The PITA principles of Threat Intelligence
The PITA principles of Threat Intelligence. Over the years I’ve come to realize that there are some foundational aspects to intelligence work, that if not given due attention, will cause your intelligence program to fall short of your objectives. Often, technology is seen as a “quick fix” panacea to circumvent these principles of intelligence, but the end result is almost always the same — lots of new, overlapping technology and the continuing struggle to show value. Although difficult, uncomfortable, and often seen as “overhead”, these four principles must be addressed to have a successful program:
Process: You have to have an established process for identifying your intelligence stakeholders, documenting what they need from you, delivering said product or service, and learning from your misdates. Figure out your process first then leverage your technology for automation and optimization.
Introspection: Your “maturity” as an intelligence program is not based on budget or headcount, but the self-awareness and willingness to identify your weaknesses and push to improve. Too many teams are afraid to show that they have room for improvement, which is a guarantee that they never will.
Transparency: Intelligence teams that hide behind the “Secret” curtain are usually trying to hide something. Your stakeholders should know what you’re doing and where you are in the process. That’s just good customer service. Yes, protect your sources and methods if necessary, but your process of intelligence should be clear to your stakeholders.
Accountability: Did you do what you said you were going to do? This isn’t just an intelligence thing, or even an information security thing, this is just good business. Your metrics should highlight your successes and reveal where you fell short. Intelligence gaps — whether from sources or process, should not be an embarrassment but a direction for improvement.
So there you have it, the PITA principles for an effective threat intelligence program. Yes, they’re totally a pain in the ***, but you have to address them to be successful.
Visit D3 Intelligence at https://d3intel.solutions, follow us on LinkedIn, or email us at info@d3intel.solutions for more information.
