Welcome to Sasha's Threat Management, Intelligence, and Hunting Wiki!

Welcome to the definitive resource on threat management, curated by yours truly. Within these digital corridors, you’ll find a comprehensive compendium of insights, strategies, and methodologies dedicated to the intricate landscape of threat management.

The field of threat management is significantly more complex that I believe the community realizes. If the goal is to proactively protect against threats before they happen, or at least mitigate damage occurring by catching the threat quickly, this requires a broad range of supporting activities in order to make this happen.

In my journeys, I have found many organization are trying to make this migration from reactive to proactive, and the from initial basic to more sophisticated capabilities in this area. Unfortunately there are many so-called experts out there who really do not understand the fundaments and are implementing programs that really do not address the root needs of the organization. As such, in my spare time I am writing this “Threat Management Guidebook”, which at one point I hope to publish. Until then, stay tuned as I add new material. I figure this will take a full year to write everything I wish to include, at which point, the threat landscape and technologies will have changed, and I will have to start again. Thank goodness this field has job safety to it, given Crime is as old as humanity itself.

Take care, & stay tuned!

Sasha, April 2024

---

These pages are still a work in progress; please stay tuned!

1. Introduction to Cyber Threat Management, Intelligence, and Hunting

   1.1 Overview of cyber threats
   1.2 Importance of managing cyber threats
   1.3 Historical context and evolution of cyber threats
   

2. Cyber Threat Landscape

   2.1 Types of cyber threats (e.g., malware, phishing)
   

   - Malware
   - DDOS
   - Digital Extortion
   - Phishing
   - Unauthorized Access
   
   2.2 Analysis of threat actors (e.g., nation-states, hacktivists, cybercriminals)
   2.3 Emergent Threats
   

3. Cyber Threat Management

   3.1 Overview of Threat Management
   

   - Importance of Threat Management Governance
   - Relationship and positioning within an overall Risk Management Approach
   - Importance of Collaborative Team Approaches
   
   3.2 Capability Maturity
   3.3 Threat Governance Framework
   
   - Establishing a Threat Governance Structure
   - Roles and Responsibilities
   - Policies and Procedures needed to support the program
   - Compliance and Regulatory Considerations
   
   3.4 Key Metrics Driving Program Success
   
   3.4.1 Overall Program Metrics
   3.4.2 Threat Intelligence Metrics
   
   - Detection Rate of Known Threats
   - False Positive and False Negative Rates
   - Threat Intelligence Utilization Metric
   
   3.4.3 Threat Detection Metrics
   
   - Detection Rate of Known Threats
   - False Positive and False Negative Rates
   - Threat Intelligence Feeds Detection Metrics
   

4. Cyber Threat Intelligence (CTI)

   4.1 Definition and importance of CTI
   

   - Integration of Threat Intelligence into Detection
   - Correlation of Threat Intelligence with Incident Data
   
   4.2 Types of CTI (e.g., strategic, operational, tactical)
   4.3 CTI lifecycle (e.g., collection, analysis, dissemination, feedback)
   4.4 Capability Maturity specifically to CTI
   4.5 CTI Products
   
   4.5.1 Threat Trending
   
   4.5.1.1 Long-term Threat Trends Analysis
   4.5.1.2 Identification of Emerging Threat Patterns
   4.5.1.3 Predictive Analytics for Threats
   

5. Threat Hunting

   • Definition and objectives of threat hunting
   • Methodologies and techniques for proactive threat hunting
   • Role of threat hunting in incident response and mitigation OpSec

6. Threat Detection

   • Definition and objectives of threat hunting
   • Methodologies and techniques for proactive threat hunting
   • Role of threat hunting in incident response and mitigation

7. Proactive Threat Defense

   7.1 Anti* Programs (Malware, DDOS, Phish) 7.2 Honey*
   7.2 Security Awareness Training
   

   - Employee Training Programs
   - Phishing Awareness
   - Best Practices for End Users
   
   7.3 Automated Defense
   

8. Threat Intelligence Platforms (TIPs)

   • Overview of TIPs and their functionalities
   • Selection criteria for TIPs
   • Case studies highlighting effective use of TIPs

9. Threat Analysis Tools and Technologies

   • Overview of tools for threat management, intelligence, and hunting
   • Categories of tools (e.g., SIEM, IDS/IPS, endpoint detection and response)
   • Comparison of popular tools and their features

10. Best Practices

    • Recommendations for effective cyber threat management
    • Strategies for optimizing threat intelligence programs
    • Tips for successful threat hunting operations

11. Ethical and Legal Considerations

    • Ethical principles in cyber threat management and intelligence
    • Compliance with regulations and laws (e.g., GDPR, HIPAA, CCPA)
    • Privacy implications and data protection measures

Glossary

- Definitions of key terms and acronyms used throughout the wiki

---

To come in 2025!

12. Case Studies

    • Real-world examples of successful cyber threat management, intelligence, and hunting initiatives
    • Lessons learned and key takeaways from each case study

13. Future Trends and Challenges

    • Predictions for the future of cyber threats
    • Emerging technologies and their impact on threat management
    • Challenges and opportunities in the evolving threat landscape