CREST Practitioner Threat Intelligence Analyst (CPTIA)

CPTIA Overview

The CREST Practitioner Threat Intelligence Analyst examination is the first certification in the CREST Threat Intelligence pathway. It proves the CTI analyst holds the fundamental skills and knowledge of both contextual analysis (focusing on social, cultural and geopolitical elements) and technical analysis (analysis of data relating to IOCs (Indicators of Compromise)).

A practitioner level Cyber Threat Intelligence Analyst is responsible for the collection and analysis of data, information and intelligence in order to generate threat intelligence outputs.

Practitioner - Competent to conduct routine assignments under supervision in structured environment.

CPTIA Syllabus

The CREST examination syllabus for CPTIA is broken down into 6 key areas, running from appendix A through to F. Within each appendix CREST defines a number of topics that should be covered.

The key concepts underlying intelligence-led cyber threat assessments.

A1 - Objectives of Threat Intelligence

Understand the key reasons why an organisation would want TI and how they would use it.

A2 - Terminology

Demonstrate familiarity with commonly used terms relating to TI and intelligence processes.

A3 - Threat Actor Types / Definitions

Be able to distinguish between different threat actors and their likely objectives.

A4 - Threat Vector & Vulnerability Types

Understand the definition of a threat vector, and demonstrate knowledge of key threat vectors. Understand the definition of a vulnerability and demonstrate knowledge of common vulnerability types.

A5 - The Intelligence Cycle

Be able to name the stages of the cycle, and explain the key processes that occur at each stage.

A6 - Analytic Models

Know the components of the Diamond Model, and understand the relationship between them.
Be aware of the meta-features of the model and be able to interpret them.

A7 - Attack Lifecycle

Understand the lifecycle of a typical attack, for example using a model such as the “Cyber Kill Chain”.

A8 - Understanding Risk

Demonstrate an understanding of the relationship between threat, capability, intent, and motivation.

Understanding how the direction and review processes influence the analyst’s workflow

B1 - Developing Terms of Reference

Be able to list the elements included in a typical Terms of Reference.
Know why Terms of Reference are important to have before beginning a job.

B2 - Importance of Project Review

Be aware of the criteria used to assess intelligence output (for example Timeliness / Accuracy / Presentation / Answering the IR etc.).
Understand why it is important to seek feedback on outputs

B3 - Dealing with Intelligence Gaps

Know what an intelligence gap is, and how to identify one.
Be able to identify likely sources of information to fill an intelligence gap.

Collection of data relevant to a customer’s intelligence requirements and turning it into a format suitable for analysis.

C1 - Function & Use of a Collection Plan

Know the key component parts of a collection plan and be able to interpret it effectively.

C2 - Use of a Collection Worksheet

Understand the benefit / necessity of recording collection activity.
Know what information a collection worksheet should contain (for example what sources were checked, what search terms were used, when, etc.)

C3 - Types of Sources

Understand different types of source and their broad classifications (HUMINT, OSINT, etc.).

C4 - Source Reliability and Grading

The ability to interpret source reliability grading / information reliability grading (based on the UK 5x5x5 model).

C5 - Specific Sources

Know what information can be obtained from typical technical sources such as WHOIS, DNS, malware analysis, social media, document metadata etc.
Understand the format of data and be able to interpret it accurately.

C6 - Boolean Search Strings

Ability to combine Boolean operators to form a precise search, as used by many search engines and proprietary products.

C7 - Basic Source Analysis

Understand reasons why some online sources are likely to be biased / inaccurate.

C8 - Operational Security (OPSEC)

Understand requirement for OPSEC and potential implications of failure.
Knowledge of anonymization tools such as Tor and i2p.
Understand the requirement to separate personal web use from work collection.
Know the appropriate course of action in the event of an OPSEC breach.

Understanding common approaches to analysis and potential pitfalls.

