Introduction: The Intelligence Imperative
In Lessons 1.1 and 1.2, we established the foundational concepts of cybersecurity for financial institutions. We explored the threat landscape, the cyber risk formula, the attack surface, the cyber kill chain, and the CIA Triad. We also examined the regulatory landscape, including GLBA, SOX, GDPR, NYDFS, and international standards.
However, understanding the threat landscape and regulations is only the first step. Financial institutions must actively gather, analyze, and act upon intelligence about cyber threats. This is the domain ofΒ Cyber Threat Intelligence (CTI)Β .
Cyber Threat Intelligence is evidence-based knowledge about existing or emerging cyber threats that can be used to inform decisions. It answers critical questions such as:
-
“What threats are most likely to target our institution?”
-
“What tactics, techniques, and procedures (TTPs) are threat actors using?”
-
“How can we detect and respond to these threats?”
This lesson provides the complete mathematical and conceptual framework for Cyber Threat Intelligence in financial institutions. We derive theΒ Intelligence Cycle: Planning β Collection β Processing β Analysis β Dissemination β Feedback. We formalize theΒ Diamond ModelΒ of intrusion analysis, which describes the relationships between adversary, capability, infrastructure, and victim. We derive theΒ Pyramid of Pain, which categorizes indicators of compromise (IOCs) by their value to defenders.
We also introduce theΒ MITRE ATT&CK FrameworkΒ for financial institutions, mapping threat actor TTPs to specific defensive measures. We derive theΒ Threat Intelligence Score:Β Tintel=Ξ±β Qdata+Ξ²β Qanalysis+Ξ³β Qaction, which quantifies the effectiveness of a threat intelligence program.
By the end, you will have a complete understanding of Cyber Threat Intelligence and its application to financial institutions.
Learning Objectives
Upon completion of this lesson, you will be able to:
-
DefineΒ Cyber Threat Intelligence and its role in financial institutions.
-
DeriveΒ theΒ Intelligence Cycle: Planning β Collection β Processing β Analysis β Dissemination β Feedback.
-
ApplyΒ theΒ Diamond ModelΒ of intrusion analysis: Adversary β Capability β Infrastructure β Victim.
-
ApplyΒ theΒ Pyramid of Pain: Hash β IP Address β Domain β Network Artifact β Tools β TTPs.
-
MapΒ theΒ MITRE ATT&CK FrameworkΒ to financial institutions.
-
DeriveΒ theΒ Threat Intelligence Score:Β Tintel=Ξ±β Qdata+Ξ²β Qanalysis+Ξ³β Qaction.
Part 1: Cyber Threat Intelligence Defined
1.1 What is Cyber Threat Intelligence?
Cyber Threat Intelligence (CTI) is evidence-based knowledge about existing or emerging cyber threats that can be used to inform decisions.
The CTI Definition:
CTI=Evidence+Analysis+ActionableΒ Insight
Components:
Β
Β
| Component | Description | Example |
|---|---|---|
| Evidence | Raw data about threats | IP addresses, domain names, malware hashes |
| Analysis | Interpretation of the evidence | Attribution to a specific threat actor |
| Actionable Insight | Recommendations for action | “Block these IP addresses” |
1.2 Types of Cyber Threat Intelligence
Cyber Threat Intelligence can be categorized by its scope and purpose:
Β
Β
| Type | Scope | Purpose | Example |
|---|---|---|---|
| Strategic Intelligence | High-level, long-term | Inform executive decisions | Threat landscape trends, geopolitical risks |
| Operational Intelligence | Medium-term, tactical | Inform security operations | Threat actor TTPs, campaign analysis |
| Tactical Intelligence | Short-term, technical | Inform immediate defenses | Indicators of compromise (IOCs) |
| Technical Intelligence | Real-time, granular | Inform automated defenses | Malware signatures, C2 patterns |
Types of Cyber Threat Intelligence (Visual): βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ | Strategic Intelligence β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β Audience: Board, C-Suite β β | β Timeframe: 1-3 years β β | β Example: "Nation-state actors are targeting financial β β | β institutions in North America." β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | | | Operational Intelligence β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β Audience: Security Operations Center (SOC) β β | β Timeframe: Weeks to months β β | β Example: "The Lazarus Group is using a new malware variant β β | β targeting SWIFT systems." β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | | | Tactical Intelligence β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β Audience: Security Analysts β β | β Timeframe: Days to weeks β β | β Example: "Block these 10 IP addresses associated with β β | β the latest phishing campaign." β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | | | Technical Intelligence β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β Audience: Security Engineers β β | β Timeframe: Real-time β β | β Example: "New C2 domain detected: evilbank.xyz" β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Part 2: The Intelligence Cycle
2.1 The Model
