Author(s): Antonio VILLALÓN-HUERTA, Ismael RIPOLL-RIPOLL, Héctor MARCO-GISBERT
Publication name: Romanian Intelligence Studies Review
Publisher name: Mihai Viteazul National Intelligence Academy
Publication type: Journal article
Publication date: June 30, 2023
Pagination:
Issue/ Volume: 1 (29)/2023
DOI:
Abstract:
Intelligence plays a key role in the detection and neutralisation of threat actors
in cyberspace, particularly when dealing with advanced ones. However, the relationship
between intelligence and the final detection capabilities is not well–defined in most cases.
Even the role of information gathering disciplines, which are the basis of intelligence and
therefore of cyber intelligence, is confusing and not consensual between authors. In this
work we contextualize intelligence gathering disciplines in the cyber intelligence arena.
We discuss the role of all of these disciplines in the characterization of advanced threat
actors, from the strategic to the tactical views. Once characterization has been performed,
we analyse the detection capabilities that intelligence provides, in the form of indicators
of compromise, both low–level and behavioural ones. Following this approach, in this
work we are defining the road from initial intelligence gathering to threat detection.
Keywords: Intelligence, Cyber Intelligence, CYBINT, Tactics and Techniques,
TTP, Indicators of Compromise.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 2.0 Generic License.