D1 - Hypothesis Testing

Ability to outline steps required to prove / disprove a hypothesis.

D2 - Facts, Assumptions, Premises & Inferences

Distinguish between facts and assumptions.
Make a logical inference from available premises.
Understand the requirement to identify assumptions and assessments as different from fact.

D3 - Expressing Likelihood / Certainty

Understand applicability of terms such as ‘possible’, ‘likely’ and ‘highly likely’.

D4 - Circular Reporting

Know what circular reporting is, and suggest ways in which it can be avoided.
Understand the importance of managing sources effectively to prevent this occurring.

D5 - Cognitive Biases

Identify some of the major types of bias that can affect intelligence analysis.
Know common ways in which analysts attempt to counter common biases.
D6 Analytical Techniques Be able to interpret data in graphical format, for example:

A network diagram
A timeline
A histogram
A scatterplot
A time series graph

Methods for disseminating intelligence product to consumers and for sharing intelligence with trusted members of the wider intelligence community

E1 - Structured / Machine Readable TI

Knowledge of STIX, CYBOX and TAXII and how they relate to each other.
Knowledge of the content and format of different types of STIX message.
Understanding of the advantages / disadvantages of machine readable TI.

E2 - Unstructured / Human Readable TI

Understanding of the key advantages / disadvantages of spoken and written dissemination.
Ability to select an appropriate dissemination mechanism, for example written product vs. verbal briefings.
Understanding of importance of accuracy, brevity, clarity.

E3 - Intelligence Sharing

Understanding of ‘Need to Know’ and ‘Need to Share’ concepts.
Ability to identify information that can / cannot be shared publicly.
Knowledge of common intelligence sharing initiatives.

Legal and ethical considerations arising from conducting intelligence-led engagements.

F1 - Understanding Requirement for Adherence to Legal / Ethical Standards

Identify examples of illegal and unethical behaviour.
Demonstrate understanding of repercussions of illegal / unethical behaviour.

F2 - Handling of Classified Material

Understand GPMS classifications and their meanings.
Understand the implications of breaching GPMS.
Demonstrate the correct course of action in the event of a breach of GPMS handling.

F3 - Key Legislation Pertaining to Intelligence Collection in the UK

Demonstrate working understanding of the constraints on intelligence collection operations imposed by:

Computer Misuse Act 1990
Human Rights Act 1998
Data Protection Act 1998
Police and Justice Act 2006
Official Secrets Act 1989
Telecommunications (Lawful Business Practice) (Interception of Communications) 2000
Regulation of Investigatory Powers Act 2000
Bribery Act 2010
Proceeds of Crime Act 2002

F4 - Dealing With Legal / Ethical Uncertainty.

Know appropriate action if given a task of questionable legality / ethics.

F5 - CREST Code of Conduct

Demonstrate understanding of code as it applies to the individual.

CPTIA Examination

The CREST Practitioner Threat Intelligence Analyst (CPTIA) exam is a 2-hour, computer-based, 120 question, multiple choice test and is taken in a Pearson Vue testing centre.

CREST use Pearson Vue test centres to ensure examinations are proctored correctly and in line with their standards. We highly recommend checking where your local Pearson Vue testing centre is in your country. To book your exam, go to the Pearson Vue website and navigate to the "For Test-Takers" section. Here you will be able to search for CREST and find your examination listed. If you haven't already done so, you will be asked to create an account to proceed with your booking.

CPTIA Training Provider

Given that you have landed on the arcX website, you have probably guessed by now that we do deliver a CPTIA training course, we just call it something different. The arcX Cyber Threat Intelligence Practitioner course is a CREST accredited training course delivering the whole CREST PTIA syllabus.

Cyber Threat Intelligence Practitioner

Develop fundamental skills and knowledge to operate as a Cyber Threat Intelligence Analyst. Learn to contribute towards intelligence projects, gather intelligence requirements, formulate collection plans, and produce actionable intelligence.