsamlet så angreb kan stoppes, før de rammer."},"body":{"formal":{"en":"Collected, checked and shared information about active threats - who is attacking, how, and with what signs - turned into advice an organisation can act on.","da":"Indsamlet, kontrolleret og delt information om aktive trusler - hvem der angriber, hvordan og med hvilke kendetegn - gjort til konkrete råd, som en organisation kan handle på."},"plain":{"en":"Like neighbours warning each other that burglars are trying car doors on the street tonight.","da":"Ligesom naboer, der advarer hinanden om, at der er tyve, som prøver bildøre på vejen i aften."},"inPractice":{"en":"A warning from CFCS names web addresses used in a new phishing wave against municipalities; a municipality's IT security team blocks them and adds them to the SIEM before any staff click.","da":"En varsling fra CFCS nævner webadresser, der bruges i en ny phishing-bølge mod kommuner; IT-sikkerhedsteamet i en kommune blokerer dem og lægger dem ind i SIEM'en, før nogen medarbejder klikker."},"whyItMatters":{"en":"It lets defenders act on what attackers are doing today instead of learning only after being hit.","da":"Den gør det muligt at handle på det, angriberne gør i dag, i stedet for først at lære det efter at være blevet ramt."}},"deepDive":{"en":"Threat intelligence is produced by the intelligence cycle borrowed from military and government practice: direction (defining intelligence requirements, the questions stakeholders need answered), collection, processing, analysis, dissemination and feedback. The distinction between data and intelligence lies in the analysis step: a list of malicious IP addresses is data; an assessment that a named ransomware affiliate is exploiting a particular VPN vulnerability against the organisation's sector, with detection guidance, is intelligence. Programmes without written requirements tend to become feed aggregators that generate alerts nobody can prioritise.\n\nOutput is commonly split by audience. Strategic intelligence informs leadership about actors, motives and trends; operational intelligence describes specific campaigns; tactical intelligence covers tactics, techniques and procedures (TTPs), typically mapped to MITRE ATT&CK; technical intelligence consists of indicators of compromise such as hashes, domains and IP addresses. David Bianco's Pyramid of Pain (2013) explains why the upper layers matter: hashes and IP addresses are trivial for an attacker to change, while detections built on tools and TTPs force costly changes in tradecraft. Indicators also have a short half-life, so feeds need ageing and expiry or they flood detection with false positives.\n\nSharing depends on common formats and handling rules. STIX 2.1 is the OASIS standard for representing threat objects and their relationships, and TAXII 2.1 is the companion protocol for exchanging them over HTTPS; MISP is a widely used open-source sharing platform. The Traffic Light Protocol, version 2.0 published by FIRST in 2022, marks how far information may be shared: TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN and TLP:CLEAR, the last replacing the former TLP:WHITE. NIST SP 800-150 gives guidance on establishing sharing relationships, and NIS2 Art. 29 provides for voluntary cybersecurity information-sharing arrangements between entities.\n\nISO/IEC 27001:2022 introduced Annex A control 5.7, Threat intelligence, requiring information about threats to be collected and analysed to produce threat intelligence, which ISO/IEC 27002:2022 divides into strategic, tactical and operational layers. In a mature organisation intelligence feeds several consumers: detection engineering, vulnerability prioritisation (which CVEs are actually being exploited), incident response, and risk management, where it updates likelihood estimates. It differs from the threat landscape, which is the aggregated picture over a period; intelligence is the continuous, requirement-driven flow that keeps that picture and day-to-day defences current.","da":"Threat intelligence produceres gennem efterretningscyklussen, som er lånt fra militær og statslig praksis: styring (fastlæggelse af efterretningsbehov, dvs. de spørgsmål, interessenterne skal have besvaret), indsamling, bearbejdning, analyse, formidling og feedback. Forskellen mellem data og efterretning ligger i analysen: En liste over ondsindede IP-adresser er data; en vurdering af, at en navngiven ransomwareaffiliate udnytter en bestemt VPN-sårbarhed mod organisationens branche, med vejledning i detektion, er efterretning. Programmer uden skriftlige efterretningsbehov ender ofte som samlesteder for feeds, der skaber alarmer, som ingen kan prioritere.\n\nProduktet opdeles normalt efter modtager. Strategisk efterretning informerer ledelsen om aktører, motiver og tendenser; operationel efterretning beskriver konkrete kampagner; taktisk efterretning dækker taktikker, teknikker og procedurer (TTP'er), typisk kortlagt til MITRE ATT&CK; teknisk efterretning består af kompromitteringsindikatorer (IoC'er) som hashværdier, domæner og IP-adresser. David Biancos Pyramid of Pain (2013) forklarer, hvorfor de øverste lag betyder mest: Hashværdier og IP-adresser er trivielle for en angriber at skifte, mens detektioner bygget på værktøjer og TTP'er tvinger angriberen til dyre ændringer i fremgangsmåden. Indikatorer har desuden kort halveringstid, så feeds skal have aldring og udløb, ellers drukner detektionen i falske positiver.\n\nDeling kræver fælles formater og regler for håndtering. STIX 2.1 er OASIS-standarden for at beskrive trusselsobjekter og deres relationer, og TAXII 2.1 er den tilhørende protokol til udveksling over HTTPS; MISP er en udbredt open source-platform til deling. Traffic Light Protocol, version 2.0 udgivet af FIRST i 2022, angiver, hvor bredt information må deles: TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN og TLP:CLEAR, hvor den sidste erstatter det tidligere TLP:WHITE. NIST SP 800-150 vejleder i at etablere delingsrelationer, og NIS2 art. 29 giver rammer for frivillige ordninger for udveksling af cybersikkerhedsinformation mellem enheder.\n\nISO/IEC 27001:2022 indførte kontrol 5.7 i bilag A, Threat intelligence, som kræver, at information om trusler indsamles og analyseres for at frembringe trusselsefterretninger, og som ISO/IEC 27002:2022 opdeler i et strategisk, taktisk og operationelt lag. I en moden organisation har efterretningerne flere aftagere: detektionsudvikling, prioritering af sårbarheder (hvilke CVE'er der faktisk udnyttes), hændelseshåndtering og risikostyring, hvor de opdaterer skønnene over sandsynlighed. Threat intelligence adskiller sig fra trusselsbilledet, som er det samlede billede over en periode; efterretningerne er den løbende, behovsstyrede strøm, der holder både billedet og det daglige forsvar opdateret."},"edges":[{"type":"requires","to":"security/threat","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/phishing","why":{"en":"Warnings about active phishing waves let senders and links be blocked before staff see them.","da":"Advarsler om aktive phishing-bølger gør det muligt at blokere afsendere og links, før medarbejderne ser dem."},"confidence":"medium","strength":"minor"},{"type":"used-with","to":"security/threat-landscape","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-150","tier":"standard"}],"draft":true}