Introduction: The Intelligence Imperative
In Lessons 1.1 and 1.2, we established the foundational concepts of cybersecurity for financial institutions. We explored the threat landscape, the cyber risk formula, the attack surface, the cyber kill chain, and the CIA Triad. We also examined the regulatory landscape, including GLBA, SOX, GDPR, NYDFS, and international standards.
However, understanding the threat landscape and regulations is only the first step. Financial institutions must actively gather, analyze, and act upon intelligence about cyber threats. This is the domain of Cyber Threat Intelligence (CTI) .
Cyber Threat Intelligence is evidence-based knowledge about existing or emerging cyber threats that can be used to inform decisions. It answers critical questions such as:
-
“What threats are most likely to target our institution?”
-
“What tactics, techniques, and procedures (TTPs) are threat actors using?”
-
“How can we detect and respond to these threats?”
This lesson provides the complete mathematical and conceptual framework for Cyber Threat Intelligence in financial institutions. We derive the Intelligence Cycle: Planning → Collection → Processing → Analysis → Dissemination → Feedback. We formalize the Diamond Model of intrusion analysis, which describes the relationships between adversary, capability, infrastructure, and victim. We derive the Pyramid of Pain, which categorizes indicators of compromise (IOCs) by their value to defenders.
We also introduce the MITRE ATT&CK Framework for financial institutions, mapping threat actor TTPs to specific defensive measures. We derive the Threat Intelligence Score: Tintel=α⋅Qdata+β⋅Qanalysis+γ⋅Qaction, which quantifies the effectiveness of a threat intelligence program.
By the end, you will have a complete understanding of Cyber Threat Intelligence and its application to financial institutions.
Learning Objectives
Upon completion of this lesson, you will be able to:
-
Define Cyber Threat Intelligence and its role in financial institutions.
-
Derive the Intelligence Cycle: Planning → Collection → Processing → Analysis → Dissemination → Feedback.
-
Apply the Diamond Model of intrusion analysis: Adversary → Capability → Infrastructure → Victim.
-
Apply the Pyramid of Pain: Hash → IP Address → Domain → Network Artifact → Tools → TTPs.
-
Map the MITRE ATT&CK Framework to financial institutions.
-
Derive the Threat Intelligence Score: Tintel=α⋅Qdata+β⋅Qanalysis+γ⋅Qaction.
Part 1: Cyber Threat Intelligence Defined
1.1 What is Cyber Threat Intelligence?
Cyber Threat Intelligence (CTI) is evidence-based knowledge about existing or emerging cyber threats that can be used to inform decisions.
The CTI Definition:
CTI=Evidence+Analysis+Actionable Insight
Components:
| Component | Description | Example |
|---|---|---|
| Evidence | Raw data about threats | IP addresses, domain names, malware hashes |
| Analysis | Interpretation of the evidence | Attribution to a specific threat actor |
| Actionable Insight | Recommendations for action | “Block these IP addresses” |
1.2 Types of Cyber Threat Intelligence
Cyber Threat Intelligence can be categorized by its scope and purpose:
| Type | Scope | Purpose | Example |
|---|---|---|---|
| Strategic Intelligence | High-level, long-term | Inform executive decisions | Threat landscape trends, geopolitical risks |
| Operational Intelligence | Medium-term, tactical | Inform security operations | Threat actor TTPs, campaign analysis |
| Tactical Intelligence | Short-term, technical | Inform immediate defenses | Indicators of compromise (IOCs) |
| Technical Intelligence | Real-time, granular | Inform automated defenses | Malware signatures, C2 patterns |
