EP128 Building Enterprise Threat Intelligence: The Who, What, Where, And Why

Play This Episode

0 Votes

Guest John Doyle Principle Intelligence Enablement Consultant at Mandiant Google Cloud Topics You have created a new intelligence class focused on building enterprise threat intelligence capability so what is the profile of an organization and profile for a person that benefits the most from the class There are many places to learn threat intel TI what is special about your new class You talk about country cyber operations in the class so what is the defender – relevant difference between say DPRK and Iran cyber doctrines More generally how do defenders benefit from such per country intel Can you really predict what the state-affiliated attackers would do to your organization based on the country doctrine In many minds TI is connected to attribution What is your best advice on attribution to CISOs of well-resourced organizations What about mainstream organizations Overall we see a lot of organizations still failing to operationalize TI especially strategic TI how does this help them Resources The new class Inside the Mind of APT Navigating Tradeoffs of Attribution paper Sands Casino hack 2014 Threat Horizons – How Google Does Threat Intelligence ep112 Click here to visit this podcast episode