CTAS flashcards

35 cards. Read the term and the definition here. The deck at the top of this page is optional.

Priority Intelligence Requirement

A statement of what decision-makers most need to know about the threat environment, tied to a specific decision, consumer, and deadline, which directs collection and analysis priorities.

Essential Elements of Information

The specific, answerable sub-questions that decompose a priority intelligence requirement into collectable facts, each with a source and a resolution criterion.

Intelligence Cycle

The repeating process of direction, collection, processing, analysis and production, dissemination, and feedback, where feedback refines the next round of requirements.

Source Reliability versus Credibility

Two independent ratings: reliability describes the source's historical trustworthiness, while credibility describes how likely this specific piece of information is true.

Threat versus Risk

Threat is the capability and intent to cause harm; risk combines the likelihood of that harm with its impact on an asset or mission.

Collection Plan

A document mapping each intelligence requirement to its source, collection method, frequency, owner, and cost, enabling gap analysis and source retirement decisions.

Indicator Time-to-Live

A per-indicator expiry period after which the indicator is reviewed or retired; hashes and domains age out faster than behavioral TTPs.

Feed Onboarding Assessment

Evaluation of a new source for environment coverage, false-positive rate, update cadence, licensing terms, schema quality, and confidence and provenance fields.

Corroboration Independence

The principle that multiple feeds reporting the same indicator only corroborate it if they do not share an upstream provider or common origin.

Collection Gap Register

A documented list of requirements that current sources cannot answer, with associated risk acceptance and a path to close the gap.

Analysis of Competing Hypotheses

A structured technique that lists alternative explanations, scores evidence as consistent, inconsistent, or neutral for each, and favors the hypothesis with least disconfirming evidence.

Key Assumptions Check

A structured analytic technique that surfaces the unstated beliefs underlying an assessment and tests whether each is still valid and supported.

Confidence versus Probability Language

Two separate expression scales: confidence describes analytic certainty in the judgment, while probability describes the likelihood of the event; they should not be mixed.

Diamond Model

An analytic framework linking adversary, capability, infrastructure, and victim, used to pivot from single indicators to campaigns and actor relationships.

Indicators of Change

Predefined observations that would cause an analyst to revise a key judgment, stated in the product so consumers can monitor for shifts.

MITRE ATT&CK Mapping

Assigning observed adversary behavior to documented tactics and techniques, producing comparable findings that support detection coverage assessment.

Living-off-the-Land Binaries

Legitimate signed system tools abused by adversaries to perform actions while evading signature detection, requiring behavior-based monitoring of command lines and process ancestry.

Kill Chain Model

A defensive sequence from reconnaissance through actions on objective; adversaries may skip or repeat stages, so it is not a literal attack plan.

Command and Control Beaconing

Regular outbound communication from implanted malware to attacker infrastructure; jitter, sleep intervals, and destination reputation are detection features.

Actor Profiling

Characterizing adversaries by motivation, resources, targeting, and risk tolerance, while keeping attribution confidence separate from assessed impact.

Bottom Line Up Front

A product structure that states the key judgment and its confidence first, followed by implications, recommended actions, then supporting detail and sources.

Traffic Light Protocol

A marking scheme (CLEAR, GREEN, AMBER, AMBER+STRICT, RED) that defines permitted onward sharing of a product and must travel with it.

Actionability Test

A check that a product names the decision it supports, the owner, the recommended action, and the deadline; failing this, it is background only.

STIX and TAXII

Standards for representing and exchanging cyber threat intelligence in machine-readable form, requiring schema conformance and confidence fields for downstream automation.

Intelligence Product Cadence

Matching product type to decision speed: tactical alerts in minutes to hours, operational reports in days, strategic assessments in weeks to months.

Risk Scoring versus Severity Scoring

Severity frameworks such as CVSS rate a vulnerability's characteristics, while risk scoring combines likelihood and business impact on a specific asset.

Strategic Warning Indicators

Leading signals such as capability development, doctrine shifts, or targeting of peer organizations, tracked over time to anticipate changes in the threat landscape.

Risk Treatment Options

The four responses to assessed risk: mitigate, transfer, avoid, or accept; each accepted risk requires an owner, rationale, and review date.

Asset Criticality Weighting

Adjusting threat prioritization by the business importance, exposure, and existing controls of the targeted asset rather than by threat severity alone.

Traffic Light Protocol Marking

A sharing restriction label attached to intelligence products that specifies who may receive and further distribute the content.

Data Minimization

Collecting and retaining only the personal data necessary for the intelligence purpose, with retention limits and access controls documented.

Attribution Confidence

The assessed degree of certainty linking activity to an actor; technical linkage is distinct from legal proof and must not be overstated publicly.

Outcome Metrics

Program measures of whether intelligence changed a decision or enabled earlier detection, preferred over volume counts such as number of indicators ingested.

Validated Detection Coverage

The proportion of priority ATT&CK techniques with tested detection rules that fire correctly, as opposed to a raw count of deployed rules.

Post-Incident Intelligence Review

A comparison of prior assessments with what actually occurred, feeding corrections back into requirements, source selection, and detection content.