Cyber Threat Intelligence 101

You define cyber threat intelligence in your own words and, more importantly, work out what it actually does: turning gathered threat information into actionable advice that guides security decisions. Through a new analyst's first morning you decide what qualifies as intelligence, whether to focus on yesterday's attack or tomorrow's, and how to describe the purpose of a programme to a manager. You explore how organisations use CTI, the levels of intelligence for different audiences, and the day-to-day role and responsibilities of a CTI analyst.

• You will explain the difference between reacting to current threats and preparing for potential ones
• You will describe how organisations use CTI to prioritise resources and improve incident response
• You will outline the roles and responsibilities of a CTI analyst, from setting intelligence requirements to presenting findings
• You will see why credible, actionable advice is the core measure of an analyst's work

You take the loaded word 'hacker' apart, tracing it back to the MIT Tech Model Railroad Club, and separate white, grey and black hat activity by intent rather than ability. From there you break black hat actors into nation-state operatives, cyber criminals and hacktivists such as Anonymous, and learn why the lines between them are blurring. You meet the CIA triad and study Mandiant's influential APT1 report to understand how advanced persistent threats operate, exfiltrate and reveal themselves.

• You will classify hackers by intent across white, grey and black hat categories
• You will distinguish nation-state actors, cyber criminals and hacktivists and their motives
• You will explain Confidentiality, Integrity and Availability and how organisations weight them
• You will draw practical lessons from the Mandiant APT1 report on how persistent threat groups behave
• You will see why researching threat actors is central to a CTI analyst's curiosity

You learn what threat vectors and vulnerabilities look like from an organisation's perspective and how to think about the corporate attack surface as the sum of every possible entry point. Using the analogy of a house with its doors, windows and vents, you see how identifying weaknesses lets you prioritise the most pressing threats. The SolarWinds Orion compromise anchors the module, showing how a single supply-chain vulnerability rippled out to thousands of organisations and even government.

• You will define the corporate attack surface and why mapping it matters
• You will use the house analogy to identify and prioritise potential entry points
• You will examine supply-chain vulnerabilities through the SolarWinds Orion attack
• You will connect attack-surface understanding to mitigation strategy

You walk the intelligence cycle, the framework at the core of CTI, from defining what information is needed through collection, processing, analysis and dissemination. You see how raw data from sources like OSINT, proprietary databases and sensor networks is verified, fused and turned into a coherent picture. You learn how results feed back to inform the next round of collection, keeping an organisation's view of the threat landscape current.

• You will describe each stage of the intelligence cycle in order
• You will identify data sources used in the collection phase, including OSINT
• You will explain the purpose of the dissemination phase for stakeholders
• You will understand why the cycle is continuous and feeds its own future collection

You draw the line between laws as society's rules and ethics as personal or organisational codes, and see why breaching internal guidelines can cost you your job even without legal consequence. You are introduced to the key UK legal articles a CTI analyst should know, from the Computer Misuse Act 1990 to the Data Protection Act, aligned with CREST exam requirements. The Zoetop breach behind Shein and Romwe shows how concealing an incident led to a fine and why honest, early disclosure limits the damage.

• You will distinguish laws from ethics and organisational guidelines
• You will recognise the key UK legal articles relevant to CTI work
• You will understand why blurred legal and ethical lines demand an analyst's caution
• You will draw lessons on breach disclosure from the Zoetop Shein and Romwe case