CTAS case studies
CTAS · Put your knowledge to work in context.
The Certified Threat Analysis and Strategy (CTAS) credential is aimed at analysts and team leads who turn raw threat data into decisions: what an adversary is doing, how likely it is to affect a given organization, and what should be done first. It suits cyber threat intelligence analysts, SOC and detection engineers moving toward intelligence work, incident responders who write assessments, and managers who own a threat intelligence program or its budget. The CTAS case studies are 5 cases and about 3,483 words.
1Scoping a Hospital Chain's First Intelligence Requirement
Northgate Health is a 12-hospital nonprofit with 9,400 staff, 1,600 endpoints, and 22,000 mailboxes. Last year a ransomware incident encrypted three file servers and caused 11 days of partial EHR downtime; the ransom was not paid.
663 words, about 3 min2Evaluating a Premium Feed Before Renewal
Meridian Pay is a payments processor with 3,200 employees and a five-person CTI team. It currently buys commercial feed A for 180,000 per year, commercial feed B for 95,000, receives sector ISAC reports, runs an OSINT crawler, and monitors two dark-web forums.
729 words, about 4 min3Triage of a Ransomware Affiliate Indicator Dump
At 09:10 on a Monday, an analyst receives a 4,800-indicator dump from a ransomware affiliate leak: 2,100 domains, 1,600 IPv4 addresses, 900 file hashes, and 200 email addresses. Initial enrichment shows 62% of the domains are already sinkholed by a public resolver, 410 IPs belong to two content-delivery networks, and 280 hashes match unsigned commodity utilities.
694 words, about 3 min4OAuth Abuse at a SaaS Provider
At a SaaS provider serving 14 enterprise tenants, the security team finds anomalous OAuth activity 30 days after a helpdesk vishing call. An attacker posing as a new employee persuaded the service desk to reset MFA and enroll a new device.
698 words, about 3 min5Sharing Malware Config Data Across a Health ISAC
A national health-sector ISAC with eight member organizations is handling a malware-configuration corpus seized during an incident response. The corpus contains 1,200 victim URLs, 300 plaintext credentials, and 40 internal hostnames.
699 words, about 3 min