Collecting, analyzing, and leveraging threat intelligence at NTT-CERT

Abstract

The use of threat intelligence is progressing in corporate-based security frameworks typified by computer security incident response teams (CSIRTs) in order to defend networks and systems against increasingly sophisticated cyberattacks. It is becoming necessary to obtain a deeper understanding of threat intelligence and to deal with more advanced forms of such information. This article presents an analysis of attacker motivation using threat intelligence. The usefulness of threat intelligence in actual on-site CSIRT activities is also explained.