Source: [LinkedIn](https://www.linkedin.com/pulse/threat-intelligence-ask-gerardus-blokdyk/)  
Author: [Gerardus Blokdyk](https://www.linkedin.com/in/gerardblokdijk/)  
Publication date: February 13, 2022
Retrieved from on February 14, 2022

Relevant ISO 27001 clauses/controls:
- [[ISO 27001 C 9.2 Internal audit]]
- [ISO 27001 A 18 Compliance](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%2018%20Compliance.md)

Related:
- [Checklist for auditing Threat Management](Checklist%20for%20auditing%20Threat%20Management.md)

# # Threat Intelligence: Ask This

1. Does your organization have a cyber threat intelligence program and attack monitoring/alert process?

2. What threat intelligence information sharing protocols does your organization use to share and disseminate threat intelligence data?

3. How does your organization collect and share threat intelligence that may be useful in mitigating cyber threat risk?

4. What security measures does your organization employ to keep your threat intelligence secure?

5. How does your organization enrich the data collected with threat intelligence and GeoIP data to enhance the analysis process for higher fidelity and lower false positive alerts?

6. What tools does your organization use to receive Cyber Threat Intelligence from other companies?

7. How confident are you in the security of sending your organizations threat intelligence data to the cloud for analysis (i.e., log files)?

8. What value does threat intelligence bring to your organizations overall security strategy?

9. Who is responsible for implementing a threat intelligence program that integrates across your security technologies, teams, and executive cyber risk decisions?

10. What sources of cybersecurity threat intelligence does your organization receive?

11. By what percentage have security breaches been reduced because of using threat intelligence solutions?

12. Do you utilize a security command center platform to update and manage your firewall and related Cyber Threat Intelligence services?

13. What cyber threat intelligence sources do you rely on to get information about the issues facing your organization?

14. Does your organization have a role in verifying the quality of threat intelligence sent or received?

15. Does your threat intelligence inform and enhance security planning, vulnerability management, and incident response activities?

16. Do you have a robust, forwardleaning strategy to incorporate threat intelligence into your security approach?

17. How many cyber attacks that eluded traditional defenses have you been able to discover because of threat intelligence from internal and external sources?

18. How does threat intelligence support situation awareness in response to cyber attacks?

19. Many early threat intelligence services focused on general security data, identifying malware indicators and tracking malicious sites, how does that apply to your environment?

20. Do you have metrics to evaluate the quality of the threat intelligence provider and the information received?

21. Does your organization have dedicated threat intelligence analysts and researchers?

22. What effect on information security was due to the combination of threat intelligence and situation awareness?

23. How do you share information cyber threat intelligence between public and private sectors?

24. Which indicators of compromise and threat intelligence does your organization respond to first?

25. If your organization consolidates threat intelligence from multiple solutions, does the process utilize an automated platform?

26. Are regular threat intelligence briefings provided to onsite Information Security staff?

27. Does your cybersecurity include network, mobile, data, app, and IoT security relying on worldwide network threat intelligence based on petabytes of data?

28. Does your threat intelligence platform integrate data from the platform into an endpoint security system?

29. If you employ a SIEM, does it have a native threat intelligence solution or offer an add on for one?

30. How do you assess your organizations ability to operationalize, or employ threat intelligence within its cyber defenses?

31. How does your organization measure the quality of the threat intelligence it receives?

32. Does threat intelligence drive decision making within your organizations security operations center?

33. Does your organization integrate threat intelligence data with its SIEM and/or IDS/IPS?

34. How is collaboration of users on managing cyber threat intelligence data supported?

35. Are procedures in place to disseminate threat information and intelligence products to higher/subordinate activities and other organizations (during duty and non duty hours)?

36. Does your organizations threat intelligence influence your security awareness training decisions?

37. Is threat intelligence used to educate/brief your organizations board of directors about cyber risks?

38. Does your organization consolidate threat intelligence data from multiple solutions?

39. Does your organization test its incident response plan regularly and update it as needed based on Cyber Incidents that have occurred and Threat Intelligence?