Types of Cyber Threat Intelligence (Visual): ┌─────────────────────────────────────────────────────────────────────────┐ | Strategic Intelligence │ | ┌─────────────────────────────────────────────────────────────────┐ │ | │ Audience: Board, C-Suite │ │ | │ Timeframe: 1-3 years │ │ | │ Example: "Nation-state actors are targeting financial │ │ | │ institutions in North America." │ │ | └─────────────────────────────────────────────────────────────────┘ │ | | | Operational Intelligence │ | ┌─────────────────────────────────────────────────────────────────┐ │ | │ Audience: Security Operations Center (SOC) │ │ | │ Timeframe: Weeks to months │ │ | │ Example: "The Lazarus Group is using a new malware variant │ │ | │ targeting SWIFT systems." │ │ | └─────────────────────────────────────────────────────────────────┘ │ | | | Tactical Intelligence │ | ┌─────────────────────────────────────────────────────────────────┐ │ | │ Audience: Security Analysts │ │ | │ Timeframe: Days to weeks │ │ | │ Example: "Block these 10 IP addresses associated with │ │ | │ the latest phishing campaign." │ │ | └─────────────────────────────────────────────────────────────────┘ │ | | | Technical Intelligence │ | ┌─────────────────────────────────────────────────────────────────┐ │ | │ Audience: Security Engineers │ │ | │ Timeframe: Real-time │ │ | │ Example: "New C2 domain detected: evilbank.xyz" │ │ | └─────────────────────────────────────────────────────────────────┘ │ └─────────────────────────────────────────────────────────────────────────┘
Part 2: The Intelligence Cycle
2.1 The Model
The Intelligence Cycle is a systematic process for collecting, analyzing, and disseminating intelligence:
Intelligence Cycle=Planning→Collection→Processing→Analysis→Dissemination→Feedback
2.2 The Six Stages
| Stage | Description | Key Activities |
|---|---|---|
| 1. Planning | Define intelligence requirements and priorities | Identify key questions, prioritize threats |
| 2. Collection | Gather raw intelligence data | Threat feeds, OSINT, dark web monitoring |
| 3. Processing | Convert raw data into a usable format | Data normalization, deduplication, enrichment |
| 4. Analysis | Interpret the processed data | Threat actor attribution, pattern recognition |
| 5. Dissemination | Share intelligence with stakeholders | Reports, alerts, briefings |
| 6. Feedback | Evaluate and improve the intelligence process | Metrics, lessons learned |
Intelligence Cycle (Visual): ┌─────────────────────────────────────────────────────────────────────────┐ | | | ┌───────────────────┐ | | │ Planning │ | | │ Requirements │ | | └────────┬──────────┘ | | │ | | ▼ | | ┌───────────────────┐ | | │ Collection │ | | │ Data Gathering │ | | └────────┬──────────┘ | | │ | | ▼ | | ┌───────────────────┐ | | │ Processing │ | | │ Data Normalization│ | | └────────┬──────────┘ | | │ | | ▼ | | ┌───────────────────┐ | | │ Analysis │ | | │ Interpretation │ | | └────────┬──────────┘ | | │ | | ▼ | | ┌───────────────────┐ | | │ Dissemination │ | | │ Sharing Results │ | | └────────┬──────────┘ | | │ | | ▼ | | ┌───────────────────┐ | | │ Feedback │ | | │ Evaluation │ | | └───────────────────┘ | | │ | | └─────────────────────────────────────────┘ | | └─────────────────────────────────────────────────────────────────────────┘
Part 3: The Diamond Model of Intrusion Analysis
3.1 The Model
The Diamond Model is a framework for analyzing cyber intrusions. It describes the relationships between four core components:
Diamond Model={Adversary,Capability,Infrastructure,Victim}
3.2 The Four Components
| Component | Description | Examples |
|---|---|---|
| Adversary | The threat actor | Nation-state, cybercriminal, insider |
| Capability | The tools and techniques used | Malware, exploits, social engineering |
| Infrastructure | The systems used by the adversary | C2 servers, botnets, email domains |
| Victim | The target of the attack | Financial institution, customer, third-party |
3.3 The Diamond Model Diagram
