© The Author(s), under exclusive license to APress Media, LLC, part of Springer Nature 2021
A. RobertsCyber Threat Intelligencehttps://doi.org/10.1007/978-1-4842-7220-6_10

10. Useful Resources

Aaron Roberts1  
(1)
London, UK
 

What is a practical “tech” book without a hefty list of resources that may be out of date by the time you read them, eh? Well, luckily I’m on hand to deliver such a useful collection for you! So while I sincerely hope this chapter can give you some resources that you can immediately use, I also want you to know that I maintain my own list of resources online, and you can get that via my blog.1 Hopefully, the combination of book and weblink should give you a solid starting point to build out your research and investigation.

Before we delve into some of the valuable links and different web resources I use and would recommend, I thought I’d also touch on the following steps to formalize an interest in CTI and take it forward for any budding analyst who’s taken the time to read this book (and if you have, then thank you!). This book was initially conceived as an aid for those in senior positions who may want or need to set up a CTI team, and as such, I’ve avoided going too deep into the rabbit hole for analysis. But I’m acutely aware that a book like this can be read by more junior people who want to learn. While I stand by this book as an introduction to CTI and the core fundamentals that I believe a CTI team should operate from, it doesn’t help you be a better intelligence analyst without putting the learning into practice.

So with that in mind, if you’re looking to become a CTI analyst, these are the things I think you need to have a good grasp on to be successful, some of them we’ve covered within the book, of course, but others sit outside the scope of this book:

  • The intelligence cycle

  • Intelligence requirements

  • Intelligence writing

  • Ways of classifying intelligence (confidentiality, source evaluation, etc.)

  • Structured analytical techniques (analysis of competing hypotheses, cone of plausibility, contrarian/imaginative techniques, etc.)

  • Conscious/unconscious bias

  • CTI-specific concepts (diamond model, ATT&CK, STIX/TAXII)

  • Collection and analysis specifics (infrastructure pivoting, link analysis, OSINT tooling)

  • Yara rules and other basic hunting methods (understanding adversary use of DNS, domain registrations, metadata)

  • Using different infrastructure (virtual machines, cloud service providers, third-party tools, etc.)

The preceding list would be a great starting point for any CTI analyst. Truth be told, the vast majority of this list would also sit any discipline of intelligence pretty well, as the core fundamentals of intelligence analysis don’t change – but the cyber-specific areas are clearly the ones that can significantly benefit anyone working in CTI, surprise surprise!

It’s also unlikely to come as a surprise that the ability to do scripting to some degree could also be a huge benefit. I say this as someone who really struggles with this and wishes he could do it. It’s definitely not an essential skill, but it will make life easier if you’re comfortable writing scripts and being able to query the APIs of some of the tools you’re going to interact with daily.

What’s also vital for any would-be intelligence analysis is an inherent curiosity. If you like investigating, sorting the wheat from the chaff, and trying to establish precisely what is going on in a given scenario, then you’re likely to succeed as an intel analyst. The world of cyber can be incredibly daunting, and there’s definitely a degree of gatekeeping on social media. Still, the truth is, once you become accustomed to the tools everyone uses and what value you can extract from them, you’ll start finding your own answers. Don’t feel intimidated or out of your depth. We all started from nowhere at some point, and if you have the curiosity and the drive to learn, then you will almost certainly succeed. Take each of these topics listed as a starting point, become familiar with the core concepts and how they work, and take it step by step. I am optimistic you will become comfortable and able to do your own research and report your own findings in no time.

You may also find certain areas or niches that you enjoy more than others. Embrace that! If you have a particular knack or ability for any facet of this burgeoning industry, then you’ll find a demand for it. And as discussed in this book, if you have specific skillsets, you can complement a wider team, and your colleagues will compliment you. So go forth, be curious, and enjoy the learning process!

Online Resources

Please note links with < > in the URL (e.g., <DOMAIN>) require the domain in question to be added to the search. The list in this book is curated for CTI-specific research and is correct at the time of writing. But as stated earlier in the chapter, please check the Resources page on my blog for the full and most up-to-date version. The online version contains more resources and a broader range of subject areas for all manner of OSINT research and investigation, including downloadable tools and other search resources. Happy hunting!

Domains

IP Addresses

File Hashes and Documents

Web Technologies

Email Addresses and Data Breaches

Usernames

Cryptocurrency

Paste Sites

N.B. It’s worth searching the following via search engines using the command site, followed by the paste site and then your search term, for example:
site:pastebin.com "Data Breach".

Social Media

Facebook

Twitter

Instagram

Other Social Media and Messenger Apps

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.219.22.169