CTSP flashcards

36 cards. Read the term and the definition here. The deck at the top of this page is optional.

Intelligence cycle phases

Direction and planning, collection, processing and exploitation, analysis and production, dissemination, and feedback. Each phase produces input for the next and the cycle repeats as requirements change.

Pyramid of Pain

A ranking of indicator types by how much difficulty removing them causes an adversary. Hashes and IPs sit at the bottom; TTPs and tooling sit at the top because they are costly to change.

Diamond Model

A model linking four core features of any intrusion: adversary, capability, infrastructure, and victim. Analysts pivot along the edges between nodes to correlate activity into campaigns.

F3EAD loop

Find, Fix, Finish, Exploit, Analyze, Disseminate. An action-oriented cycle that pairs intelligence with operations, closing the loop by feeding exploitation results back into analysis.

Intelligence requirement

A stated question a decision-maker needs answered, scoped by time, geography, and subject. Collection and analysis are justified only when traceable to a requirement.

APT characteristics

Sustained, resourced intrusion activity, typically state-linked, prioritizing espionage or strategic positioning. Long dwell time, custom tooling, and infrastructure discipline distinguish it from commodity crime.

Initial access broker

An actor who gains and sells access to victim networks to other operators, often ransomware affiliates. They monetize intrusion without running the follow-on extortion themselves.

ATT&CK tactics vs techniques

Tactics are adversary goals such as persistence or credential access; techniques are the specific methods used to achieve them, identified by IDs like T1059.

Actor alias tracking

Vendors assign different names to the same actor. Analysts maintain alias mappings and note the source vendor when citing a name to avoid false merging of distinct groups.

Commodity versus targeted activity

Commodity campaigns use broad, reusable lures and public tooling against many victims. Targeted campaigns tailor infrastructure and lures to specific organizations and maintain stealth.

Priority intelligence requirements

PIRs are the ranked questions leadership most needs answered to make decisions. They drive collection planning and determine which sources are worth the cost.

Admiralty source rating

A two-part code rating source reliability A through F and information credibility 1 through 6. Both letters are reported together to convey evidentiary weight.

Passive versus active collection

Passive collection observes existing traffic or logs without touching targets. Active collection interacts with systems, such as scanning or sinkholing, and carries legal and OPSEC exposure.

Collection plan contents

A table mapping each requirement to source, method, frequency, owner, and confidence threshold. It also records known gaps so analysts do not overstate coverage.

Observable provenance

Metadata recording where an indicator came from, when it was first and last seen, and who reported it. Provenance lets consumers re-verify and weight indicators correctly.

Analysis of Competing Hypotheses

A technique listing alternative hypotheses and scoring evidence for consistency or inconsistency with each. Analysts reject hypotheses with the most inconsistent evidence rather than confirming a favorite.

Key Assumptions Check

A structured review that surfaces the unstated premises an analytic judgment depends on, then tests each for validity. Unverified assumptions are flagged in the report.

Indicators and signposts

Predefined observable events that would confirm or disconfirm each hypothesis. They are set before new reporting arrives to reduce after-the-fact rationalization.

Confidence versus likelihood

Likelihood expresses the probability of an event; confidence expresses the strength of the evidence behind the judgment. A high-likelihood call can still carry low confidence.

Cognitive bias in CTI

Recurring judgment errors including confirmation bias, anchoring, availability, mirror-imaging, and groupthink. Structured techniques are used specifically to expose and counter them.

IOC aging and decay

Indicators lose value over time as infrastructure is repurposed, sinkholed, or cleaned. Analysts re-verify before blocking and set time-to-live values on automated blocks.

Hypothesis-driven hunting

Hunting starts from a falsifiable statement derived from intelligence or a detection gap. The analyst defines data sources, time window, and expected observable before querying.

YARA versus Sigma

YARA rules match file content and memory patterns. Sigma rules describe log-based detections in a portable format converted to vendor query languages such as Splunk or Sentinel.

JA3 fingerprinting

A hash of TLS client hello parameters used to identify client applications regardless of IP. It supports hunting for malware families with distinctive TLS stacks.

Pivoting on infrastructure

Moving from one observable to related infrastructure using passive DNS, WHOIS or RDAP, and certificate transparency. Pivoting expands a single indicator into a campaign view.

STIX 2.1 objects

A standardized data model for cyber threat intelligence, defining indicators, malware, threat actors, campaigns, relationships, and sightings with a common JSON structure.

TAXII role

TAXII is a transport protocol for exchanging STIX over HTTPS using collections and channels. It moves the data model; it does not define the objects themselves.

MISP sharing model

An open-source platform organizing intelligence as events with attributes, taxonomies, and galaxies. Sharing groups and distribution levels control who receives each event.

TIP enrichment function

Enrichment adds context to observables from sources such as sandboxes, passive DNS, and reputation services. It informs scoring but does not by itself confirm maliciousness.

Automated blocking safeguards

Confidence thresholds, TTLs, and allowlists applied before a TIP pushes indicators to firewalls or EDR. They prevent false positives from disrupting production.

TLP 2.0 markings

Traffic Light Protocol levels CLEAR, GREEN, AMBER, AMBER plus STRICT, and RED define sharing scope. Markings must travel with the content when it is redistributed.

BLUF reporting structure

Bottom Line Up Front: state the key judgment first, then confidence, evidence, implications, recommended actions, and gaps. It lets busy readers act without reading the full report.

Report tearline

A separation between the narrative assessment and machine-readable observables such as CSV or STIX. Consumers ingest indicators automatically while analysts read the judgment.

Analyst OPSEC basics

Separate research identities from personal accounts, use isolated virtual machines, and avoid attributing activity from a personal IP. These practices protect both the analyst and the organization.

Feed license restrictions

Commercial intelligence feeds often prohibit redistribution to third parties. Analysts check license terms before sharing indicators outside the licensed organization or sharing group.

Chain of custody

Documentation of who collected an artifact, when, how, and its hash at each transfer. It preserves evidentiary value for legal, HR, or law-enforcement proceedings.