40. Can investigatory teams seeking to establish operator identities and methods get access to more data from threat intelligence and incident response efforts conducted by specialist companies?

41. What threat intelligence activities and technologies are most important in your ability to plan preventive measures, detect threats, and resolve security incidents?

42. What is the single biggest deficiency of the threat intelligence upon which your organization currently relies?

43. Do you apply threat intelligence to customer security alerts as part of your process for vetting or determining if an alert should be escalated to security event status and action taken?

44. Is your organization using threat intelligence to enhance the security in real time or in post attack analysis?

45. How is your organization managing the integration of different threat intelligence data sources?

46. Is your security infrastructure integrated so that threat intelligence can be shared in real time across all security elements?

47. What threat intelligence feeds does the MSSP use that are relevant to your business, and can it tailor its threat intelligence to cover specific indicators you provide?

48. Does your organization have a dedicated threat hunting team within its IT Security function?

  

## Organized by Key Themes: SECURITY, DATA, MANAGEMENT, INTELLIGENCE, CYBER, THREAT, TECHNOLOGY, SYSTEMS, TOOLS:

  

### SECURITY:

  

How can existing information standards be used to support incentive based cyber trust?

Ensure your team is involved in these the following Information Security programs areas: Endpoint Protection, Risk Management, Threat Management, Incident Management and/or Security Engineering and Operations Support. 

  

Do you have bespoke software (for monitoring, collective, analysing, and sharing data)?

Be certain that your team executes and improves the core functions of incident response including: threat detection and prevention, incident response, systems and network security monitoring, forensics and vulnerability management at enterprise scale. 

  

Are all your Data Privacy policies updated on a regular basis and how do you check that some are effective?

Make headway so that your design collaborates with the Information Security organization, other Ascend technology teams and third party vendors to ensure threat intelligence is being shared and alerts, processes and technologies are updated accordingly. 

  

How difficult/costly will it be to enhance monitoring of access points in the supplier networks?

Develop experience working with a variety of security-related platforms and services, including: SIEM systems, Threat Intelligence platforms, Security Orchestration, Automation and Response (SOAR) solutions, and other network and system monitoring tools. 

  

Has threat changed significantly to require a re assessment/change to the modular design?

Be sure your process manages all aspects of security disciplines: Information security, software development, vulnerability assessments, threat analysis, incident response, threat modeling, security intelligence and forensic investigations. 

  

How can managed service providers, technology, and information security leaders within smb markets build a program that can quickly recapture costs and poor decisions?

Administer and maintain security systems in the cybersecurity security operations center (CSOC) technology stack, including the security information and event management (SIEM) environment; OT and IT network intrusion detection systems (IDS); endpoint detection and response (EDR) tool; security orchestration, automation, and response (SOAR); cyber threat intelligence platform (TIP); and full packet capture (PCAP) servers across your service territory. 

  

How will corresponding advances affect approaches to areas as cybersecurity and cryptography?

Be certain that your team analysis and response: collects and analyzes threat intelligence to prepare the rest of your security team against emerging threats and to optimally respond to security incidents. 

  

How frequently does your organization conduct full network active vulnerability scans?

Certify your organization advises on Cybersecurity defense and leverages solutions to deliver operational services, including network intrusion, detection and prevention, security events, data spillage, and incident response actions. 

  

How do you tackle the most complex business problems using data?

Assure your organization implements, and models security practices for enterprise and cloud environments using an intelligence and threat driven defense model. 

  

How do you focus on your people to develop organizational preparedness for an attack?

Develop experience integrating threat intelligence data into security operations teams. 

  

### DATA:

  

Are you required to provide specific consumer protection services as identify theft insurance and/or credit monitoring?

Develop experience working with SIEM systems, Endpoint Detection and Response (EDR) solutions, threat intelligence platforms, security automation and orchestration solutions, intrusion detection and prevention systems (IDS/IPS), Data Loss Prevention and other network and security monitoring tools. 

