Streamline and optimize your deal cycle for Operations with airSlate SignNow

How to create outlook signature

or as we wrap well we're not wrapping up the day yet but as we get closer because i think it's going to call back to a lot of different things that we've heard in previous talks in track 2 today for others that were in here one of the things that i particularly like this is in the advisory board and the chairs when we do a review of all the submissions we do a blind review and we get pretty far into it before we get to see who the submissions are from but whenever you see a submission and it's from you know an enterprise that's doing kind of use case stuff everyone's like instantly excited so uh really really excited and pleased that team can come and talk so john bob if you guys want to take it away great thanks rick um my name is bob mclean i lead the cyber threat intelligence team at and i'm joined today by john gerardo uh john is a cyber threat landscape analyst on our cti team and he's also a key architect of our uh custom internal built uh intel platform that we're going to call atlas for the purpose of this presentation um so today we're going to talk about uh challenges facing a cti program uh in a large corporate environment and how those challenges are exacerbated if it's not grounded in a mature uh intelligence requirements uh program from a collection cell and then what we're gonna do is dive into uh some of the ways that you can take intelligence requirements from the ground up and build it into a really uh mature uh process for both your intel program and your entire enterprise and then what we're gonna do is talk about how that drives operations how it drives in intel driven operations and how that feeds into uh the need to disseminate your information in a in a platform that can reach your customers expand your base um john is gonna talk about our atlas platform uh some of the creative solutions that we've come up with there to make it an interactive platform as well as a product repository and then serve as a force multiplier and this is really key as well as we disseminate information track requirements addressed through atlas uh we're also able to collect metrics there both from a production standpoint but from a uh threat tracking standpoint so that gives us and our stakeholders throughout the business a lot of visibility not only from the um the narrative agenda of our of our products but also the empirical data so key takeaways from today's briefing is intelligence requirements can work in a large corporate environment if we apply lessons learned and best practices from both the public and private sector and that's what we've been doing at second with those intelligence requirements you're gonna help uh you're gonna help your customers fully uh identify their information needs their gaps and also help them drive operations via intelligence that you're supplying them we need to have a way to get that information out to our customers we need to do that in an efficient manner there's many challenges to doing that in a large enterprise so we're going to dive deeply into our custom-built uh solution and uh explain how you can make that work in your own environment if you don't have something like that and then finally we encourage you to reach out to us after the presentation whether you've explored uh building your own internal intel uh platform or whether uh it's something uh you you haven't really thought about yet until today we can help you uh provide ideas what works what the challenges are and we love to have those conversations uh so with that john let's go ahead and get started so beginning with challenges of intelligence in the private sector um a cti team in a large corporate environment such as is dealing with global threats right we deal with threats from all over the globe with uh threat actors from various levels of sophistication resources various motivations um and there there's no limitation uh whether it's regional or uh or uh motivational of what sort of adversary uh may seek to target financial institutions in the united states as such we have a broad scope for uh for evaluating the cyber threat landscape this requires what we call all source intelligence in the private sector so we classify those into five main categories the first three we consider closed source so that's your intelligence vendors uh it's your information sharing communities and uh it's your internal information and data those all have to be key parts of the of your collection then there's the open source the security company free reporting the media reports um that all has to feed into your collection and then finally there's the hybrid of government reporting which which can be either closed source or fully open source so this all leads to extensive collection processing analysis production and disseminates and dissemination but how are you going to disseminate it and who are your customers so john if we go to the next slide the other the other challenge we have in a large corporate environment is the customer base you're dealing with a very large and diverse customer base this may be your cyber leadership team or maybe your cyber operators who may be interested in very different information or information at very different levels right uh you have your lines of business you have your board of directors you have perhaps enterprise teams um who are working to defend uh the business um in different in different manners or develop applications um so you've got a broad set of customers you've got a broad threat you have to cover there there are other obstacles as well um most of your customers do not have a background in the intelligence community most your customers do not have a background in cyber threat analysis um many of your customers may struggle to identify what their information needs are how intelligence can help them and how they can take intelligence and make it actionable finally your customers may want that information in various different formats um long paper short papers briefings uh whatever it may be um so if you're a cti program that's adapting to a broad audience and a broad threat you need to have a plan so let's go to the next slide john you have to establish yourself and cti's role within the enterprise um to do that you got to set the agenda so a immature cti team can be reactionary reactionary is where you are driven by external events um or by internal requests for