CTI Analysis, Co-Authoring a SANS course, and Building a vibrant CTI sharing community - Interview with Will Thomas (S1E5)

In this conversation, Freddy and Will delve into the world of Cyber Threat Intelligence (CTI) and sharing communities, exploring of Will T, the journey of a cybersecurity professional, the importance of training and community, the challenges faced in threat reporting, and the impact of AI on the field. They discuss the evolution of CTI, the necessity for critical thinking, and the ethical considerations surrounding the use of AI in intelligence work. The conversation emphasizes the need for collaboration and knowledge sharing within the cybersecurity community to enhance overall effectiveness against cyber threats.TakeawaysThe importance of foundational knowledge in cybersecurity.Real-world experience is crucial for developing analytical skills.Training can significantly enhance an analyst's capabilities.Community support is vital for sharing knowledge and resources.AI can assist in summarizing and analyzing data but has limitations.Ethical considerations are paramount when using AI in intelligence.Critical thinking is essential in evaluating threat reports.Transparency in threat reporting builds trust with stakeholders.Continuous learning and adaptation are necessary in cybersecurity.Collaboration within the community can lead to better threat mitigation.Resources & References MentionedRob M. Lee - https://www.dragos.com/team/robert-m-lee/SANS FOR578: https://www.sans.org/cyber-security-courses/cyber-threat-intelligence/ SANS FOR589: https://www.sans.org/cyber-security-courses/cybercrime-investigations/ Chainalysis Blockchain Intelligence: https://www.chainalysis.com/blockchain-intelligence/ SANS blog post on Admiralty Scale https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system/Oracle incident - https://www.csoonline.com/article/3953644/oracle-quietly-admits-data-breach-days-after-lawsuit-accused-it-of-cover-up.html Flavio Queiroz's LinkedIn post - https://www.linkedin.com/posts/flavioqueiroz_threathunting-threatdetection-threatanalysis-activity-7310254153732141056-b-Ba/ Council of Experts: https://blog.bushidotoken.net/2024/04/strengthening-proactive-cti-through.htmlWill's Projects: https://github.com/BushidoUK#-my-projectsRansomware Tool Matrix: https://github.com/BushidoUK/Ransomware-Tool-MatrixCurated Intelligence: https://www.curatedintel.org/MITRE ATT&CK: https://attack.mitre.org/Diamond Model of Intrusion Analysis: https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf?adlt=strictMapping TTPs: https://github.com/BushidoUK/MITRE-MappingsCurated Intel website - https://www.curatedintel.org/ Microsoft Security Copilot: https://www.microsoft.com/en-us/security/business/ai-machine-learning/microsoft-security-copilotChapters00:00 Introduction to Cyber Threat Intelligence02:48 Career Journey in Cybersecurity06:08 Understanding Cyber Threat Intelligence09:06 The Role of Training in Cyber Intelligence11:57 Teaching and Sharing Knowledge in Cybersecurity15:08 The Importance of Community in Cyber Intelligence17:54 Challenges in Cyber Threat Reporting20:56 The Impact of AI on Cyber Threat Intelligence24:08 Future of AI in Cybersecurity26:47 Ethics and Challenges of AI in Intelligence29:57 Conclusion and Final ThoughtsThis conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview happened on May 2nd, 2025 in Bournemouth, England.