  

How would your capability change if the timeframe metrics were increased or decreased?

Be sure your team provides expertise and leadership to utilize threat intelligence and reporting capabilities to analyze data from multiple feeds to better detect and respond to cyber attacks and decrease risk to assets or data. 

  

How do you believe AI could improve your organizations cybersecurity?

Characterize and analyze threat intelligence data to identify potential cyber related information that could impact your organization. 

  

Is the role of your organizations personnel to keep track of all of the active threat actors, intentions and active attacks?

Identify and track targeted intrusion cyber threats, trends, and new developments by cyber threat actors through analysis of raw intelligence and data. 

  

What reporting mechanisms are there in place for staff to report any suspicious activity?

Operationalize Cyber Threat Intelligence data gathering, reporting, and analysis activities. 

  

How do you assess your organizations ability to operationalize threat intelligence?

Check that your team is authoring reports and generating complete, actionable, relevant, and timely threat intelligence from OSINT, organization, and vendor supplied information and data sources. 

  

How do you identify the devices on the Enterprise network?

Evaluate technical cyber intelligence and complex structured and unstructured data to identify malicious and foreign cyber threats targeting organization personnel, technologies, and networks. 

  

Does it practice good cyber hygiene, a set of steps and best practices it can take to prevent attacks?

Research repository: collaborate with corporate strategic development team to support the design, organization, development and safeguarding of an organizational knowledge management system for market and competitive intelligence data. 

  

How would you rate the value received from the integration of your organizations threat intelligence platform and SIEM?

Ensure you have applied knowledge across all critical elements and common data types used in threat intelligence analysis, including malware used in targeted adversary campaigns; host and log forensics including methods of data collection and analytic techniques; and network forensics including common protocols and how those are used in adversary operations. 

  

Do you correlate internal activity with relevant threat intelligence beyond your perimeter to more quickly identify advanced attacks?

Consolidate and conduct a comprehensive analysis of threat intelligence data obtained from classified, proprietary, and open-source resources to provide indications and warnings of impending attacks against unclassified and classified networks. 

  

### MANAGEMENT:

  

How will advances in technology (e.g., artificial intelligence, Internet of Things, etc.) or other factors affect the cybersecurity workforce needed in the future?

Create and manage cyber security strategy, programs and execution including threat management services such as vulnerability assessments, threat intelligence, analysis and response, security event monitoring and incident management, digital forensics etc. 

  

How do customers submit requirements and provide feedback to support more relevant intelligence?

Utilize and customize your threat management platform in order to provide a tailored intelligence involvement for your (internal) clients. 

  

How has the NIS Directive improved notification of cyber incidents in critical sectors and beyond?

Integrate internal and external threat intelligence data in SOC functions and tools to improve the efficacy of vulnerability and threat management. 

  

Which technique would you recommend to a multidisciplinary team that is missing a discipline?

Evaluate and recommend threat intelligence and vulnerability management options. 

  

Does your organization have cyber insurance that protects it from theft or misuse of electronic data, customer records, etc?

Safeguard that your design forensics Threat Intelligence Penetration Testing Vulnerability Management Purple Teaming etc. 

  

What tools does your organization use to receive Cyber Threat Intelligence from other companies?

Ensure you can also leverage the cloud to enhance security through simplified policy management and dynamic threat intelligence. 

  

What are other organizations doing to adapt the cybersecurity measures to the changing requirements?

Make sure there is involvement with Vulnerability Management and Threat Intelligence or Threat Modeling. 

  

How do you get started with the digital transformation as your organization leader?

Take the lead in form threat Intelligence, Incident Response and Vulnerability Management. 

  

Is there someone in your organization that might understand the risks involved better than you?

Verify that your operation is involved in threat intelligence and persistent threat identification/management. 

  

How do you meet the need for reporting that is accurate, timely, and helpful?

Provide recommendations, technical guidance, architecture, installation, configuration, and/or operation for solutions used across the entire lifecycle of vulnerability management including vulnerability identification, threat intelligence, assessment, patching and remediation, exception management, secure configuration management, and reporting as well as the integration of these various solutions and technologies. 