information from various stakeholders as an alternative um we recommend the the uh approach of being deliberate strategic and that means proactive proactive by having established intelligence requirements and being initiative driven we're not going to talk about all of our initiatives today um but we are going to talk a lot about our intel requirements and uh one of our key initiatives which has been our intel platform so intel requirements um intel requirements are critical for the purpose of that they enable you to scope your collections and scope your production to the information needs of your business to do that you have to identify what your mission is um who your customers are who are your potential customers those are the first key questions that you have to ask to know where you need to take your intel requirements um then you've got to take a look at developing your intel requirements from various phases and we're going to get into those specific phases as we go through the next few slides here um but the other key part of building out your role in the enterprise is building your platform um you need to be able to serve your customers you need to be able to establish your brand and you need to be able to expand your customer base and building that platform such as we have with the atlas at is going to help you establish that brand establish your role in the enterprise and most critically established trust of your customers and establish a way to drive again drive operations through intelligence next slide so let's dive into intelligence requirements what you can expect when getting started are four key challenges here and uh the first is limited resources most teams do not necessarily have uh dedicated collection managers getting intel requirements right requires resources it takes time it takes personnel not a lot of personnel but you need some dedicated personnel who are collections managers who can put in the time engaging with customers to get this right um why do we need to engage customers we need to engage them because you will inevitably inevitably face questions on relevancy your customers may not know that that they are your customers or that they are potential customers um they may lack experience with intel requirements you will certainly come across uh teams full of people who have no experience with intelligence requirements and if they don't have that experience they don't they may not understand the relevancy they may not provide the feedback we need to identify their information needs and to contribute to the intelligence requirements this then creates another problem you may if you don't have uh full contributions from your uh customers you're gonna get inconsistent contributions and what that's gonna lead to is distortions within your intelligence requirements list those distortions will will focus heavily on those customers who engage you who provide that feedback and then that is going to alter the way that you operate as a program if you don't understand that and work with the customers and i'm going to use the term a couple times here throughout the brief but hand hold those customers who don't necessarily understand the process who have trouble understanding what their information needs are and how to articulate them um that's that's not a criticism of those customers it's it's just a fact because again we are the intelligence professionals we need to help our customers understand how to articulate that so that we can go out and collect against that information and report on it finally avoid creating problems for yourself by um by developing uh opportunities for collections gaps when you review them down the road and what i mean by that is that if you're just kicking off a uh your intelligence requirements process and you're just building out a a collections function you you want to make sure you're constantly providing feedback to those you're engaging with because if you are so eager for that feedback that you accept uh intel requirement nominations without um looking at those critically and helping the customers understand what is realistic from a collections perspective what will really provide value to those teams you'll find yourself reviewing your performance against the intel requirements six months later a month later whenever it may be and see that you have many gaps because some of your intel requirements were not realistic or they may not really add any sort of value because it's not the sort of information that's appropriate for an intelligence requirement next slide so some required actions for success um start by building out an intelligence requirements baseline um what i mean by this is if you're on a cti team or you're responsible for developing intelligence requirements in your environment there's a reason you have some sort of knowledge of the cyber threat landscape you work with others on your team in cti or others in intel who have knowledge of the cyber threat landscape start by building a foundation of what you see as requirements for the program based on your knowledge of the of the threat landscape do not stop there of course we need to get the inputs from all of our stakeholders otherwise we risk not only not reflecting the information needs of our customers but we we risk accentuating our built-in assumptions our built-in biases and therefore we collect against those threats that we think are the greatest problem but then when we talk to the business we realize we've left ourselves with clear gaps so build the baseline the baseline will get you started and it'll also serve in as example when you go out and engage your customers to show um a little bit of structure and also um actual intel requirements what they look like and how we can add to the picture next you need to identify your customers this is a key part but once you do identify them you've got to promote this process you've got to explain why it matters and schedule meetings with all of your stakeholders and the tip here is know your audience you might have to explain it a little bit differently to different audiences what it means for them so make sure you reach out make sure you put in the work to explain the process we at have developed a uh internal training program that's available enterprise wide and is required throughout parts of the business um so that our customers are coming into these meetings even if they um have experience or don't have experience going through this bi-annual