INTELLIGENCE IN CYBERSPACE
Cyberintelligence
Understand the digital environment to anticipate relevant risks, actors and events.
Cyberintelligence brings together processes for obtaining, integrating and analyzing information about cyberspace and the digital environment to reduce uncertainty and support decision-making.
Its scope can range from technical threats and malicious activity to actors, campaigns, narratives, infrastructure, events and signals observable in open sources.
Cyberintelligence is not just about analyzing malware or technical indicators.
TWO COMPLEMENTARY FUNCTIONS
Protection and understanding serve different purposes.
Cybersecurity
Protects systems, networks, services and data.
Cyberintelligence
Seeks to understand threats, actors, capabilities, behaviors and changes in the environment.
Cybersecurity focuses on protection. Cyberintelligence provides knowledge to guide decisions on protection, prevention, anticipation and response.
INFORMATION LAYERS
One discipline, different layers of information.
Technical threats
malware · IOCs · vulnerabilities · infrastructure
Actors and campaigns
groups · objectives · behaviors · patterns
Digital environment
narratives · events · relationships · spread
Open sources
media · web · public platforms · documents
PSID focuses primarily on the layers of actors and campaigns, the digital environment and open sources.
CYBER THREAT INTELLIGENCE
Where does threat intelligence fit?
Cyber Threat Intelligence (CTI) is an important part of cyberintelligence focused on understanding threats that may affect systems, networks or organizations.
Technical
Indicators and infrastructure.
Tactical
Techniques, procedures and behaviors.
Operational
Campaigns, objectives and activity.
Strategic
Actors, trends, risk and context.
PSID can provide context from open sources and the digital environment, but it does not replace a specialized technical CTI platform.
OPEN SOURCES
The open environment also yields relevant intelligence.
Actors, organizations, media, platforms, communities and public websites generate signals that can provide context on events, campaigns, narratives, relationships and change.
OSINT makes it possible to use these sources in a structured way.
Open sources
- Actors
- Campaigns
- Narratives
- Events
DIMENSIONS
Threats and risks also have context.
Actors
Who is involved and how they behave.
Campaigns
Which activity is sustained or coordinated over time.
Narratives
Which messages, interpretations or frames circulate around an event.
A technical signal may take on a different meaning when connected to an actor, an event, a campaign or a narrative.
CHANGE AND HYPOTHESES
Understanding activity requires observing how it evolves.
Linking activity to an actor requires multiple sources, evidence and confidence assessments. Coincidence in timing, narrative or relationships does not, on its own, establish attribution.
- Signal
- Pattern
- Context
- Corroboration
- Hypothesis
SITUATIONAL AWARENESS
Understand the environment before a signal becomes a surprise.
Situational awareness requires knowing what is happening, what has changed, who is involved and how signals relate to a particular mission or risk.
Cyberintelligence helps reduce uncertainty and identify information that deserves attention.
- What is happening
- Who is involved
- What has changed
- How it connects
- What deserves attention
PSID
PSID provides intelligence on the digital environment.
PSID organizes the use of open sources around specific information requirements, making it possible to monitor actors, topics, events and signals in the digital environment with evidence, context and a view of change over time.
Its role is to help make sense of the information and digital environment surrounding a mission, complementing other specialized cybersecurity or threat intelligence capabilities where appropriate.
PSID does not replace technical cybersecurity capabilities. It adds context and intelligence about the digital environment.
Technical capabilities
malware · IOCs · vulnerabilities · telemetry
Intelligence on the digital environment
actors · narratives · events · evidence
Better context for decisions
DIGITAL ENVIRONMENT
Cyberspace is also an information environment.
Digital activity cannot be understood through technical indicators alone. Actors, events, relationships, narratives and timing are also part of the context.
Explore intelligence on the digital environment →Technical indicators
- Actors
- Narratives
- Events
- Relationships
- Time
SECURITY AND DEFENSE
A relevant capability for security and defense.
Modern security, defense and intelligence organizations consider cyberspace and the information environment relevant domains for acquiring knowledge, building situational awareness and making decisions.
The use of open sources, actor analysis, observation of campaigns and understanding of the digital environment can complement other technical and operational capabilities.
- Situational awareness
- Reduced uncertainty
- Decision support
Signals show activity.Context helps make sense of it.Intelligence supports decisions.
PSID
Timely insight into the digital environment.