Diamond Model (Visual): ┌─────────────────────────────────────────────────────────────────────────┐ | | | Adversary | | (Who is attacking) | | ▲ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | | / \ | |/ \ | | Capability ────────────────────────────────────────────── Infrastructure │ | (What is used) (Where from) │ | | | ▼ | | | | Victim | | (Who is targeted) | | | | Relationships: | | ┌─────────────────────────────────────────────────────────────────┐ │ | │ • Adversary ↔ Capability: Attacker uses tools. │ │ | │ • Capability ↔ Infrastructure: Tools are hosted on servers. │ │ | │ • Infrastructure ↔ Victim: Attacks are delivered. │ │ | │ • Victim ↔ Adversary: Attacks have a target. │ │ | └─────────────────────────────────────────────────────────────────┘ │ | | └─────────────────────────────────────────────────────────────────────────┘
Part 4: The Pyramid of Pain
4.1 The Model
The Pyramid of Pain categorizes indicators of compromise (IOCs) by their value to defenders:
Pyramid of Pain=Hash→IP Address→Domain→Network Artifact→Tools→TTPs
4.2 The Six Levels
| Level | Indicator | Difficulty to Change | Defender Value |
|---|---|---|---|
| 1. Hash | File hashes (MD5, SHA-1, SHA-256) | Easy (trivial) | Low |
| 2. IP Address | Attacker IP addresses | Easy (change proxies) | Low-Medium |
| 3. Domain | Attacker domains | Moderate (register new domains) | Medium |
| 4. Network Artifact | URLs, user-agents, ports | Moderate-Hard | Medium-High |
| 5. Tools | Malware families, exploit kits | Hard (rewrite tools) | High |
| 6. TTPs | Tactics, Techniques, Procedures | Very Hard (change behavior) | Very High |
4.3 The Pyramid Diagram
Pyramid of Pain (Visual): ┌─────────────────────────────────────────────────────────────────────────┐ | | | Very High Value ┌─────────────────────────────┐ │ | │ TTPs │ │ | │ (Tactics, Techniques, │ │ | │ Procedures) │ │ | ├─────────────────────────────┤ │ | │ Tools │ │ | │ (Malware, Exploit Kits) │ │ | High Value ├─────────────────────────────┤ │ | │ Network Artifacts │ │ | │ (URLs, User-Agents, Ports) │ │ | Medium Value ├─────────────────────────────┤ │ | │ Domain │ │ | │ (Attacker Domains) │ │ | Low-Medium Value ├─────────────────────────────┤ │ | │ IP Address │ │ | │ (Attacker IPs) │ │ | Low Value ├─────────────────────────────┤ │ | │ Hash │ │ | │ (File Hashes) │ │ | └─────────────────────────────┘ │ | | | Interpretation: │ | ┌─────────────────────────────────────────────────────────────────┐ │ | │ • Moving up the pyramid increases the defender's advantage. │ │ | │ • TTPs are the most valuable intelligence. │ │ | │ • Hashes are the least valuable intelligence. │ │ | └─────────────────────────────────────────────────────────────────┘ │ | | └─────────────────────────────────────────────────────────────────────────┘
Part 5: The MITRE ATT&CK Framework for Financial Institutions
5.1 Overview
The MITRE ATT&CK Framework is a comprehensive knowledge base of adversary tactics and techniques.
ATT&CK=Adversarial Tactics, Techniques, and Common Knowledge
5.2 The 14 Tactics
| Tactic | Description | Financial Sector Examples |
|---|---|---|
| Reconnaissance | Gathering information about the target | Social media OSINT, spear phishing |
| Resource Development | Acquiring resources for the attack | Buying exploit kits, renting botnets |
| Initial Access | Getting into the target environment | Spear phishing, exploitation |
| Execution | Running malicious code | Malware installation, scripts |
| Persistence | Maintaining access | Backdoors, scheduled tasks |
| Privilege Escalation | Gaining higher-level access | Credential theft, zero-day exploits |
| Defense Evasion | Avoiding detection | Obfuscation, anti-virus bypass |
| Credential Access | Stealing credentials | Password cracking, keylogging |
| Discovery | Understanding the target environment | Network scanning, enumeration |
| Lateral Movement | Moving through the network | Pass-the-hash, remote services |
| Collection | Gathering target data | Data exfiltration, screen capture |
| Command & Control | Remote control | C2 servers, tunneling |
| Exfiltration | Stealing data | Data compression, encryption |
| Impact | Disrupting operations | Ransomware, denial of service |
5.3 Financial Sector ATT&CK Mapping
| Threat Actor | MITRE Group | Common Techniques |
|---|---|---|
| FIN7 | G0046 | T1059 (Command Execution), T1583 (Acquire Infrastructure) |
| APT38 | G0082 | T1046 (Network Scanning), T1568 (Dynamic Resolution) |
