CTI: Operational Security and Threat Intelligence Program Management

This domain tests two linked subjects: protecting your own collection activity, and building a programme that survives budget cycles. Items often present a research scenario and ask what the analyst should have done differently.

The OPSEC process

1. Identify critical information - your sources, methods, attribution data, customer identities, investigation scope.
2. Analyse the threat - who wants it: the adversary, affiliates, competitors.
3. Analyse vulnerabilities - attributable research infrastructure, leaked documents, metadata, social engineering.
4. Assess risk.
5. Apply countermeasures.

Practical countermeasures

• Sock puppets and separate research identities; never browse adversary infrastructure from corporate addresses.
• Dedicated research virtual machines, commercial VPN or Tor, non-attributable infrastructure, isolated browser profiles.
• Strip document and image metadata before sharing.
• Do not resolve or visit command-and-control from production; use sandboxes and passive DNS.
• Compartmentalise accounts, payment methods and hardware used for covert collection.
• Legal and ethical check: authorisation, computer misuse legislation, no access without lawful basis, lawful handling of personal data.
• Internal OPSEC: TLP handling, need-to-know, secure storage of sensitive reports.

Programme management

• Charter: mission, scope, stakeholders, authority.
• People and process before tooling; build versus buy decisions for platform and feeds.
• Roles across collection, analysis and detection engineering, with training and cover for absence.
• Metrics that matter: requirements answered, time-to-detect, detections deployed, false positive rate, decisions influenced. Avoid vanity metrics such as indicator count ingested.
• Vendor selection on coverage, latency, false positive rate, API integration, licensing and cost.
• Maturity roadmap with quick wins first: one requirement, one sharing relationship, one detection pipeline.

Worked example

An analyst wants to research a ransomware group's leak site from their office workstation. Reasoning: critical information is the fact of your interest and your corporate address range; the threat is the group and its affiliates, who monitor visitors and can retaliate; the vulnerability is that corporate egress addresses are attributable and browser fingerprinting identifies the analyst; risk is high for tipping off or being targeted; countermeasure is an isolated research virtual machine behind a commercial VPN under a dedicated persona, no corporate credentials, screenshots rather than downloads, and a logged record of the activity. Document the decision so it can be reviewed later.

Traps that cost marks

• Researching adversaries from production infrastructure.
• Publishing reports with document metadata intact.
• Conducting covert collection without a documented legal basis.
• Reporting feed volume as evidence of programme value.