Cyber threat intelligence is unquestionably a hot buzzword in the security industry these days. It is being used to seek venture capital and fund startups. It is being pitched to the enterprise market by providers and consultants. However, in this paper, we argue that the majority of what is being billed as “threat intelligence” isn’t. It’s data. From lists of bad IPs or application vulnerabilities to malware signatures, social media data or indicators of compromise (“IOCs”), none of these things are “intelligence.” They’re data.
In this white paper, we define the difference between intelligence and data, and then illustrate the theoretical discussion in a concise case study in the tangible terms of a real-world practitioner and an actual event.
What are your thoughts on this issue? Show in the comments below
Comments