The CREST Practitioner Threat Intelligence Analyst (CPTIA)

If a hacker influences an employee or a disgruntled staff member to gain access to an organization's resources or sensitive information, this is classified as an insider attack. Insider attacks are perpetrated by individuals within the organization, such as employees, contractors, or business associates, who have inside information concerning the organization's security practices, data, and computer systems. The threat from insiders can be intentional, as in the case of a disgruntled employee seeking to harm the organization, or unintentional, where an employee is manipulated or coerced by external parties without realizing the implications of their actions. Phishing attacks, footprinting, and identity theft represent different types of cybersecurity threats where the attacker's method or objective differs from that of insider attacks. References: The CREST program addresses various types of threats, including insider threats, emphasizing the importance of recognizing and mitigating risks posed by individuals within the organization.

Incident triage is the phase in the incident handling and response process where identified security incidents are analyzed, validated, categorized, and prioritized. This step is critical for determining the severity of incidents and deciding on the allocation of resources for effective response. It involves initial analysis to understand the nature of the incident, its impact, and urgency, which guides the subsequent response actions.

References: The incident triage phase is a foundational concept in the CREST CPTIA curriculum, emphasizing the importance of a structured approach to responding to security incidents, ensuring that resources are focused where they are needed most.

Incident triage is the phase in the Incident Handling and Response (IH & R) process where identified security incidents are analyzed, validated, categorized, and prioritized. This step is crucial for determining the severity of incidents and deciding on the order in which they should be addressed. During triage, incident handlers assess the impact, urgency, and potential harm of an incident to prioritize their response efforts effectively. This ensures that resources are allocated efficiently, and the most critical incidents are handled first. Incident recording and assignment involve logging incidents and assigning them to handlers, containment focuses on limiting the extent of damage, and notification involves informing stakeholders about the incident. References: The Incident Handler (CREST CPTIA) courses and study guides detail the IH & R process, emphasizing the importance of triage in managing and responding to security incidents effectively.

Not enabling default administrative accounts is crucial to ensuring accountability and minimizing the risk of insider attacks by privileged users. By disabling or renaming default accounts, organizations can better track the actions performed by individual administrators, reducing the risk of unauthorized or malicious activities going unnoticed. This practice is part of a broader approach to privilege management that includes limiting permissions to the minimum necessary and monitoring the use of administrative privileges.

References: The CREST CPTIA program emphasizes the importance of managing privileged access and ensuring accountability among users with elevated permissions to protect against insider threats and misuse of administrative rights.

Tactical threat intelligence analysis focuses on the immediate, technical indicators of threats, such as the tactics, techniques, and procedures (TTPs) used by adversaries, their communication channels, the tools and software they utilize, and their strategies for evading forensic analysis. This type of analysis is crucial for operational defenses and is used by security teams to adjust their defenses against current threats. Since John successfully extracted information related to the adversaries' modus operandi, tools, communication channels, and evasion strategies, he is performing tactical threat intelligence analysis. This differs from strategic and operational threat intelligence, which focus on broader trends and specific operations, respectively, and from technical threat intelligence, which deals with technical indicators like malware signatures and IPs. References:

"Tactical Cyber Intelligence," by Cyber Threat Intelligence Network, Inc.

"Intelligence-Driven Incident Response: Outwitting the Adversary," by Scott J. Roberts and Rebekah Brown

Normalization in the context of data analysis refers to the process of organizing data to reduce redundancy and improve efficiency in storing and sharing. By filtering, tagging, and queuing, Miley is effectively normalizing the data—converting it from various unstructured formats into a structured, more accessible format. This makes the data easier to analyze, store, and share. Normalization is crucial in cybersecurity and threat intelligence to manage the vast amounts of data collected and ensure that only relevant data is retained and analyzed. This technique contrasts with sandboxing, which is used for isolating and analyzing suspicious code; data visualization, which involves representing data graphically; and convenience sampling, which is a method of sampling where samples are taken from a group that is conveniently accessible. References:

"The Application of Data Normalization to Database Security," International Journal of Computer Science Issues

SANS Institute Reading Room, "Data Normalization Considerations in Cyber Threat Intelligence"

Email-bombing refers to the attack where the attacker sends a massive volume of emails to a specific email address or mail server in order to overflow the mailbox or overwhelm the server, potentially causing it to fail or deny service to legitimate users. This attack can disrupt communications and, in some cases, lead to the targeted email account being disabled. Masquerading involves pretending to be another legitimate user, spoofing is the creation of emails (or other communications) with a forged sender address, and a smurf attack is a specific type of Distributed Denial of Service (DDoS) attack that exploits Internet Protocol (IP) and Internet Control Message Protocol (ICMP) to flood a target with traffic. Email-bombing specifically targets email services with the goal of causing disruption by overflowing inboxes. References: CREST CPTIA courses and study guides often include discussions on various attack vectors used by cybercriminals, including email-based threats and their impact on organizational security.

The information Sarah is gathering, which includes collections of validated and prioritized threat indicators along with detailed technical analysis of malware samples, botnets, DDoS methods, and other malicious tools, indicates that she is obtaining this intelligence from providers of comprehensive cyber-threat intelligence. These providers offer a holistic view of the threat landscape, combining tactical and operational threat data with in-depth analysis and context, enabling security teams to make informed decisions and strategically enhance their defenses. References:

"Cyber Threat Intelligence Providers: How to Choose the Right One for Your Organization," by CrowdStrike

"The Role of Comprehensive Cyber Threat Intelligence in Effective Cybersecurity Strategies," by FireEye

Karry's method of collecting data, which involves no active engagement with participants and is purely based on analysis and observation of activities within the organization, is known as passive data collection. This method is characterized by the non-intrusive monitoring of data and events, allowing analysts to gather intelligence without alerting potential adversaries or disrupting ongoing processes. Passive data collection is essential for maintaining operational security and obtaining an unaltered view of system and network activities. References:

"Passive Data Collection in Cybersecurity," by Cybersecurity Guide

"Understanding Passive and Active Data Collection for Cyber Threat Intelligence," by ThreatConnect