Source: [LinkedIn](https://www.linkedin.com/pulse/does-your-organization-have-cyber-threat-intelligence-blokdyk/)  
Author: [Gerardus Blokdyk](https://www.linkedin.com/in/gerardblokdijk/)  
Publication date: March 1, 2022
Retrieved from on March 3, 2022

Relevant ISO 27001:2013 clauses/controls:
- [[ISO 27001 C 9.2 Internal audit]]
- [ISO 27001 A 18 Compliance](../../Standards/ISO27x/archive/ISO%2027001%202013/ISO%2027001%20A%2018%20Compliance.md)
- [ISO 27001 A 16 Information security incident management](../../Standards/ISO27x/archive/ISO%2027001%202013/ISO%2027001%20A%2016%20Information%20security%20incident%20management.md)
- [ISO 27001 A 12.4 Logging and monitoring](../../Standards/ISO27x/archive/ISO%2027001%202013/ISO%2027001%20A%2012.4%20Logging%20and%20monitoring.md)
- [[ISO 27001 A 13.1.1 Network controls]]

Relevant ISO 27002:2022 clauses/controls:
- [a-5.7-Threat-intelligence](../../Standards/ISO27x/OST/27002/EN/a-5.7-Threat-intelligence.md)

Related:
- [Threat Intelligence](../../🎇%20Sparks/Threat%20Intelligence.md)

## Cyber Threat Intelligence: Ask This;

### TLDR: Ask This;

1. Does your organization have a Cyber Threat Intelligence program and attack monitoring/alert process ?

2. How does your organization share Cyber Threat Intelligence reputation data?

3. What tools does your organization use to receive Cyber Threat Intelligence from other companies?

4. How will you share ratings and Cyber Threat Intelligence information with stakeholders?

5. How is your system used to accurately model your organizations Cyber Threat Intelligence maturity level?

6. What security measures does your organization employ to keep your threat intelligence secure?

7. What Cyber Threat Intelligence sources do you rely on to get information about the issues facing your organization?

8. Who is responsible for implementing a threat intelligence program that integrates across your security technologies, teams, and executive cyber risk decisions?

9. How do you share information Cyber Threat Intelligence between public and private sectors?

10. How does the Cyber Threat Intelligence provider measure performance?

11. Do you utilize a security command center platform to update and manage your firewall and related Cyber Threat Intelligence services?

12. How is Cyber Threat Intelligence incorporated into your security processes?

13. How does your organization evaluate the impact of threat intelligence sharing platforms?

14. How is collaboration of users on managing Cyber Threat Intelligence data supported?

15. Does your organization have a role in verifying the quality of threat intelligence sent or received?

16. Do you have metrics to evaluate the quality of the threat intelligence provider and the information received?

17. Does your organization consolidate threat intelligence data from multiple solutions?

18. How do you aggregate Cyber Threat Intelligence with internal data?

19. What contextual intelligence does the vendor provide to enrich threat and indicator data?

20. Does your organization receive regular intelligence from the Chief Information Officer/Head of Security on who may be targeting your organization, methods and motivations?

21. What data sources corroborate threat intelligence to ensure accuracy?

22. Is the threat intelligence updated when new information is learned or knowledge changes?

23. Does your organization have a formal threat hunting program with assigned staff?

24. How does your organization integrate relevant and actionable intelligence into security operations?

25. What vulnerabilities are being researched by cyber threat actors?

26. What personnel controls does your organization have in place when conducting security clearances, background checks?

27. Does your organization have cyber insurance and which incidents are covered?

28. How does your organization allocate staff for your information security function?

29. Do you store knowledge of assets affected and exploits used along with the relevant threat intelligence indicators involved?

30. What kind(s) of data does your security organization collect and analyze?

31. Who has the authority to release cyber defence related information to external partners?

32. Do you correlate internal activity with relevant threat intelligence beyond your perimeter to more quickly identify advanced attacks?

33. What is the value of your organizations information and information flows to potential threat actors?

34. How does your organization determine what pieces of intelligence are relevant to them?

35. How serious does your organization consider the current threats to control system cybersecurity to be?

36. Does the threat intelligence incorporate vulnerability analysis?

37. What exposure does your organizations senior management have into your cybersecurity practices?

38. What percentage of threat intelligence alarms on a weekly basis are false positive?

39. How does the enterprise define the threat environment, in terms of mission and business operations?

40. Does the threat intelligence cover all of the critical digital forensics domains?

41. Does your organization have the human bandwidth available on staff to build the desired capability?

42. Do your email security solutions integrate with your other security tools to seamlessly work across threat vectors and protect against blended attacks?

43. Who within your organization needs what information, and in what formats, to help drive more effective cyber risk management investments?

44. Does your organization have a risk assessment for its information assets?

45. What external digital threat management tasks do you outsource to managed security service providers?

46. How does your response plan match up with your threat intelligence?

47. Which non regulatory approaches do you use to share information on cyber incidents?

48. What is the process to gather and analyze threat and vulnerability information from multiple sources?

  

## Organized by Key Themes: SECURITY, CYBER, SEARCH, THREAT, DATA, MANAGEMENT, NETWORK, INTELLIGENCE, DEVELOPMENT, INCIDENT:

  

### SECURITY:

  

How do you extend your internal security controls to your vendors and help reduce your organizations risk?

Combine cyber threat intelligence with vulnerabilities to simulate relevant threats, evaluate (internal) client incident response (IR) capabilities, help security operations teams prepare for worst-case scenarios. 

  

How do you collect timely, relevant, and actionable cyber intelligence data?

Lead a team of cyber professionals responsible for infusing collaboration, security meta data and threat intelligence into operational workflows laterally across all technical service functions. 

  

How will advances in technology (e.g., artificial intelligence, Internet of Things, etc.) or other factors affect the cybersecurity workforce needed in the future?

Interface so that your strategy is involved in security technologies such as automated penetration testing tools, Security Information and Event Management (SIEM), IDS/IPS, Data Loss Prevention (DLP), Proxy, Web Application Firewall (WAF), Endpoint Detection and Response (EDR), Anti-Virus, Sandboxing, network- and host-based firewalls, Threat Intelligence, etc. 

  

How are you involved in your organizations Cyber Threat Intelligence activities or process?

Manage and grow a best-in-class cyber threat hunt team to compliment the ethical hacking program to aid in proactively identify security risks in systems/applications/networks using cyber threat intelligence to think like an adversary. 

  

Did the team establishing them understand whether the metrics were achievable?

Oversee that your staff manage all enterprise cyber, data protection, and insider threat programs, including establishing incident response, 24x7 security operations center, and security engineering, architecture and intelligence teams. 

  

Did your organization include bottom up input in establishing metrics?

Guarantee your personnel is involved in Cybersecurity programs, specifically Enterprise Security Architecture to include reference security architecture creation, security program assessment, security operations, incident response, forensic analysis, threat intelligence, identity and access management, data protection, penetration testing, Web application security testing, vulnerability and risk management. 

  

What incentives are needed to support proactive measures to strengthen cybersecurity?

Oversee enterprise functions such as the Security Operations Center, technical security design and project management, threat and intelligence analysis and management, and executive support and protection. 

  

What is the system support needed to make surrogate use seamless and minimally intrusive for a user?

Develop and maintain requirements and standards for capabilities that support security operations, threat detection, intelligence and incident response functions. 

  

How will you know if an attacker got any kind of unauthenticated access to the system?

Make headway so that your workforce conducts research regarding the security of critical infrastructures, particularly using advanced AI based cyber threat intelligence systems for attack mitigation in industrial environments. 

  

When conducting a security risk assessment, what does your security risk assessment include?

Lead a team of you and Offshore information security professionals to conduct security assessments, incident response/forensics, security architecture to include cloud, threat intelligence and third party security capabilities. 

  

### CYBER:

  

What sources does the team use to determine when a compromise has occurred?

Lead the teams to provide cyber threat intelligence expertise to support the major incident response activities that can occur through insight on threat actors and tradecraft. 

  

Which best reflects the maturity of your SOC in addressing emerging threats?

Liaison so that your design is providing intelligence support, expert knowledge and insight into compliance, cyber hunt, incident response, risk and vulnerability assessment, and emerging cyber threat requirements. 

  

Do the threat actors pose an indirect risk, as attacks on the enterprise supply chain?

Perform cyber threat analysis and reporting on information from both internal and external sources and appropriately apply gathered cyber threat intelligence to defending the enterprise network. 

  

Which standards or frameworks is your CTI information adhering to?

Analyze cyber threat data and synthesize the analysis with cyber threats impacting your organization; identify, escalate, and fill intelligence gaps. 

  

What roles, responsibilities, and business processes are assumed to be present?

Conduct multi intelligence, all source analysis and cyber threat intelligence on past, present, and future cyber threats to network systems. 

  

Why is it so difficult for the system to identify whether the anomaly has to be classified as good or bad?

Confirm that your operation is building, leading, mentoring, and supporting teams of incident responders and cyber threat intelligence analysts who specialize in the prevention, detection, response, and recovery of cyber incidents. 

  

How can attack attribution play a role in deterring cyber attacks?

Make sure your process is involved in Cyber Threat Intelligence principles to include indicators of compromise (IOC) types, indicator pivoting and indicator attribution strength. 

  

How do you keep and grow your cybersecurity staff?

Ensure you leverage the latest technologies including an array of deployment and management tools as well as several cyber threat intelligence networks to keep your systems running smoothly around the clock. 

  

Should large companies sever business ties with mid size and small vendors and suppliers in favor of others that in reality may be no more cyber secure?

Confirm that your company performs research and analysis of APT infrastructure and malicious binaries, external cyber threat intelligence reporting and production. 

  

Does your threat hunting system currently generate automated alerts and perform pattern matching?

Integrate Cyber Threat Intelligence to inform (internal) customer on newly discovered threats and vulnerabilities associated with the technologies used in the enterprise for the purpose of developing hunt analytics. 

  

### RESEARCH:

  

What is threat intelligence, and how does it differ from antivirus research, and security research?

Make headway so that your staff is involved in cyber threat intelligence, security research, security operations, and/or incident response. 

  

What are the known, unpatched, vulnerable hardware on your organizations production networks for which exploits are publicly available?

Liaison so that your strategy is performing threat intelligence research into current trends, vulnerabilities, and exploits. 

  

What technical problems did the research team encounter by trying to share CTI information?

Research and propose strategic research directions for threat intelligence based on signals from the threat landscape. 

  

Do you have an incident response plan to react to an attack and mitigate exposure?

Research emerging threat actors and threat scenarios and aligned testing approaches to detect and mitigate those threats. 

  

How useful have the research results proven as measured by implementation to improve the security of your computing and networking environments?

Establish that your strategy research and design integration solutions by documenting individual modules and/or components to account for the function, responsibility, and execution per business requirements. 

  

How long does it take to detect the intrusion after the attackers first gain access?

Ensure your organization researches topics and interview stakeholders to understand communication product requirements; analyzes business problems and helps prescribe communication solutions. 

  

What preventive action do you take and who are the rising stars in cybersecurity?

Make sure your strategy is showing Respect Research issues and incidents with internal teams, business partners and (internal) customers in a collaborative manner that includes professional, honest and transparent communication. 

  

What vulnerabilities are being researched by cyber threat actors?

Research and train in all aspects of a secure software development lifecycle, from requirements to design to implementation. 

  

What is threat intelligence, and how does it differ from antivirus research, and security research?

Make sure there is business development capabilities needed to build and grow a new research practice area. 

  

How useful have the research results proven as measured by implementation to improve the security of your computing and networking environments?

Assure your process is involved in virtual currency transactions, research, and analysis. 

  

### THREAT:

  

Do you have systems in place to identify new security vulnerabilities in your technology?

Collaborate with other Threat Analysis team members to identify and design new areas for intelligence collection and storage. 

  

What are the ideal outcomes of intelligence support to the stakeholder?

Provide threat intelligence support to vulnerability management and incident response teams. 

  

Who provides support to cyber threats and groups who wish to attack or exploit your organization?

Support incident response and threat hunting activities to include providing intelligence context, analysis support, industry expertise, and recommendations around remediation and countermeasures. 

  

What are the key functions to support cyber information sharing and analysis?

Assure your strategy support SOC operations, malware analysis and network/endpoint threat hunting teams with actionable intelligence products. 

  

How do you reduce turnover of your highly skilled security and IT professionals and maintain an engaging and innovative culture?

Make sure the Manager, Threat Management works closely with Red team members to plan, coordinate, execute, and report on sophisticated ethical hacking exercises to identify cyber vulnerabilities and reduce the risk posture of enterprise systems. 

  

How do you get to the point where organizations offer information rather than just consume it?

Hunt for and identify threat actor groups and their techniques, tools and processes utilizing threat intelligence, analysis of anomalous log data and results of collaborative team sessions to detect and eradicate threat actors on the network. 

  

How can attack attribution play a role in deterring cyber attacks?

Produce and deliver TTP focused intelligence to support defensive activities including threat hunting, Incident Response, attribution workflows and Red Team engagement. 

  

What venues for cyber defender actions are represented or assumed?

Conduct analysis and research on the latest advanced cyber threats to provide actionable threat intelligence, including adversary indicators of compromise (IOCs), technique, tactics, and procedures (TTPs), behaviors, and trends to help defend the (internal) client agency and larger public and private sectors. 

  

Have your control system cyber assets and/or control system network ever been infected with malware or purposely breached by internal or external parties?

Participate in hunt missions using threat intelligence tools, analysis of anomalous log data and results of brainstorming sessions to detect and eradicate threat actors on networks. 

  

What is your process for ensuring that risks identified through your detective controls are remediated?

Check that your strategy contributes to Incident Response activities by providing contextual Threat Intelligence Package related to IOC(s) identified. 

  

### DATA:

  

What are the main human rights concerns when dealing with cybersecurity?

Ensure you have applied knowledge across all critical elements and common data types used in threat intelligence analysis, including malware used in targeted adversary campaigns; host and log forensics including methods of data collection and analytic techniques; and network forensics including common protocols and how those are used in adversary operations. 

  

Which classification techniques are appropriate for authorship analysis?

Secure that your staff is identifying, triaging, and remediating threats based on threat intelligence and active analysis of log data. 

  

How have employers been involved in your program in the past year?

Be sure your organization is involved in issues around data security and consumer privacy compliance issues. 

  

Does the information you receive enable your organization to prioritize threats?

Use APIs to create integrations to enable data enrichment and incorporation of threat intelligence sources. 

  

Are you using existing data effectively to drive your security decisions?

Use business intelligence tools to create reporting and maintain metrics using collected data. 

  

How do you conceptualize cyber crime?

Analyze information requirements to develop reporting systems including the systems specifications, data gathering and analytical techniques, and systems evaluation methodology. 

  

What are the front companies or Internet properties supporting any cyber threat?

Warrant that your process is involved in vulnerability scanning tools to include those supporting operation system, web application, database assessments. 

  

How is an information exchange structured to ensure that it delivers the greatest value?

Work with stakeholders and Product Managers to understand data model and business requirements and translate those requirements into solutions and acceptance criteria that deliver business value. 

  

What emerging risks in the financial lines space are you most concerned by?

Make sure the team leverages a variety of unconnected data sources to identify fraudulent activity related to emerging trends, fraudster tactics, and anomalous activity. 

  

### MANAGEMENT:

  

How can the asset management industry improve its approach to tackling cyber threats?

Integrate internal and external threat intelligence data in SOC functions and tools to improve the efficacy of vulnerability and threat management. 

  

What knowledge and skills are currently needed in the cybersecurity workforce?

Interface so that your team is involved in incident handling, vulnerability management, hacking tools, intelligence gathering or kill chain methodology. 

  

How well trained is staff concerning potential attack vectors an active adversary may use?

Make headway so that your personnel is understanding common cybersecurity concepts as vulnerability management, risk management, cybersecurity frameworks (NIST, COBIT), attack vectors, threat intelligence. 

  

How can security be positioned as an enabler of the established goals of control systems operators?

Make headway so that your team provides overall management support for the contract to ensure all projects are synchronized toward established goals and objectives. 

  

Who is responsible in your organization to assist in preparing for and responding to a data breach?

Make sure your organization develops and executes continuous process improvement for vulnerability management and risk reduction. 

  

Do you develop learning methods for learning from adversarial data?

Confer with management staff and other organization personnel to determine program requirements and availability of resources and develop criteria and standards for program evaluation. 

  

How effectively is your organization communicating metrics, incentives and expectations?

Provide direction and support of operational tools and processes for identifying and communicating vulnerable items for Vulnerability Management Infrastructure (VMI). 

  

Who at your organization is responsibility for assessing and mitigating breach-related risks?

Proactively support program management of multiple projects and facilitate your organization needs in depth working groups to identify credible threats, relevant vulnerabilities, and assess operational impacts. 

  

Is your organization committed to developing and maintaining an information security-aware culture?

Be confident that your group is maintaining effective regional cyber crisis management processes and activities. 

  

Does the alert apply to your organizations information technology assets?

Lead Department management in planning and organizing resources needed to deliver the departments objectives Review and monitor all aspects of shift operations and coordinate closely with counterparts to ensure smooth operations and reliability of the plant functions Ensure all actions are taken for the safe shut-down/start-up of the plant in line with standard operating procedures. 

  

### NETWORK:

  

Is there someone in your organization that might understand the risks involved better than you?

Be sure your workforce is involved in host and/or network log analysis as applied to incident response threat hunting. 

  

Do you store knowledge of assets affected and exploits used along with the relevant threat intelligence indicators involved?

Check that your company is involved in threat hunting on a large, enterprise network both as an individual and leading hunting exercises with other team members. 

  

Are you required to provide specific consumer protection services as identity theft insurance and/or credit monitoring?

Analyze host and network forensic artifacts and identify patterns and behaviors related to threat actors. 

  

Who is most responsible for deciding what threat intelligence sources are used?

Be confident that your operation is responsible for securing all information and information systems assets of your organization network infrastructure. 

  

What types of reports, outputs, data and deliverables should systems and analysts be expected to produce?

Make headway so that your organization monitor several tools and report network incidents and threats in real time. 

  

Do you determine what kind of data has been compromised/stolen/ made unavailable?

Interface with Dev/QA/OPS teams to identify root cause analysis and re instrument triggers to prevent future network degradation and outages. 

  

Are roles and responsibilities for information sharing set at your organization?

Guarantee your group is involved in application support, server support, network support or similar skill set. 

  

Are system owners willing to adjust logging policies to meet SOC needs?

Make sure your strategy analyze network data for trends and anomalies to compare and adjust machine learning models. 

  

Does your organization check compliance requirements in IT systems?

Develop experience working with monitoring devices, network and host intrusion detection systems, web applications, AV, WAF, Proxy and operating system logs. 

  

What type of management tools are you using to aggregate, analyze and/or present CTI information?

Guarantee your company is involved in developing and using testing methodology for cloud based and networked systems. 

  

### INTELLIGENCE:

  

Do you have a Data Protection Officer that reports at board level?

Develop experience conducting intelligence and network threat analysis to produce statistical reports and analytical products. 

  

Is asset management integrated into other security and business processes?

Have a strong understanding how enterprise endpoint and network components operationalize Threat Intelligence and adversary detection. 

  

Is performance data from other equipment leveraged in determining equipment optimization?

Perform threat hunting for suspicious activity based on anomalous activity and indicators of compromise from various intelligence sources and toolsets. 

  

How do you extend your capabilities?

Incorporate threat intelligence into countermeasures to detect and prevent intrusions and malware infections. 

  

What would you do if any of the parties involved were the subject of a cyber-attack?

Safeguard that your design is involved in managing and mentoring Business Intelligence development teams. 

  

Which options help to reduce undesirable consequences of cyber activities?

Establish that your process is providing intelligence analysis in order to identify threats, quantify vulnerabilities, and reduce risk to the client. 

  

How is your business/organization involved with cybersecurity?

Be certain that your group is involved in program and project management, specifically in the Business Intelligence area. 

  

Does the intelligence product meet the needs of its intended purpose?

Develop internal relationships with stakeholders to better understand the business needs for varying departments, subs, and affiliates to ensure intelligence collection and reporting meet their requirements to make informed business decisions. 

  

Who within your organization needs what information, and in what formats, to help drive more effective cyber risk management investments?

Develop experience using intelligence to drive vulnerability management, testing, incident response, investigations, and other digital operations. 

  

### DEVELOPMENT:

  

What are the top use cases for your Cyber Threat Intelligence data?

Oversee that your team applies leading edge principles, theories, and concepts while also contributing to the development of new and innovative threat intelligence workflows. 

  

What are the most serious cyber risks to critical infrastructure?

Make sure the process automation team is responsible for the resolution of automation problems, implementation of process control, data collection techniques, and troubleshooting in compliance with System Development Life Cycle (SDLC), GMP, safety, and environmental regulations. 

  

Are all the infected systems related to a specific type of user or department?

Be confident that your strategy works with various departments to identify workflow and system integration requirements as they relate to IT system development and deployment. 

  

How many people work at your organization, either as employees, contractors or consultants?

Be sure your design directs development of program safety measures and implementation of standard workplace safety practices, to mitigate injuries and foster a healthy work environment for staff. 

  

How is collaboration of users on managing cyber-threat intelligence data supported?

Lead development and monitoring of service level agreement compliance for production support ticket system. 

  

How is collaboration of users on managing Cyber Threat Intelligence data supported?

Support business case development related to implementation of future HR Service Delivery Model. 

  

Who are the threats who are interested in buying confidential organizational data?

Certify your group fosters the development of an information sharing culture through direct leadership, expert training and continuous collaboration. 

  

How well do the metrics drive achievement of organizational objectives?

Support the development and communication of (internal) customer improvement strategies dependent on new services/features to drive financial results. 

  

Does the tool allow for the creation of customized intelligence reports for management or sharing with other stakeholders?

Manage the development of cybersecurity standards and capabilities. 

  

### INCIDENT:

  

How are you involved in your organizations Cyber Threat Intelligence activities or process?

Guarantee your personnel is involved in Endpoint Detection and Response (EDR) tools with a focus in incident investigation and/or threat hunting. 

  

What reports are provided to your board on cyber events and trends?

Perform trend analysis and develops metrics and reports on intelligence and incidents for management. 

  

What do you do when off the shelf tools and exploits fall short?

Ensure your design is involved in red/purple teaming, penetration testing, exploitation, incident response (hunt), or blue teaming. 

  

Is the equipment uniquely identifiable and addressable locally within a network?

Coordinate and work closely with internal and external stakeholders to understand business objectives and advise on mitigation strategies during the incident response work. 

  

Is the CEO highly technical and thus likes reading full on reverse engineering reports?

Establish that your company is involved in writing clear and concise technical documents, specifically event analysis and incident handling documentation/creating formal incident reports. 

  

What tools and resources does the team use in handling an incident?

Develop experience conducting your organization needs in depth investigations, digital forensics, and/or incident response handling. 

  

How is collaboration of users on managing Cyber Threat Intelligence data supported?

Invest in optimizing and auditing content development in support of incident detection and investigation capabilities. 

  

How will advances in technology (e.g., artificial intelligence, Internet of Things, etc.) or other factors affect the cybersecurity workforce needed in the future?

Provide custom metrics reports including incident category types, tools used, number of indicators, time opened at each step, trending statistics, service availability, system utilization, etc. 

  

Are your appsec practices prepared to scale with your development practices?

Develop experience conducting incident response activities and seeing incidents through to successful remediation. 

  

Does your posted privacy policy align with your actual data management practices?

Guarantee your operation performs scoping activities during incident response for incidents escalated from the vertical specific analyst teams.