EC-Council Certified Threat Intelligence Analyst v1

Learning Objectives for CSA v1 Training Course

This Certified Threat Intelligence Analyst training and certification aim to explain expertly:

• Primary issues threatening the information security world
• Role of threat intelligence
• Implementing threat intelligence in risk management, incident response, and SIEM
• Cyber threats and threat factors
• Objectives of diverse cybersecurity attacks
• Basics of threat intelligence including types, capabilities, strategy, lifecycle, maturity model, and frameworks
• Implementing the cyber kill chain methodology
• Advanced Persistent Threat (APT) lifecycle
• Tactics, Techniques, and Procedures (TTPs)
• Indicators of Compromise (IoCs) and the pyramid of pain
• Steps to Planning a threat intelligence program including taking requirements, planning, directing, and review
• Types of data feeds and methods to collect data
• Threat intelligence data collection by using Cyber Counterintelligence (CCI), Open Source Intelligence (OSINT), Human Intelligence (HUMINT), and Indicators of Compromise (IOS)
• Bulk data collection, data structuring, processing, normalizing, sampling, storing, and creating visualizations
• Types of data analysis techniques such as Statistical Data Analysis, Analysis Structured Analysis of Competing Hypotheses (SACH), and of Competing Hypotheses (ACH)
• Threat analysis process including threat modeling, evaluation, fine-tuning, creating a knowledge base and runbook
• Threat intelligence dissemination, dissemination preferences
• Intelligence collaboration and Malware analysis
• Types of TI exchange and threat intelligence sharing formats
• Tools for threat intelligence, threat modeling, data analysis
• Disseminating threat intelligence and sharing protocols, dissemination preferences, sharing rules and models, intelligence collaboration
• TI exchange architecture and types, sharing relationships
• Threat intelligence standards and formats for sharing
• Threat intelligence reporting
• Platforms and regulations to share operational, strategic, tactical, and technical intelligence

Certified Threat Intelligence Analyst (C|TIA) is a training and credentialing program designed and developed in collaboration with cybersecurity and threat intelligence experts across the globe to help organizations identify and mitigate business risks by converting unknown internal and external threats into known threats. It is a comprehensive specialist-level program that teaches a structured approach for building effective threat intelligence.

The program was based on a rigorous Job Task Analysis (JTA) of the job roles involved in the field of threat intelligence. This program differentiates threat intelligence professionals from other information security professionals. It is a highly interactive, comprehensive, standards-based, intensive 3-day training program that teaches information security professionals to build professional threat intelligence.

More than 40 percent of class time is dedicated to the learning of practical skills, and this is achieved through EC-Council labs. Theory to practice ratio for C|TIA program is 60:40, providing students with a hands-on experience of the latest threat intelligence tools, techniques, methodologies, frameworks, scripts, etc. C|TIA comes integrated with labs to emphasize the learning objectives.

The C|TIA lab environment consists of the latest operating systems including Windows 10 and Kali Linux for planning, collecting, analyzing, evaluating, and disseminating threat intelligence.

This course covers:

1. Introduction to Threat Intelligence

• Understanding Intelligence
• Understanding Cyber Threat Intelligence
• Overview of Threat Intelligence Lifecycle and Frameworks

2. Cyber Threats and Kill Chain Methodology

• Understanding Cyber Threats
• Understanding Advanced Persistent Threats (APTs)
• Understanding Cyber Kill Chain
• Understanding Indicators of Compromise (IoCs)

3. Requirements, Planning, Direction and Review

• Understanding Organization's Current Threat Landscape
• Understanding Requirements Analysis
• Planning Threat Intelligence Program
• Establishing Management Support
• Building a Threat Intelligence Team
• Overview of Threat Intelligence Sharing
• Reviewing threat Intelligence Program

4. Data Collection and Processing

• Overview of Threat Intelligence Data Collection
• Overview of Threat Intelligence Collection Management
• Overview of Threat Intelligence Feeds and Sources
• Understanding Threat Intelligence Data Collection and Acquisition
• Understanding Bulk Data Collection
• Understanding Data Processing and Exploitation

5. Data Analysis

• Overview of Data Analysis
• Understanding Data Analysis Techniques
• Overview of Threat Analysis
• Understanding Threat Analysis Process
• Overview of Fine-Tuning Threat Analysis
• Understanding Threat Intelligence Evaluation
• Creating Runbooks and Knowledge Base
• Overview of Threat Intelligence Tools

6. Intelligence Reporting and Dissemination

• Overview of Threat Intelligence Reports
• Introduction to Dissemination
• Participating in Sharing relationships
• Overview of Sharing Threat Intelligence
• Overview of Delivery Mechanisms
• Understanding Threat Intelligence Sharing Platforms
• Overview of Intelligence Sharing Acts and Regulations
• Overview of Threat Intelligence Integration