review process with us that they'll at least have a baseline of understanding what it's about um so you schedule your meetings you hold your meetings with various teams of stakeholders throughout the business again i'll use the term handhold make sure you hand hold where necessary don't just accept um we don't really have any information requirements uh we can't think of any help them do it that's that's what that's what we have to put a lot of effort into is helping our customers understand what those needs are and how we can formulate them into intel requirements that we can then collect on um once this process is done you're going to be refining your standing intelligence requirements the language that has been submitted by your customers providing them subject suggested language back and uh finalizing that language at we use standing intel requirements and then about 25 of those are priority intelligence requirements um priority intelligence requirements um also go under our review process twice a year um and the way we develop those are based on um either customer nominations specifically to be a priority intelligence requirement um or where there's commonality between a lot of customers uh in a specific standing intelligence requirements once you finalize those lists um you finalize your production requirements production requirements are based on a linked series of intel requirements that address a production need at that point you've completed the process you're going to disseminate it to your customers we disseminated in two ways we disseminate it out via email but we also hang it on our atlas platform where it stays and our customers can see it at any point um and can see performance addressing those requirements um and you've got to operationalize them once you've disseminated it then comes the collection um collection can come in various formats it can come in automated collection uh that you set up manual collection or task collection uh during this process you're gonna you have to document uh when you're addressing those intel requirements diversify your product lines uh as we talked about earlier you have many types of customers and you collect a lot of different types of information some of it is higher level um wider ranging interest is likely throughout the business some of it is very specific to intel requirements that are more at a tactical level we have reports that are designed to address those various audiences so that we can still um put out reporting addressing intel requirements when it's not necessarily something that needs to go out to our wider customer base in a blast distro sir editions remember this is not a static list so at any point throughout the year customers should be able to to submit requests for new intel requirements new standing intel requirements new priority intel requirements or even your intel program itself may come up with new requirements based on evolutions in the cyber threat landscape we've done that where we as a program determine hey look you know we need these nine additional intel requirements based on uh developments in the last couple months here um we're adding them now and you don't need to wait until your bi-annual review or whatever period you choose we've chosen a bi-annual review um because um things don't move that quickly that quarterly is necessary as we talked about um there's a lot of work that goes into the review process but annual seems to be too long in our view we want to make sure that our requirements stay comprehensive and up to date so we go with the bi-annual review process and then as you see on this chart here the process starts over again it's a continuous cycle where you're starting a bi-annual review engaging the customers and going through the whole process again next slide john all right so i want to talk about a few quick points on the stakeholder engagement and uh the amendment process of the intel requirements um as you're meeting with your stakeholders um one of the things that we've developed in is is we do follow the racy model so that's responsible accountable consulted and informed when it comes to our bi-annual review of the intel requirements this ensures that we have a deliberate structure and uh a a line of responsibility that that flows throughout both our intel program and our stakeholders to ensure that it's a repeatable process and that is performed right each time around secondly sirs need to be crafted in a collaborative manner we talked a little bit about this but we need them to accurately reflect the needs of the customers but we also need to make sure that these are actionable right that these are uh intel requirements that that we have um collection assets to address um moving over to the amendment process once we have all that information in a few other points we want to stress here is uh you want to review your performance for the prior six months um so you will not hit all of your intel requirements do not expect to hit 100 of your intel requirements um if you hit 100 of your intel requirements you may not have comprehensive enough coverage um so what we do is we look at where did we not hit why did we not hit it is it stale is it unnecessary or is it somewhere where we need to adjust our collections planning to address those intel requirements in the next six months um and secondly you want to look at your requirements list look at your pirs again work your pirs based on a nomination process from your customers but also looking at the totality of interest from your customers and what intel requirements really resonate throughout the business or across a number of teams that might be able to action it and elevate those to priority intel requirements um and then finally um you can use your intel requirements if your reporting is formulated this way to help evaluate your intelligence sources um so in other words if you're documenting uh which intelligence source contributed to a certain report served as the source for a report that can serve as as one of many different pieces of information to inform evaluations of your sources next slide all right finally i want to talk about how this leads to intel driven operations and then i'm going to turn it over to john um so a efficient um and lean program can be highly productive and impactful if grounded in intelligence requirements and what we want to show here is that um with a with that productive efficient intel program you can drive a lot of uh