I’ve been thinking about Threat Intelligence (TI) and Threat Intel Platforms (TIP) lately. What makes a platform useful? What role should Threat Intel play? Does TI even matter? Just so we’re on the same page, Threat Intel is not just Indicators of Compromise (IOC). It includes IOCs, but it’s also the knowledge, context and evaluation of those elements that inform decisions and action. Continue reading →
Just to clarify, this post is about APT and I’m not trying to sell you something.
Advanced Persistent Threat (APT) is the all the buzz these days. It’s become an all-encompassing term to describe just about any covert intrusion in the news. Guess what? APT is espionage. It’s not spammers, it’s not opportunistic hackers, it’s not criminals trying to get credit card information. Wikipedia has a good entry: http://en.wikipedia.org/wiki/Advanced_Persistent_Threat Continue reading →