Current intelligence deals with day-to-day events. While current intelligence is an integral component of threat intelligence, threat intelligence teams' effort to respond to their customers' current needs can dominate collection and analysis, resulting in piecemeal and narrowly focused intelligence flow. The domination can also hinder the continuity of analyses and the production of other levels of intelligence analysis meant to protect the organization. This presentation will first define what current intelligence is and how it differs from the other intelligence analysis products. We will then explore the dangers of over-prioritizing current threat intelligence to an organization and its stakeholders. Finally, the presentation will provide recommendations on managing current intelligence with your customers and within your threat intelligence team.

About the Speaker
Sherman is the lead technical threat intelligence analyst for New York City Cyber Command (NYC3). A US Army veteran, Sherman spent time integrating threat intelligence with incident response at a major financial institution, and performed collection and analysis work at a threat intelligence vendor before his time at NYC3.

View upcoming Summits: [ Ссылка ]
Download the presentation slides (SANS account required) at [ Ссылка ]
#CTISummit

свернуть