Threat Intelligence: Intelligence Requirement
Intelligence requirement (IR) is an important component of threat intelligence.
Threat intelligence plays an important role in infosec, and one of its key components is intelligence requirement (IR) which I will cover in this article. For some of us, IR may seem difficult to get into at first like with many things when they are new. But there is no need to fret, as I will provide simple tips with a list of questions you can ask yourself to make doing IR much easier.
Intelligence Requirement
Intelligence requirement is defined as any subject, general or specific, that is needed for the collection of information or intelligence. In a work environment, it can be any information that is important for your business in order to understand its possible threats, threat actors, threat landscape, and more.
The first and main problem in this matter arises from the fact that many people don't know what information they want until it's needed. To prevent this, there is a solution that helps with decision making along the way - asking the right questions.
IR Questions to Ask
There are never perfect solutions, but these are roughly the questions you should ask yourself when doing IR for anyone or for any reason.
1. What's the main objective my company is concerned with?
2. What threat actors could be interested in the field that my company operates in?
3. Are there any known threat actors that target the industry my company operates in? (Threat actors that aren't any specific group or APT, but rather threat actors with the same background and motivation, whether it's individuals or groups.)
4. Has my company been a victim of a threat actor before? If yes, what was the background and motivation for them?
5. What assets does my company have to protect?
These questions are supposed to be starting points, but you may want to adjust them depending on your situation, and who or what you're trying to provide
threat intelligence for.
Summary
Intelligence requirement (IR) is an important component of threat intelligence that helps with the collection of information. One of the biggest issues people have when doing IR is not knowing what information to look out for until it's needed. Having a list of the proper questions to ask are a great starting point to know what gaps to fill for when performing intelligence requirement. Although it is not the cure all solution, it certainly comes in handy and makes doing IR an easier process.
