Menettely toimintaympäristön seuraamiseen

Organization carries out threat intelligence by gathering information about information security threats related to its operations and how to protect against them. The goal is to increase awareness of the threat environment, so that own security level can be better evaluated and adequate control measures implemented.

When collecting threat intelligence, all three levels must be taken into account:

• strategic threat intelligence (e.g. information on the growing types of attackers and attacks)
• tactical threat intelligence (e.g. information about tools and technologies used in attacks)
• operational threat intelligence (e.g. details of specific attacks)

Principles related to threat intelligence should include:

• setting targets for threat intelligence
• identification, verification and selection of information sources used in threat intelligence
• gathering threat intelligence
• data processing for analysis (e.g. translation, formatting, compression)

Organization should share threat intelligence information actively with other organizations to improve its own threat awareness.