The Intelligence Cycle is a systematic process for collecting, analyzing, and disseminating intelligence:
IntelligenceΒ Cycle=PlanningβCollectionβProcessingβAnalysisβDisseminationβFeedback
2.2 The Six Stages
Β
Β
| Stage | Description | Key Activities |
|---|---|---|
| 1. Planning | Define intelligence requirements and priorities | Identify key questions, prioritize threats |
| 2. Collection | Gather raw intelligence data | Threat feeds, OSINT, dark web monitoring |
| 3. Processing | Convert raw data into a usable format | Data normalization, deduplication, enrichment |
| 4. Analysis | Interpret the processed data | Threat actor attribution, pattern recognition |
| 5. Dissemination | Share intelligence with stakeholders | Reports, alerts, briefings |
| 6. Feedback | Evaluate and improve the intelligence process | Metrics, lessons learned |
Intelligence Cycle (Visual): βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ | | | βββββββββββββββββββββ | | β Planning β | | β Requirements β | | ββββββββββ¬βββββββββββ | | β | | βΌ | | βββββββββββββββββββββ | | β Collection β | | β Data Gathering β | | ββββββββββ¬βββββββββββ | | β | | βΌ | | βββββββββββββββββββββ | | β Processing β | | β Data Normalizationβ | | ββββββββββ¬βββββββββββ | | β | | βΌ | | βββββββββββββββββββββ | | β Analysis β | | β Interpretation β | | ββββββββββ¬βββββββββββ | | β | | βΌ | | βββββββββββββββββββββ | | β Dissemination β | | β Sharing Results β | | ββββββββββ¬βββββββββββ | | β | | βΌ | | βββββββββββββββββββββ | | β Feedback β | | β Evaluation β | | βββββββββββββββββββββ | | β | | βββββββββββββββββββββββββββββββββββββββββββ | | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Part 3: The Diamond Model of Intrusion Analysis
3.1 The Model
The Diamond Model is a framework for analyzing cyber intrusions. It describes the relationships between four core components:
DiamondΒ Model={Adversary,Capability,Infrastructure,Victim}
3.2 The Four Components
Β
Β
| Component | Description | Examples |
|---|---|---|
| Adversary | The threat actor | Nation-state, cybercriminal, insider |
| Capability | The tools and techniques used | Malware, exploits, social engineering |
| Infrastructure | The systems used by the adversary | C2 servers, botnets, email domains |
| Victim | The target of the attack | Financial institution, customer, third-party |
3.3 The Diamond Model Diagram
Diamond Model (Visual): βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ | | | Adversary | | (Who is attacking) | | β² | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | |/ \ | | Capability ββββββββββββββββββββββββββββββββββββββββββββββ Infrastructure β | (What is used) (Where from) β | | | βΌ | | | | Victim | | (Who is targeted) | | | | Relationships: | | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β β’ Adversary β Capability: Attacker uses tools. β β | β β’ Capability β Infrastructure: Tools are hosted on servers. β β | β β’ Infrastructure β Victim: Attacks are delivered. β β | β β’ Victim β Adversary: Attacks have a target. β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Part 4: The Pyramid of Pain
4.1 The Model
The Pyramid of Pain categorizes indicators of compromise (IOCs) by their value to defenders:
PyramidΒ ofΒ Pain=HashβIPΒ AddressβDomainβNetworkΒ ArtifactβToolsβTTPs
4.2 The Six Levels
Β
Β
| Level | Indicator | Difficulty to Change | Defender Value |
|---|---|---|---|
| 1. Hash | File hashes (MD5, SHA-1, SHA-256) | Easy (trivial) | Low |
| 2. IP Address | Attacker IP addresses | Easy (change proxies) | Low-Medium |
| 3. Domain | Attacker domains | Moderate (register new domains) | Medium |
| 4. Network Artifact | URLs, user-agents, ports | Moderate-Hard | Medium-High |
| 5. Tools | Malware families, exploit kits | Hard (rewrite tools) | High |
| 6. TTPs | Tactics, Techniques, Procedures | Very Hard (change behavior) | Very High |
4.3 The Pyramid Diagram
Pyramid of Pain (Visual): βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ | | | Very High Value βββββββββββββββββββββββββββββββ β | β TTPs β β | β (Tactics, Techniques, β β | β Procedures) β β | βββββββββββββββββββββββββββββββ€ β | β Tools β β | β (Malware, Exploit Kits) β β | High Value βββββββββββββββββββββββββββββββ€ β | β Network Artifacts β β | β (URLs, User-Agents, Ports) β β | Medium Value βββββββββββββββββββββββββββββββ€ β | β Domain β β | β (Attacker Domains) β β | Low-Medium Value βββββββββββββββββββββββββββββββ€ β | β IP Address β β | β (Attacker IPs) β β | Low Value βββββββββββββββββββββββββββββββ€ β | β Hash β β | β (File Hashes) β β | βββββββββββββββββββββββββββββββ β | | | Interpretation: β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β β’ Moving up the pyramid increases the defender's advantage. β β | β β’ TTPs are the most valuable intelligence. β β | β β’ Hashes are the least valuable intelligence. β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Part 5: The MITRE ATT&CK Framework for Financial Institutions
5.1 Overview
The MITRE ATT&CK Framework is a comprehensive knowledge base of adversary tactics and techniques.