| Lazarus Group | G0032 | T1203 (Exploit via Email), T1055 (Process Injection) |
| Carbanak Group | G0008 | T1486 (Data Encryption for Impact), T1530 (Data from Cloud) |
MITRE ATT&CK for Financial Institutions (Visual): ┌─────────────────────────────────────────────────────────────────────────┐ | Financial Sector ATT&CK Techniques │ | ┌─────────────────────────────────────────────────────────────────┐ │ | │ Tactic │ Technique │ │ | │───────────────────────┼───────────────────────────────────────│ │ | │ Initial Access │ T1566: Phishing │ │ | │ │ T1189: Drive-by Compromise │ │ | │───────────────────────┼───────────────────────────────────────│ │ | │ Persistence │ T1505: Server Software Component │ │ | │ │ T1547: Boot/Logon Autostart │ │ | │───────────────────────┼───────────────────────────────────────│ │ | │ Defense Evasion │ T1027: Obfuscated Files │ │ | │ │ T1070: Indicator Removal │ │ | │───────────────────────┼───────────────────────────────────────│ │ | │ Credential Access │ T1110: Brute Force │ │ | │ │ T1555: Credentials from Password │ │ | │ │ Stores │ │ | │───────────────────────┼───────────────────────────────────────│ │ | │ Lateral Movement │ T1021: Remote Services │ │ | │ │ T1550: Use Alternate │ │ | │ │ Authentication │ │ | │───────────────────────┼───────────────────────────────────────│ │ | │ Exfiltration │ T1048: Exfiltration Over C2 │ │ | │ │ T1537: Transfer Data to Cloud │ │ | └─────────────────────────────────────────────────────────────────┘ │ └─────────────────────────────────────────────────────────────────────────┘
Part 6: The Threat Intelligence Score
6.1 Definition
The Threat Intelligence Score quantifies the effectiveness of a threat intelligence program:
Tintel=α⋅Qdata+β⋅Qanalysis+γ⋅Qaction
Where:
-
Qdata is the Quality of Data (0-1)
-
Qanalysis is the Quality of Analysis (0-1)
-
Qaction is the Quality of Action (0-1)
-
α,β,γ are weights (typically α=0.3,β=0.4,γ=0.3)
6.2 Components
| Component | Metrics | Weight |
|---|---|---|
| Data Quality | Completeness, Accuracy, Timeliness | 30% |
| Analysis Quality | Relevance, Depth, Clarity | 40% |
| Action Quality | Implementability, Effectiveness, Speed | 30% |
Threat Intelligence Score (Visual): ┌─────────────────────────────────────────────────────────────────────────┐ | Data Quality: 0.85 │ | ┌─────────────────────────────────────────────────────────────────┐ │ | │ • Completeness: 0.90 │ │ | │ • Accuracy: 0.85 │ │ | │ • Timeliness: 0.80 │ │ | └─────────────────────────────────────────────────────────────────┘ │ | | | Analysis Quality: 0.82 │ | ┌─────────────────────────────────────────────────────────────────┐ │ | │ • Relevance: 0.85 │ │ | │ • Depth: 0.80 │ │ | │ • Clarity: 0.82 │ │ | └─────────────────────────────────────────────────────────────────┘ │ | | | Action Quality: 0.88 │ | ┌─────────────────────────────────────────────────────────────────┐ │ | │ • Implementability: 0.90 │ │ | │ • Effectiveness: 0.85 │ │ | │ • Speed: 0.89 │ │ | └─────────────────────────────────────────────────────────────────┘ │ | | | Threat Intelligence Score: │ | ┌─────────────────────────────────────────────────────────────────┐ │ | │ T = 0.3 * 0.85 + 0.4 * 0.82 + 0.3 * 0.88 = 0.85 │ │ | │ Status: Excellent │ │ | └─────────────────────────────────────────────────────────────────┘ │ └─────────────────────────────────────────────────────────────────────────┘
Summary and Bridge to Lesson 1.4
We have now completed the Cyber Threat Intelligence framework. You have learned:
-
Cyber Threat Intelligence: Evidence + Analysis + Actionable Insight.
-
Intelligence Cycle: Planning → Collection → Processing → Analysis → Dissemination → Feedback.
-
Diamond Model: Adversary → Capability → Infrastructure → Victim.
-
Pyramid of Pain: Hash → IP → Domain → Network Artifact → Tools → TTPs.
-
MITRE ATT&CK: Tactics, Techniques, and Common Knowledge for financial institutions.
-
Threat Intelligence Score: Tintel=α⋅Qdata+β⋅Qanalysis+γ⋅Qaction.
In Lesson 1.4, we will explore Cyber Risk Assessment and Quantification for Financial Institutions.