  

### INTELLIGENCE:

  

What should be considered from a market perspective when developing a long term business plan?

Make sure the Security Threat Intelligence Team is responsible for developing innovative detection capabilities for threats against identity. 

  

What types of reports, outputs, data and deliverables should systems and analysts be expected to produce?

Develop and operate a team which is able to produce higher value and more actionable security and threat intelligence than is otherwise available through market threat intelligence vendors. 

  

What is the quantity of threat intelligence that your organization currently receives daily in the form of threat indicators from your various feeds?

Safeguard that your design hunts for indicators of compromise using various toolsets, and provides initial analysis of security intelligence feeds relative to network traffic analysis, intrusion detection, offensive security, data science and predictive analytics. 

  

Are regular threat intelligence briefings provided to onsite Information Security staff?

Research includes developing techniques in analysis, visualization, testing, and representation of all aspects of network cybersecurity; applying new and emerging techniques to the open-source cyber intelligence domain; and maintaining a data and analysis infrastructure to provide unique insights into the evolution of techniques in malware design and network security. 

  

How do you get started with the digital transformation as your organization leader?

Lead agile team of software security researchers in the discovery, analysis, and capability integration for the cyber intelligence operations community. 

  

What percentage of the current years IT Security budget will go to activities relating to threat intelligence operations both internal and external combined?

Produce all-source cyber intelligence analysis using various industry and organization tools, available classified and unclassified data sets, and accepted methodologies for assessing network traffic; identify, investigate and analyze cyber events of intelligence significance; and collect data, analyze results, and prepare intelligence products relating to cyber mission objectives. 

  

What best practices enable organizations to respond to cyber incidents effectively?

Lead and perform investigations to respond to threat detection and intelligence requests utilizing threat hunting or intelligence analysis best practices. 

  

How do you perform root cause analysis?

Work with your Threat Intelligence feeds and solutions to identify threats, develop or recommend countermeasures, and perform advanced network and host analysis in the event of a compromise. 

  

Do you trust new digital opportunities & transform without compromising your critical assets?

Make headway so that your organization develops models for identifying incident-type activity, of malware or bad actors, using statistical/advanced analytic tools; shares indicators of compromise (IOC) models with trusted parties for validation and collaboration; synthesizes and places intelligence information into context; communicates the nature, impact and mitigations for applicable security vulnerabilities. 

  

Is there a way to give better tools to organization heads through policy than exist now?

Liaison so that your team partners with other Information Security teams to evaluate and advance capabilities in mutual teams and through intelligence initiatives drives enhanced security capabilities across your organization. 

  

### CYBER:

  

What is the system support needed to make surrogate use seamless and minimally intrusive for a user?

Develop experience performing focused research and analysis to write complete, accurate, relevant and timely cyber threat intelligence reports to support network defense. 

  

What is the claims investigation, if any, that you conduct following a cybersecurity incident?

Diagnose collaborate with your cyber intelligence team and partners to share threat intelligence and response methods to strengthen your defenses and invest in the development and improvement of incident response processes. 

  

Who has the authority to enter information into the system, and how will entries be audited?

Be sure your process has hands on involvement working with Incident Response and Cyber Threat Intelligence functions. 

  

How much of a concern should you have about protecting data from foreign adversaries?

Serve on a team of Cyber threat analysts responsible for the 24x7 analyses and response to Cyber threat activity to protect client information resources. 

  

Do you actively share [Operational Technology](../../💡Drafts%20and%20Ideas/Operational%20Technology.md) threat related intelligence with your peers?

Maintain and drive the development of new reports of Cyber Threat Intelligence analysis to peers, management and (internal) customer teams for purposes of situational awareness and making threat intelligence actionable. 

  

Does ai represent a threat or an opportunity and what are the critical factors in its development?

Conduct multi intelligence, all source analysis and cyber threat intelligence on past, present, and future cyber threats to network systems. 

  

Did your organization sanitize the information that it provided to the external communities?

