SSCP Systems Security Certified PractitionerRisk Identification, Monitoring, and AnalysisMedium
A security analyst is investigating a series of failed login attempts against a critical server. The attempts originate from various IP addresses globally, occur over a short period, and target common usernames like 'admin' and 'root'. This activity aligns with known TTPs (Tactics, Techniques, and Procedures) of a specific threat group known for credential stuffing. What type of threat intelligence would be most valuable for the analyst to assess the immediate danger and potential impact?
- AOperational threat intelligence
- BStrategic threat intelligence
- CTactical threat intelligence
- DTechnical threat intelligence
Show answer & explanationAnswer & explanation
Correct answer: D. Technical threat intelligence
Technical threat intelligence focuses on specific, actionable indicators such as IP addresses, malicious domains, file hashes, and specific attack patterns. For an analyst investigating immediate failed login attempts from various IPs and common usernames, this type of intelligence (e.g., block lists for known malicious IPs, common credential stuffing patterns) would be most directly valuable to assess immediate danger and inform defensive actions.
Why the other options are wrong
- A. Operational intelligence describes threat actor motivations and campaigns, providing context but not the granular, immediate indicators required for this scenario.
- B. Strategic intelligence is high-level, long-term, and does not provide immediate actionable details for an ongoing incident.
- C. Tactical intelligence provides information on TTPs, which is relevant, but 'technical' intelligence provides the specific, actionable indicators (IPs, hashes) needed for immediate response.
Technical Threat Intelligence
Actionable, low-level indicators of compromise (IoCs) that can be directly applied to security controls for detection and prevention.
- Includes IP addresses, domains, file hashes, URLs, registry keys.
- Shortest shelf life, highly specific.
- Used by security devices and analysts for immediate detection and blocking.
Memory trick: Strategic for leaders, Operational for campaigns, Tactical for TTPs, Technical for IoCs.