actionable outputs um based on your uh based on your intel requirements if you look at our actual outputs here those range from day-to-day sort of operations to uh informing your detection and alerting prioritization red team hunt team operations as well as mapping uh your adversaries to things like the mitre attack framework understanding uh what tactics and techniques they use and how well you're defended against those all the way up to internal controls contracts partnerships and acquisitions as well as uh strategic prioritizations for the business itself um and then product outputs to be productive from a production standpoint um you're gonna have to have a lot of products we have a lot of products to address the various um objectives of the program all the way down from uh metrics insights on our atlas platform that john will dive into into tactical reports to reports highlighting emerging threats all the way up to our cyber threat landscape strategic product board memo uh products so intel requirements drive all of that actionable output all that production in a strategic manner a deliberate manner and enables again a relatively small intelligence program to have a large impact when it comes to actionable outputs and products for your customers informing them providing them with the context they need i'm going to turn it over to john now so he can go into our atlas platform and how that enhances those deliverables thanks bob so before i get into uh and bob did a great job in kind of walking through our intel requirements and why they're important for your program right there in the majority of your program and how we collect against our requirements and kind of the cycle so we started off talking about the cycle now we're going to talk about operationalizing those requirements and how can you build towards a platform for your organization or for yourself even if you're just that curious so before we get deep into that let's let's think about the challenges first and and the way i like to think about these challenges that there's really two parts right there is satisfying those those stakeholders or satisfying those requirements rather and that's kind of a dissemination issue and then satisfying the requirement itself and managing those requirements right so we talked about the biannual review we talked about all those things that uh help you develop the requirements now we'll get into how you operationalize them so we'll start with dissemination now when we first start off in in intel especially if you're a newer team most of your intel is driven from the inbox right all your products or the way you disseminate products that address those requirements may come to you your stakeholders or where your readers are via email right and email is is limited because one it's an email right it can get buried under other notifications other alerts other things that are important to that individual but also to it it limits our reach right your your emails are limited to who you can send the actual email to and that might be uh distribution based right so do you have access to reduce distribution list in your organizations that are wide enough to get the right reach and so forth and so on and then how do we get further engagement on those products that we've created and those requirements that address those requirements and a lot of that is relationship built and built into our relationships and if you're really mature program all those relationships are built into the pipeline you create something uh you send down the pipeline the operators and there's someone to pick it up and action it right away and no questions asked but when you're first getting off the ground like you really have to develop those relationships you really have to show the value upfront on what this intel can do for you and that's tough in the inbox right and third there's there's a lot of um it's hard to get to your historical uh products that you've already sent out and already developed right all the products that you've disseminated in the past and that history becomes what history right so minimal access to historical products what it does is create constraints on your analysts because if your stakeholder don't know where to go to find your intelligence they're going to ask you again right they may ask you the same question you just addressed in your product you just sent out yesterday right and that's kind of how it is when you're working through your dissemination challenges now the second part of that is the requirements issue right now you have to actually make it real for your stakeholders you have these requirements you developed it well you know you have this uh these requirements in place how do you track it back to these products right and you really have to think about the traceability right and in the beginning when you're first getting started like a lot of that traceability is very manual it's a manual process and you have to connect those requirements to how you're delivering against those requirements to make it real for those stakeholders who are along this ride with you and that's going to create more awareness for the stakeholder they kind of get it they can give you more feedback if they understand how they're being delivered against right or how these requirements are being delivered against and that lack of clarity uh and is going to lead to more confusion for your stakeholder and bob put it nicely with the with the hand-holding right now you have to re-educate your stakeholder every time right every time you come towards a review you got to re-educate them you kind of got to teach them up how how why are we doing this why is this important why can this help you uh but if they're engaged from the beginning and they have that clarity that that uh it's less opaque to them it's easy for them to kind of get it up front and then metrics are very difficult to derive when you don't have a good system in place to manage your requirements and metrics again is how we we track our performance against these requirements is it not enough to just have a list of requirements you have to address them and then you also have to track how you perform against them right are they valuable to even have them in the first place so that's all part of it so what do we do now we know the challenges how do we innovate through how do we get towards the other side so i'll do this in a couple ways one i want to give something to you and i know we're