Interesting view. Also to the extent it can be integrated with some measure, and prediction of risk. Classic approaches for risk analysis calculates likely, statistical views in a context we are operating in. The notion of a 'Battlespace', to me indicates, that I have an adversarial agent, which likely has overlapping goals. Understanding threats and analyzing them is the first step to making something actionable. Actionable in context also means the role of the agent (human or AI, or likely augmented human) that can respond. Classification leads to better response.
Defining Your Cyber Battlespace With Threat Intelligence
By Daniel Kropp on October 4, 2018
A Conceptual Framework for Threat Intelligence
An intelligence preparation of the battlefield (IPB) is a method for defining and understanding a specific operating environment in all battlespaces — a conceptual framework to better understand how to apply your threat intelligence. It has a been a staple tool to help military leadership make decisions, and when the same methodology is applied to the cyber realm, the benefits can be tremendous. By providing a broad overview for cybersecurity decision makers to aid in strategy development, it helps answer the basic question, “What is my current state of security?”
It can also provide a tactical understanding that helps decision makers implement more effective mitigating controls. Everyone in cybersecurity constantly seeks “actionable” threat intelligence, but it’s critical to realize that what is considered actionable depends on the role of the person asking the question. A well developed IPB provides a level of understanding that benefits everyone from the C-suite to the Tier 1 SOC analyst. .... "
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment