Plain Conversation No. 4

The cyber risk intelligence analyst can use several techniques to place events and impacts accurately on the boom chart.

He must start with a foundational understanding of cyber event elements, many of which display in the following mind map:

An intelligence analyst learns all he can about these items. He is fascinated by context, and terrified by ignorance. He explores relationships and advances hypothesis. He builds on his knowledge and previous estimations. A good analyst knows and readily applies a broad number of analytical techniques, asking question after question — carefully documenting his results — building histories and frameworks.

When trying to anticipate the future, the cyber risk analyst applies all his efforts to match what he knows about the external environment with what he knows about the internal environment he must protect.

We can divide intelligence product types useful in this “matching” effort into four broad categories:

  1. Technical Data
  2. Adversary TTPs
  3. Assessment and Estimation
  4. Vulnerability Discovery and Disclosure

In the following posts we will look at each of these in greater detail.

Plain Convo III

When we left off, you were just beginning to wonder “When will my organization be the victim of a significant cyber incident?”

And I told you I would show you how cyber risk intelligence could help us get there. So here goes.

It is the job of the cyber risk intelligence analyst to place all cyber events affecting the organization he serves on the Boom Chart:

The Boom Chart is a conceptual tool the analysts uses to estimate when things go “boom”, and how big the boom will be. The Y axis displays “Impact”, the X axis displays “Time”. 

T sub not (t0), shown on the X axis, represents the present. The cyber intelligence analyst deals always in the notion of time. He must cover both events that have already affected the organization (shown to the left of t0), and events that may affect the organization in the future (shown to the right of t0).

Intelligence analysts often do not learn about events that have impacted their organization until after the event has occurred. The “dwell time” statistic made famous by Mandiant’s annual “M-Trends” reports illustrates this concept nicely (see Mandiant metrics white paper for more detailed discussion about dwell time and its components). We all kind of naturally find ourselves wanting to “get that dwell time down”.

Indeed, a cyber intelligence analyst provides the most value to his organization when leadership trusts him to deliver an accurate appraisal of events that will occur in the future — eliminating dwell time all together. While important caveats exist, logic dictates that event impacts can be mitigated or diminished less-expensively and more-effectively before the event occurs than they can afterwards.

Next time, we will discuss some specific ways an analyst goes about this important task.