Intel is a Fallacy, But I May Be Biased

No ratings

Presented at Shmoocon 2024 by

As threat intelligence practitioners, we often discuss our biases, mental models, and the common fallacies that impact our analysis and reporting. This talk looks at how we’ve failed to effectively communicate some of the decisions that we’ve made consciously and unconsciously during the production and dissemination of threat intelligence and how that impacts how our stakeholders think about the data. For example, threat profiles and analysis reports often talk about the targeted industry without actually discussing if the industry was specifically targeted or if a member of that industry was breached as a target-of-opportunity. Without that clarity organizations in that industry may misunderstand their threat landscape and prioritize defensive projects for lower-priority groups. Quite simply–we’ve introduced biases into our intelligence reporting that are not often discussed or considered by consumers. This talk will present multiple areas of threat intelligence reporting where we may be unintentionally implying significance to the wrong areas in our findings.