Threat Intelligence Fundamentals bibliography

Standards-body + government · 3

1. Cybersecurity and Infrastructure Security Agency (2024). Automated Indicator Sharing (AIS). CISA. https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/automated-indicator-sharing-ais
2. SANS Institute (2024). GIAC Certified Cyber Threat Intelligence (GCTI) Certification. GIAC. https://www.giac.org/certifications/cyber-threat-intelligence-gcti/
3. Strom, B. E., Applebaum, A., Miller, D. P., Nickels, K. C., Pennington, A. G., & Thomas, C. B. (2018). MITRE ATT&CK: Design and Philosophy. MITRE Corporation, Technical Report MP180360. https://attack.mitre.org/docs/ATTACK_Design_and_Philosophy_March_2020.pdf

Books + monographs · 2

1. Heuer, R. J., Jr., & Pherson, R. H. (2014). Structured Analytic Techniques for Intelligence Analysis (2nd ed.). CQ Press, Washington DC.
2. Pherson, K. H., & Pherson, R. H. (2020). Critical Thinking for Strategic Intelligence (3rd ed.). CQ Press, Washington DC.

Other primary sources · 11

1. Bianco, D. (2014). The Pyramid of Pain. Enterprise Detection and Response (Bianco's Personal Blog, widely cited in CTI tradecraft). https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
2. Caltagirone, S., Pendergast, A., & Betz, C. (2013). The Diamond Model of Intrusion Analysis. Center for Cyber Intelligence Analysis and Threat Research, Technical Report ADA586960. https://apps.dtic.mil/sti/pdfs/ADA586960.pdf
3. OASIS Cyber Threat Intelligence Technical Committee (2021). STIX Version 2.1 Specification. OASIS Open. https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html
4. OASIS Cyber Threat Intelligence Technical Committee (2021). TAXII Version 2.1 Specification. OASIS Open. https://docs.oasis-open.org/cti/taxii/v2.1/taxii-v2.1.html
5. FIRST.org (2022). Traffic Light Protocol (TLP) Version 2.0. Forum of Incident Response and Security Teams. https://www.first.org/tlp/
6. Heuer, R. J., Jr. (1999). Psychology of Intelligence Analysis. Center for the Study of Intelligence, Central Intelligence Agency. https://www.cia.gov/static/9a5f1162fd0932c29bfed1c030edf4ae/Pyschology-of-Intelligence-Analysis.pdfCited in 2 modules
7. Hutchins, E. M., Cloppert, M. J., & Amin, R. M. (2011). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Proceedings of the 6th Annual International Conference on Information Warfare and Security. https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf
8. Office of the Director of National Intelligence (2015). Intelligence Community Directive 203: Analytic Standards. ODNI. https://www.dni.gov/files/documents/ICD/ICD%20203%20Analytic%20Standards.pdfCited in 3 modules
9. Office of the Director of National Intelligence (2017). Background to Assessing Russian Activities and Intentions in Recent US Elections: The Analytic Process and Cyber Incident Attribution. ODNI. https://www.dni.gov/files/documents/ICA_2017_01.pdf
10. ISC2 (2024). Cybersecurity Workforce Study 2024. International Information System Security Certification Consortium. https://www.isc2.org/research
11. U.S. Bureau of Labor Statistics (2024). Occupational Employment and Wage Statistics, May 2024: 15-1212 Information Security Analysts. U.S. Department of Labor. https://www.bls.gov/oes/current/oes151212.htm