ATT&CK=AdversarialΒ Tactics,Β Techniques,Β andΒ CommonΒ Knowledge
5.2 The 14 Tactics
Β
Β
| Tactic | Description | Financial Sector Examples |
|---|---|---|
| Reconnaissance | Gathering information about the target | Social media OSINT, spear phishing |
| Resource Development | Acquiring resources for the attack | Buying exploit kits, renting botnets |
| Initial Access | Getting into the target environment | Spear phishing, exploitation |
| Execution | Running malicious code | Malware installation, scripts |
| Persistence | Maintaining access | Backdoors, scheduled tasks |
| Privilege Escalation | Gaining higher-level access | Credential theft, zero-day exploits |
| Defense Evasion | Avoiding detection | Obfuscation, anti-virus bypass |
| Credential Access | Stealing credentials | Password cracking, keylogging |
| Discovery | Understanding the target environment | Network scanning, enumeration |
| Lateral Movement | Moving through the network | Pass-the-hash, remote services |
| Collection | Gathering target data | Data exfiltration, screen capture |
| Command & Control | Remote control | C2 servers, tunneling |
| Exfiltration | Stealing data | Data compression, encryption |
| Impact | Disrupting operations | Ransomware, denial of service |
5.3 Financial Sector ATT&CK Mapping
Β
Β
| Threat Actor | MITRE Group | Common Techniques |
|---|---|---|
| FIN7 | G0046 | T1059 (Command Execution), T1583 (Acquire Infrastructure) |
| APT38 | G0082 | T1046 (Network Scanning), T1568 (Dynamic Resolution) |
| Lazarus Group | G0032 | T1203 (Exploit via Email), T1055 (Process Injection) |
| Carbanak Group | G0008 | T1486 (Data Encryption for Impact), T1530 (Data from Cloud) |
MITRE ATT&CK for Financial Institutions (Visual): βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ | Financial Sector ATT&CK Techniques β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β Tactic β Technique β β | βββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββ β | β Initial Access β T1566: Phishing β β | β β T1189: Drive-by Compromise β β | βββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββ β | β Persistence β T1505: Server Software Component β β | β β T1547: Boot/Logon Autostart β β | βββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββ β | β Defense Evasion β T1027: Obfuscated Files β β | β β T1070: Indicator Removal β β | βββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββ β | β Credential Access β T1110: Brute Force β β | β β T1555: Credentials from Password β β | β β Stores β β | βββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββ β | β Lateral Movement β T1021: Remote Services β β | β β T1550: Use Alternate β β | β β Authentication β β | βββββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββββββββ β | β Exfiltration β T1048: Exfiltration Over C2 β β | β β T1537: Transfer Data to Cloud β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Part 6: The Threat Intelligence Score
6.1 Definition
The Threat Intelligence Score quantifies the effectiveness of a threat intelligence program:
Tintel=Ξ±β Qdata+Ξ²β Qanalysis+Ξ³β Qaction
Where:
-
QdataΒ is the Quality of Data (0-1)
-
QanalysisΒ is the Quality of Analysis (0-1)
-
QactionΒ is the Quality of Action (0-1)
-
Ξ±,Ξ²,Ξ³Β are weights (typicallyΒ Ξ±=0.3,Ξ²=0.4,Ξ³=0.3)
6.2 Components
Β
Β
| Component | Metrics | Weight |
|---|---|---|
| Data Quality | Completeness, Accuracy, Timeliness | 30% |
| Analysis Quality | Relevance, Depth, Clarity | 40% |
| Action Quality | Implementability, Effectiveness, Speed | 30% |
Threat Intelligence Score (Visual): βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ | Data Quality: 0.85 β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β β’ Completeness: 0.90 β β | β β’ Accuracy: 0.85 β β | β β’ Timeliness: 0.80 β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | | | Analysis Quality: 0.82 β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β β’ Relevance: 0.85 β β | β β’ Depth: 0.80 β β | β β’ Clarity: 0.82 β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | | | Action Quality: 0.88 β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β β’ Implementability: 0.90 β β | β β’ Effectiveness: 0.85 β β | β β’ Speed: 0.89 β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | | | Threat Intelligence Score: β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β | β T = 0.3 * 0.85 + 0.4 * 0.82 + 0.3 * 0.88 = 0.85 β β | β Status: Excellent β β | βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Summary and Bridge to Lesson 1.4
We have now completed the Cyber Threat Intelligence framework. You have learned:
-
Cyber Threat Intelligence:Β Evidence + Analysis + Actionable Insight.
-
Intelligence Cycle:Β Planning β Collection β Processing β Analysis β Dissemination β Feedback.
-
Diamond Model:Β Adversary β Capability β Infrastructure β Victim.
-
Pyramid of Pain:Β Hash β IP β Domain β Network Artifact β Tools β TTPs.
-
MITRE ATT&CK:Β Tactics, Techniques, and Common Knowledge for financial institutions.
-
Threat Intelligence Score:Β Tintel=Ξ±β Qdata+Ξ²β Qanalysis+Ξ³β Qaction.
InΒ Lesson 1.4, we will exploreΒ Cyber Risk Assessment and Quantification for Financial Institutions.