Argument-Driven Inquiry for Cyber Threat Intelligence

In this article, we'll explore how argument-driven inquiry can be applied to cyber threat intelligence, how argument-driven inquiry aligns to the intelligence cycle, a step by step implementation, and highlight some of the benefits of integrating argument-driven inquiry into cyber threat intelligence. 

When argument-driven inquiry is applied to the field of Cyber Threat Intelligence, these 7 steps align with the Intelligence Lifecycle. The Intelligence Lifecycle is a framework that is widely used in the intelligence community, and it consists of six stages: Planning and Direction, Collection, Processing and Exploitation, Analysis and Production, Dissemination, and Feedback. By aligning the steps of ADI with the Intelligence Lifecycle, cybersecurity professionals can take a more structured and efficient approach to intelligence gathering and analysis.

In the first stage of the Intelligence Lifecycle, Planning and Direction, the focus is on identifying intelligence requirements and prioritizing them based on the level of threat they pose to the organization. This stage aligns with the first step of ADI, which is to identify a problem. By identifying potential threats and vulnerabilities, cybersecurity professionals can prioritize their efforts and focus on those areas that pose the greatest risk.

The second stage of the Intelligence Lifecycle, Collection, involves gathering information from a variety of sources, including internal data sources and external intelligence sources. This stage aligns with the fourth step of ADI, which is to collect data. By gathering information from a variety of sources, cybersecurity professionals can gain a more comprehensive understanding of potential threats and vulnerabilities.

The third stage of the Intelligence Lifecycle, Processing and Exploitation, involves organizing and analyzing the collected data to identify patterns and connections. This stage aligns with the fifth step of ADI, which is to analyze the data. By analyzing the data, cybersecurity professionals can identify potential threats and vulnerabilities and develop strategies to mitigate them.

The fourth stage of the Intelligence Lifecycle, Analysis and Production, involves synthesizing the processed data and generating intelligence products that can be used to inform decision-making. This stage aligns with the sixth step of ADI, which is to refine the hypothesis. By refining the hypothesis based on the results of the data analysis, cybersecurity professionals can develop more effective strategies to mitigate potential threats and vulnerabilities.

The fifth stage of the Intelligence Lifecycle, Dissemination, involves sharing the intelligence products with decision-makers and stakeholders. This stage aligns with the seventh step of ADI, which is to draw conclusions. By drawing conclusions based on the results of the data analysis and disseminating the intelligence products, cybersecurity professionals can inform decision-making and help mitigate potential threats and vulnerabilities.

The final stage of the Intelligence Lifecycle, Feedback, involves reviewing the effectiveness of the intelligence products and the decision-making process to identify areas for improvement. This stage aligns with the entire ADI process, as each step can inform the next and contribute to a more effective and efficient intelligence gathering and analysis process.

By aligning the steps of ADI with the Intelligence Lifecycle, cybersecurity professionals can take a more structured and systematic approach to Cyber Threat Intelligence. This can lead to a more comprehensive and effective understanding of potential threats and vulnerabilities, and ultimately help organizations better protect themselves against cyber attacks.

Here's a step-by-step plan for cyber threat intelligence analysts to implement the 7 steps of argument-driven inquiry in the context of cybersecurity:

1. Identify a problem: Begin by identifying a specific cybersecurity problem or question that needs to be addressed. For example, "What is the likelihood of a ransomware attack against our organization in the next six months?"
2. Develop a question: Once the problem has been identified, develop a specific and answerable question that can be addressed through the process of argumentation. For example, "What factors contribute to the likelihood of a ransomware attack against our organization in the next six months?"
3. Develop a hypothesis: Based on available evidence, develop a testable hypothesis that can be used to answer the question. For example, "The likelihood of a ransomware attack against our organization in the next six months is higher if we do not have adequate backup and recovery systems in place."
4. Collect data: Collect data from a variety of sources, including internal data from the organization's cybersecurity systems, external data from threat intelligence sources, and data from academic research. For example, collect data on the number and types of ransomware attacks targeting organizations similar to yours, as well as data on the effectiveness of backup and recovery systems in preventing or mitigating ransomware attacks.
5. Analyze the data: Analyze the data to determine whether the hypothesis is supported or refuted. This analysis should be rigorous and take into account any limitations of the data. For example, conduct statistical analyses to determine whether organizations without adequate backup and recovery systems are more likely to experience ransomware attacks.
6. Refine the hypothesis: Based on the results of the data analysis, refine the hypothesis if necessary. This may involve revising the hypothesis, developing new hypotheses, or developing new strategies to mitigate the threat. For example, refine the hypothesis to account for other factors that may contribute to the likelihood of a ransomware attack, such as employee training and awareness.
7. Draw conclusions: Based on the results of the data analysis, draw conclusions and develop recommendations for cybersecurity strategy and defense tactics, or develop new policies and procedures to address the identified threat or vulnerability. For example, recommend implementing more robust backup and recovery systems and increasing employee training and awareness around ransomware threats.

By following these steps, cyber threat intelligence analysts can use the principles of argument-driven inquiry to develop evidence-based cybersecurity strategies that are supported by rigorous data analysis and testing.

Implementing the 7 steps of argument-driven inquiry can provide several benefits to cyber threat intelligence analysts and their organizations, including:

• Improved decision-making: The ADI process can help analysts to make more informed and evidence-based decisions about how to address specific cyber threats or vulnerabilities.
• Increased efficiency: By using a structured approach to problem-solving, the ADI process can help organizations to identify and address cybersecurity issues more efficiently and effectively.
• Better use of data: The ADI process requires analysts to collect and analyze data from a variety of sources, which can help organizations to better understand the nature and scope of cybersecurity threats.
• Enhanced collaboration: By involving multiple stakeholders in the ADI process, including technical and non-technical personnel, organizations can encourage collaboration and knowledge sharing to better address cybersecurity threats.
• Improved communication: The ADI process provides a common language and framework for discussing cybersecurity issues, which can help analysts to communicate more clearly and effectively with both technical and non-technical stakeholders.

Overall, the benefits of implementing the ADI process can help organizations to better understand and address cybersecurity threats, and to make more informed decisions about cybersecurity strategy and defense tactics.