Chapter 4: Threat Intelligence

Which of the following measures is not commonly used to assess threat intelligence?

• 1. Timeliness

• 1. Detail

• 1. Accuracy

• 1. Relevance

Answer explanation

While higher levels of detail can be useful, it isn't a common measure used to assess threat intelligence. Instead, the timeliness, accuracy, and relevance of the information are considered critical to determining whether you should use the threat information.

Nandita has encountered an attacker who appears to be using a commonly available exploit package to attack her organization. The package seems to have been run with default configurations against her entire public-facing Internet presence from a single system. What type of threat actor is she most likely facing?

• 1. An APT

• 1. A hacktivist

• 1. A script kiddie

• 1. A nation-state actor

Answer explanation

The lack of complexity and nuance most likely indicates that she has discovered an attack by an unskilled attacker, sometimes called a “script kiddie”.

Which of the following activities follows threat data analysis in the threat intelligence cycle?

• 1. Gathering feedback

• 1. Threat data collection

• 1. Threat data review

• 1. Threat intelligence dissemination

Answer explanation

Threat intelligence dissemination or sharing typically follows threat data analysis. The goal is to get the threat data into the hands of the organizations and individuals who need it.

Susan wants to start performing intelligence gathering. Which of the following options is frequently conducted in the requirements gathering stage?

• 1. Review of security breaches or compromises your organization has faced

• 1. Review of current vulnerability scans

• 1. Review of current data handling standards

• 1. Review of threat intelligence feeds for new threats

Answer explanation

Understanding what your organization needs is important for the requirements gathering phase of the intelligence cycle. Reviewing recent breaches and compromises can help to define what threats you are currently facing. Current vulnerability scans can identify where you may be vulnerable but are less useful for threat identification. Data handling standards do not provide threat information, and intelligence feed reviews list new threats, but those are useful only if you know what type of threats you're likely to face so that you can determine which ones you should target.

What organizations did the U.S. government help create to help share knowledge between organizations in specific verticals?

• 1. DHS

• 1. SANS

• 1. CERTs

• 1. ISACs

Answer explanation

The U.S. government created the information sharing and analysis centers (ISACs). ISACs help infrastructure owners and operators share threat information, as well as provide tools and assistance to their members.

Which of the following threat actors typically has the greatest access to resources?

• 1. Nation-state actors

• 1. Organized crime

• 1. Hacktivists

• 1. Insider threats

Answer explanation

Nation-state actors are government sponsored and typically have the greatest access to resources, including tools, money, and talent.

Organizations like Anonymous, which target governments and businesses for political reasons, are examples of what type of threat actor?

• 1. Hacktivists

• 1. Military assets

• 1. Nation-state actors

• 1. Organized crime

Answer explanation

Hacktivists execute attacks for political reasons, including those against governments and businesses. The key element in this question is the political reasons behind the attack.

Jason gathers threat intelligence that tells him that an adversary his organization considers a threat likes to use USB key drops to compromise their targets. What is this an example of?

• 1. His organization's attack surface

• 1. A possible attack vector

• 1. An example of adversary capability

• 1. A probability assessment

Answer explanation

Attack vectors, or the means by which an attacker can gain access to their target, can include things like USB key drops. You may be tempted to answer this question with adversary capability, but remember the definition: the resources, intent, or ability of the likely threat actor. Capability here doesn't mean what they can do but their ability to do so. The attack surface might include the organization's parking lot in this example, but this is not an example of an attack surface, and there was no probability assessment included in this problem.

What type of assessment is particularly useful for identifying insider threats?

• 1. Behavioral

• 1. Instinctual

• 1. Habitual

• 1. IOCs

Answer explanation

Behavioral assessments are very useful when you are attempting to identify insider threats. Since insider threats are often hard to distinguish from normal behavior context of the actions performed, such as after-hours logins, misuse of credentials, and logins from abnormal locations or in abnormal patterns, other behavioral indicators are often used.

Felix want to gather threat intelligence about an organized crime threat actor. Where is he most likely to find information published by the threat actor ?

• 1. Social media

• 1. Blogs

• 1. Government bulletins

• 1. The dark web

Answer explanation

Threat actors like criminal organizations frequently operate via the dark web. Forums operate as clearinghouses for information, resources, and access via TOR-hosted sites. While social media, blogs, or government bulletins may provide information about a criminal organization, more likely to publish information themselves on the dark web.