Make sure the Cyber Threat Intelligence Team Lead manages a team of Cyber Threat Intelligence Support professional who provide technical expertise in cyber adversary. 

  

How do you Determine the Risk of a Threat Actor?

Analyze cyber threat intelligence to identify threat actor Tactics, Tools, and Procedures (TTPs) and apply this knowledge to system design in order to determine the impact of successful TTP execution. 

  

Does your organization have a cyber threat intelligence program and attack monitoring/alert process?

Make sure the SOC consists of a variety of highly-skilled, technical staff performing Monitoring and Analysis, Cyber Incident Handling, Threat Intelligence and Hunting, non-compliance reporting, user activity monitoring, malware and forensic analysis, vulnerability assessments and penetration testing. 

  

### THREAT:

  

What are the Key Functions in your organization that support Cyber Information Sharing and Analysis?

Manage practical knowledge managing threat data and creating intelligence assessments in support of your incident response and threat hunting missions. 

  

How do you translate operational measurements into meaningful security metrics for the business?

Make headway so that your workforce is involved in understanding threats, the current threat landscape, and intelligence gathering with an analytical mindset in order to translate data into threat indicators faced by (internal) clients. 

  

How do you focus on your people to develop organizational preparedness for an attack?

Perform research and collection across the intelligence spectrum to support requests for information from internal teams and conduct trending and correlation across threat intelligence data to establish patterns, identify proactive mitigations, and develop countermeasures. 

  

Is your security infrastructure integrated so that threat intelligence can be shared in real time across all security elements?

Manage threat intelligence platforms and monitor feed sources for efficacy and work with security operations and engineering to integrate threat indicator sources with appropriate tools. 

  

Is it possible to secure your organization against both external and internal threats without causing undue friction?

Ensure you have intimate knowledge about information security threat intelligence and thrive on the details of threat analysis. 

  

What is the best approach to strengthening corporate governance of cybersecurity risk?

Ensure your strategy collects, assesses and analyzes intelligence reports from multiple sources and disciplines; reviews incident logs/records mining for intrusion patterns; manages documentation and tracking of relevant threats, threat actors TTPs. 

  

How does osint and dark web analysis compare with expensive, custom built intelligence feeds?

Interface so that your process ascertain and leverage trustworthy open and closed source cyber threat intelligence data feeds. 

  

Many early threat intelligence services focused on general security data, identifying malware indicators and tracking malicious sites, how does that apply to your environment?

Collaborate with other Threat Analysis team members to identify and design new areas for intelligence collection and storage. 

  

### TECHNOLOGY:

  

What are the different ways in which fidelity can be lowered for a broad range of applications?

Incorporate Threat Intelligence into the Information Security program, staying abreast of the latest information technology security trends and vulnerabilities. 

  

Do you utilize a security command center platform to update and manage your firewall and related Cyber Threat Intelligence services?

Utilize cutting edge cyber technology tools and threat intelligence in making secure design recommendations for ICS/OT and the admin network. 

  

How regularly do you review your threat model to determine what attack vectors are most likely?

Identify attack surface reduction opportunities via vulnerability data analysis, trends and asset metadata review as well as collaboration with threat intelligence and technology management. 

  

Does your organization have the appropriate controls to detect and prevent an insider attack?

Ensure your next-generation technology, which combines threat intelligence with machine learning, enables financial institutions and organizations to detect cryptocurrency fraud and financial crime with unprecedented scale. 

  

What effect on information security was due to the combination of threat intelligence and situation awareness?

Work with the Attack Surface Management team to conduct a penetration test scoping/kick off meetings with technology business stakeholders, document scope, and schedule testing window. 

  

What incentives are needed to support proactive measures to strengthen cybersecurity?

Ensure your team is involved in providing CI support to Technology Protection. 

  

How will the subject matter expertise developed by the program administrators be kept and shared over time?

Develop experience providing oversight of large, multi functional project teams, specifically in an information technology environment. 

