Teaching the intelligence bits of CTI

When considered as an intelligence discipline, Cyber Threat Intelligence (CTI) is still relatively young. Its practitioners come from a broad range of backgrounds, but common pathways into CTI include moving from other cyber and information security roles or coming across from other intelligence disciplines. CTI has now matured to a state where it is its own intelligence and cyber discipline with sub specialisations. Despite this, finding training pathways to develop cyber threat intelligence analysts to become domain experts can be a challenge in Australia.

Technical IT and cyber skills are well served by the Australian tertiary education system. However, there isn’t a similar pathway to learn core intelligence analysis skills outside of the military and intelligence agencies. Tertiary degrees in intelligence focus more on an academic understanding of intelligence rather than the practical skills essential for its application. While a technical foundation is necessary for any individual aspiring to become a CTI analyst, developing fundamental intelligence skills is also essential. This is particularly challenging given the range of activities CTI analysts are asked to undertake: everything from strategic assessments through to highly technical analysis.

This session aims to identify the core skills of highest value for intelligence analysts of all disciplines and to demonstrate how they can be applied to a CTI context. It draws on the two decades of experience of the presenter across intelligence training, signals intelligence, geospatial intelligence, criminal intelligence, insider threat, and cyber threat intelligence, to tease out the themes and challenges that analysts have expressed when progressing through their careers. The focus is on those skills common across all disciplines: collection management, stakeholder engagement and requirements gathering, assessing the quality of information, analytic technique, report writing and presentation skills, problem deconstruction, and measuring success in intelligence through feedback and metrics. It then outlines current pathways for learning within CTI teams and offers suggestions for future opportunities across industry.