CERT PODCAST SERIES: SECURITY FOR BUSINESS LEADERS: SHOW NOTES

Intelligence Preparation for Operational Resilience

Key Message: Security and operational resilience leaders need a way to make sense of the flood of threat and environmental information to understand their cyber situational awareness and make informed decisions.

Executive Summary

Intelligence preparation for Operational Resilience (IPOR) is a structured framework that decision makers can use to:

• identify intelligence needs
• consume the information received by intelligence sources
• make informed decisions about the organization and courses of action

In this podcast, Douglas Gray, a member of the CERT Cyber Risk Management team, discusses how to operationalize intelligence products to build operational resilience of organizational assets and services using IPOR.

PART 1: USING IPOR FOR SITUATIONAL AWARENESS

IPOR enables a cybersecurity manager or operational resilience practitioner to break down all the kinds of information they need in order to build situational awareness about their environment. IPOR explains what intelligence is and how it can assist in moving from collecting information to consuming intelligence for better decision-making. The different kinds of information pertain to the various risk landscapes in which an organization operates such as the:

• Legal and policy environment and regulatory concerns
• Socio-political environment and threat actors
• Technological environment, whether under the direct control of the organization or outsourced
• Business climate, consumer and stakeholder confidence, and reputation
• Physical boundaries and location of facilities

Instead of reinventing the wheel, the IPOR framework leverages existing frameworks such as:

• DOD’s Intelligence Preparation for the Battlefield (IBP) process
• The CERT Resilience Management Model (CERT-RMM)
• Operationally Critical, Threat, Asset, and Vulnerability Evaluation (OCTAVE) Allegro
• National Institute of Standards and Technology (NIST) Special Publication 800-37 Risk Management Framework (RMF)
• Agile
• Project Management Body of Knowledge (PMBoK)
• Goal-Question-Indicator-Metric (GQIM) method

PART 2: SETTING THE OPERATIONAL CONTEXT AND HEARING THE VOICES

IPOR uses “voices” to enumerate the landscape in which the organization and the adversary operate. The voices are:

• Voice of the Mission - strategic objectives and organizational culture
• Voice of the Service - organizational assets and external dependencies
• Together the Voice of the Mission and Voice of the Service create the Voice of the Organization
• Voice of the Threat Actor - describes the potential adversary use cases and a threat actor taxonomy, which includes the attackers’ motivations, intentions, and most likely attack patterns that are relevant to the organization

PART 3 GETTING STARTED WITH IPOR

IPOR proposes a framework to enable operational resilience and cybersecurity leaders and practitioners to:

• identify their intelligence needs
• consume intelligence
• integrate intelligence information into risk management, project, and incident response capabilities
• develop a trust relationship with their intelligence provider
• adjust the level of rigor and formality based on resources available

SEI Blog: Gray, Douglas. "Leveraging Threat Intelligence to Support Resilience, Risk, and Project Management," September 2015.

SEI Blog: Gray, Douglas. "Applying Threat Intelligence to Operational Resilience and Risk Management Frameworks," October 2015.

Intelligence Preparation for the Battlefield/Battlespace (IPB).

CERT Resilience Management Model

OCTAVE

National Institute of Standards and Technology (NIST) Special Publication 800-37 Rev 1. Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach.

Agile.

Stewart, Katie; Allen, Julia H.; Valdez, Michelle; Young, Lisa. Measuring What Matters Workshop Report (CMU/SEI-2015-TN-002). Software Engineering Institute, Carnegie Mellon University, January 2015.

A Guide to the Project Management Body of Knowledge (PMBOK Guide). Newtown Square, PA. Project Management Institute, Inc., 2004.