  

Do you store knowledge of assets affected and exploits used along with the relevant threat intelligence indicators involved?

Make sure your organization is involved in all aspects of the RPA technology platform. 

  

How do you create personal incentives for disclosing cyber trust information?

Serve as a key resource for anomaly detection in protecting your Operational Technologies (OT)/ICS manufacturing assets, information assets and technology assets. 

  

Do you regard flexibility, scalability and security of the technological platform as important?

Evaluate automated and information technology systems and develop strategies to optimize and ensure the quality and stability of automation systems through future expansion, replacement, or upgrade. 

  

### SYSTEMS:

  

What impact, if any, have high profile cyberattacks had on IT security at your firm?

Make sure your staff carries out your organization needs in depth threat intelligence analysis to find the perpetrator, the type of attack, and the data or systems impacted. 

  

Do you demonstrate due diligence, ownership, and effective management of cyber risk?

Interface so that your team works with considerable independence, developing operating plans and related operational processes for own department and monitoring the flow of work between own department and others in alignment with broader business objectives, selecting and developing effective managers and work teams, and managing own organization through reliable systems and processes. 

  

How well trained is staff concerning potential attack vectors an active adversary may use?

Decrease leverages emerging threat intelligence to identify affected systems and scope of attack. 

  

Is the threat intelligence updated when new information is learned or knowledge changes?

Use threat intelligence as updated rules and Indicators of Compromise (IOCs) to pinpoint affected systems and the extent of an incident. 

  

Is the ceo highly technical and thus likes reading full on reverse engineering reports?

Document investigation and incident response actions taken in case management systems and prepare formal incident reports. 

  

How do you ensure that the board and senior management are regularly involved in managing Cybersecurity risks and resource allocation?

Certify your company is continuing development of professional knowledge and skills in Information Systems and Information Assurance. 

  

Do you have access to the latest, contextual intelligence available to rapidly adapt to the evolving threat landscape?

Ensure that ppl eu systems and data management protocols adhere to regulatory requirements. 

  

How serious does your organization consider the current threats to control system cybersecurity to be?

Install and organize information systems to guarantee organization functionality. 

  

What methods should be involved to identify vulnerabilities at the perimeter of critical networks?

Be certain that your workforce is involved in systems software development. 

  

Do you believe gathering and using threat intelligence is essential to a strong security posture?

Be sure your organization improving fundamentals and innovating engineering systems and process the team is using. 

  

### TOOLS:

  

How do you know when your organization is a cyber target?

Interface so that your staff is involved in methods, sources, tools, and subject matter pertaining to all source cyber threat intelligence collection and analysis. 

  

Do you carry out research and gather intelligence to become better informed about your core customers, to segment your markets and provide a more personalised service?

Become expert with third party threat intelligence tools with priority. 

  

What technology tools does your organization currently use to collect and analyze threat intelligence?

Ensure you focus on growing as a team to deliver the best support to your (internal) customers and use multiple resources for mentoring and learning new skills and tools. 

  

What value does threat intelligence bring to your organizations overall security strategy?

Ensure you support each other through success and failure, to bring the best tools to law enforcement, organization departments and corporate (internal) customers. 

  

How do you ensure that the board and senior management are regularly involved in managing Cybersecurity risks and resource allocation?

Ensure your operation is involved in forensic tools and investigations. 

  

Do you know the private sector entities in your jurisdiction that should be involved?

Confirm that your process is involved in wireless exploitation techniques and tools. 

  

What would you do if any of the parties involved were the subject of a cyber-attack?

Make headway so that your company is involved in container/orchestration tools. 

  

Have requirements for support from the intelligence collection management infrastructure been addressed?

Select and tailor approaches, methodologies and tools to support service offering or industry projects. 

  

What has the framework indicated in terms of the weaknesses in maintaining the accountability of intelligence departments?

Be confident that your strategy has involvement with analytical tools and processes. 

  

What is your process for ensuring that risks identified through your detective controls are remediated?

Work closely with tools engineering teams to prioritize and remediate vulnerabilities.