kind of tough on time but i want to give something to you you can start tomorrow and then we'll talk about what the future would look like and how if you build the systems right you can develop towards something even grander so how do we move from inbox intel intelligence to something that's more interactive more tangible more things make it easier for stakeholders to get around and really what we want to do is centralize and connect that intelligence make it easy for people to see that alignment how do you pivot from the requirement to how you address the requirement is it a product that matches it right how do you get that a clear as day right and once you know the stakeholders are able to understand it alignment it makes it a whole lot easier to understand where the products are being delivered or how much value you're giving them second let's revisit that dissemination strategy or a problem that we talked about let's look back at how we're actually communicating with our stakeholders right do we need to add a little more polish do we need to lean into other channels of dissemination and bob talked a lot about the different products that you may produce and they have different audiences and each one of those products may have this own type of dissemination channel right um let's say it's an executive level right you have your leadership stakeholders so maybe a text message is right that's the product and you send it through a text message and that's the dissemination channel but your operators they need you know quick reports tactical throw some iocs on a piece of paper tell them where the things are and they point right and you can send it right to uh slack they're slack users or maybe you have big beautiful reports that are the history of you know and it's very analytical and it looks back by everything in the trends that we're seeing as or in your organization and we want to put that somewhere hang it up somewhere and so that it's easily accessible on our internal web or you know maybe you have internal tools that you use internal blog sites and so forth you know that's another dissemination strategy so really think creatively think outside the box how can you get more eyes on your intelligence or eyes on your eyes i guess is a good way to put it right and then design more towards interactive systems so i'll i'll get to how do we get interactive and i'm gonna you know peel back a layer here and dive a little deeper so this is a real system and this is kind of dummy data dummy thing that i put together for the purpose of this talk and this could be its own talk by itself on how to really actions but from high level you can create use google sheets use the tools that you have right so let's say your tool is google sheets and i'm using that as an example because it's free so you can go in here and and use your um your your sheets and create kind of different tabs to store your stuff and centralize your products have everything live in one place have your product live in one tab and have multiple tabs to keep your tags in there so that you can reference them to your products right have that alignment and then from there you can have a third tab that will have your dashboard and your metrics and visualizations up there and uh you know just because again time i'm gonna move on to the next part of it but this is a system that you can talk about and address a lot of this in the hallway if you want to learn more so we started there we started uh scrappy right and then we got into a full custom solution right and we built upon that we built on those systems and what we got was codename atlas right and now we're centralizing all this in a portal you're able to access and self-service get your needs met all on a portal and that's just the interactive ui version of what we built in the tools that we you know you may have at home right your google sheets or whatever the whatever case may be and um how do we make our interactive our requirements more interactive right how do you make it easy for for stakeholders to get it we allow them to submit our requirements right we allow them to submit even requests through the portal so now it's always available to them so they can just fire off a request to us and then that also kicks off our workflow automates that for us now we want to make it very intuitive and easy to navigate through all those requirements that we have right so we have it all in one place and you're able to click into that requirement and see some details see the history behind those requirements all in that's in the portal and then our products our products are are we want to get a central home we talked about a product list and a sheet before now this is like a real grand version of it uh it's in one place and you can filter down search against it look at your requirements so if you're a stakeholder and i care about requirement 1.1 you click it and now you have all the products that align to that now you know how we provide value to you easily and then um in the products itself we have real connections right real integrations your requirements the tags they're all there right the feedback is intuitive it looks just like everything else that you you give feedback for so we get that more in real time and then um versions you're able to download the different version types right from the tool right and this is just again iterations on what you can build at home and just having steady working requirements in your previous system events we monitor events in the tool right and we're able to track our events to products that create that address those are uh those events and then requirements that are addressed by those products so you have that traceability all the way from the event that occurred all the way to the product and then how it satisfies that requirement so the stakeholders can really get it and also the visibility and the workflow benefits that come from this and again the slides will be available um and this is the last slide so i'll leave it at this uh if you do it all this way you have better ways to visualize and report efficiently right you have maybe you have a mobile view maybe you have leadership views that can get some insight from very quickly and then you can also tailor to audit and get reporting done more efficiently and of course your production metrics and how you performed so i know that was really rapid fire but thanks again and uh and i hope i i love you with something uh there