Security teams today have access to multiple sources of information on threats and threat actors.
These come from industry, from law enforcement, and even their own networks and SOCs. The volume of information can sometimes be overwhelming.
But what, exactly, is threat intelligence? And how do CISOs use it? And how effective is it against an ever-changing roster of adversaries?
We invited Rafe Pilling, director of threat intelligence at Sophos, to discuss how threat intelligence has developed, and how it works, in the context of some of the recent attacks and threat groups.
We also look at how a threat intelligence team works on a day to day basis, and the skills needed to work in the field.
And we discuss the differences between producing and consuming threat intelligence, and how to use the information to strengthen defences, as well as for a more effective response during a security incident.
After all, it is people that security teams are up against during a cyber attack, and threat intelligence can help CISOs understand the adversaries’ motives, and what they might do next.
Featured image by Gerd Altmann from Pixabay
