Cyber Threat Intelligence

Description of the training

This training provides the skills necessary to collect, analyse and use information on cyber threats in order to anticipate, detect and respond effectively to cyber attacks.

Objectives of training

At the end of this training, participants will be able to:

• Understand the foundations of Cyber Threat Intelligence.
• Collect, analyze and correlate information on threats.
• Use ITC tools and platforms.
• Produce exploitable intelligence reports.
• Integrate ITC into a defensive cybersecurity strategy.

Who is this training for?

The training is aimed at a wide audience, including:

• Computer security officers.
• Systems and networks administrators.
• Cybersecurity consultants.
• Cloud Architects and Infrastructure.
• Compliance and Governance Professionals IT.

Prerequisites

No specific prerequisites are required.

Training programme

Introduction to Cyber Threat Intelligence

• Typologies of intelligence (strategic, tactical, operational, technical)
• The intelligence cycle
• Role of ITC in a comprehensive security strategy
• Differences between cloud security and the security of traditional infrastructure.

Threat Actors and Motivations

• Typology of attackers: APTs, hacktivists, cybercriminals, insiders
• TTPs (Techniques, Tactics and Procedures)
• Case studies: analysis of known actors (e.g. Lazarus, FIN7)

Data sources and collection

• OSINT (Open Source Intelligence)
• HUMINT, SIGINT, Dark Web, underground forums
• Technical sources (logs, IOC, sandbox, honeypots)
• Collection tools (e.g. Maltego, SpiderFoot, Shodan)

Analysis and correlation

• Cloud Access Governance and Management (IAM, RBAC)
• Cloud Network Security Configuration: Firewall, VPC, and Application Security
• Multi-factor authentication (MFA)
• Identity and Compliance Management Strategies

Production and dissemination

• Standard formats (STIX, TAXII, IODEF).
• Preparation of exploitable ITC reports (executive vs. technical)
• Information sharing (ISACs, CERTs, public/private partnerships)

ITCs in the organisational environment

• Integration with SOC, SIEM and other security teams
• ITC and proactive detection
• Case of use in risk management and incident response
• CTI limitations and challenges (biash, audit, over-information)

Use case

• Analysis of an APT from open sources
• Creation and dissemination of an ITC report

Simulation of the intelligence cycle

Training assets

• Pedagogical approach: An alternative between theory and practice for better assimilation of concepts.
• Qualified speakers: Specialist trainers with practical experience in the field of cloud security.
• Educational tools and materials: Access to online resources, live demonstrations and real-life case studies.
• Accessibility: Training is open to all, without advanced technical prerequisites.

Pedagogical methods and tools used

Live demonstrations on cloud security.
Real case studies and practical work.
Discussions on best practices in the field.
Project management tools for monitoring and feedback.

Evaluation

• MCQ at the end of training.
• Practical case studies.
• Continuous evaluation with personalized feedback.

Normative References

• Well-Architected Cloud Providers Framework
• ISO/IEC 19086
• GDPR (General Data Protection Regulation)
• NIST Cloud Computing Standards (SP 500-292)
• ISO 27001 Information Security: Guarantees data security in cloud environments while monitoring and managing costs