1. Course Overview

 Certified Threat Intelligence Analyst (C|TIA) is a training and credentialing program designed and developed in collaboration with cybersecurity and threat intelligence experts across the globe to help organizations identify and mitigate business risks by converting unknown internal and external threats into known threats. It is a comprehensive specialist-level program that teaches a structured approach for building effective threat intelligence.

The program was based on a rigorous Job Task Analysis (JTA) of the job roles involved in the field of threat intelligence. This program differentiates threat intelligence professionals from other information security professionals. It is a highly interactive, comprehensive, standards-based, intensive 3-day training program that teaches information security professionals to build professional threat intelligence.

More than 40 percent of class time is dedicated to the learning of practical skills, and this is achieved through EC-Council labs. Theory to practice ratio for C|TIA program is 60:40, providing students with a hands-on experience of the latest threat intelligence tools, techniques, methodologies, frameworks, scripts, etc. C|TIA comes integrated with labs to emphasize the learning objectives.

The C|TIA lab environment consists of the latest operating systems including Windows 10 and Kali Linux for planning, collecting, analyzing, evaluating, and disseminating threat intelligence.

2. Course Duration

3 Days ( 24 Hours )

3. Target Audience

Any cyber security professional who needs to understand how to gather large amounts of relevant threat information from a multitude of intelligence sources which can then be analyzed to provide threat intelligence that accurately predicts the potential threats that an organization may encounter. These individuals may be fulfilling roles such as: Ethical Hackers, Threat Intelligence Analysts, Threat Hunters, SOC Professionals, Digital Forensic and Malware Analysts, Incident Response,

4. During this course you should learn: 

• Key issues plaguing the information security world

• Importance of threat intelligence in risk management, SIEM, and incident response

• Types of cyber threats, threat actors and their motives, goals, and objectives of cybersecurity attacks

• Fundamentals of threat intelligence (including threat intelligence types, lifecycle, strategy, capabilities, maturity model, frameworks, etc.)

• Cyber kill chain methodology, Advanced Persistent Threat (APT) lifecycle, Tactics, Techniques, and Procedures (TTPs), Indicators of Compromise (IoCs), and pyramid of pain

• Various steps involved in planning a threat intelligence program (Requirements, Planning, Direction, and Review)

• Different types of data feeds, sources, and data collection methods

• Threat intelligence data collection and acquisition through Open Source Intelligence (OSINT), Human Intelligence (HUMINT), Cyber Counterintelligence (CCI), Indicators of Compromise (IoCs), and malware analysis

• Bulk data collection and management (data processing, structuring, normalization, sampling, storing, and visualization)

• Different data analysis types and techniques including statistical Data Analysis, Analysis of Competing Hypotheses (ACH), Structured Analysis of Competing Hypotheses (SACH), etc.)

• Complete threat analysis process which includes threat modeling, fine-tuning, evaluation, runbook, and knowledge base creation

• Different data analysis, threat modeling, and threat intelligence tools

• Threat intelligence dissemination and sharing protocol including dissemination preferences, intelligence collaboration, sharing rules and models, TI exchange types and architectures, participating in sharing relationships, standards, and formats for sharing threat intelligence

• Effective creation of threat intelligence reports

• Different threat intelligence sharing platforms, acts, and regulations for sharing strategic, tactical, operational, and technical intelligence

5. Course Content

Module 1: Introduction to Threat Intelligence

Lesson 1: Understanding Intelligence

Lesson 2: Understanding Cyber Threat Intelligence

Lesson 3: Overview of Threat Intelligence Lifecycle and Frameworks

Module 2: Cyber Threats and Kill Chain Methodology

Lesson 1: Understanding Cyber Threats

Lesson 2: Understanding Advanced Persistent Threats (APTs)

Lesson 3: Understanding Cyber Kill Chain

Lesson 4: Understanding Indicators of Compromise (IoCs)

Module 3: Requirements, Planning, Direction, and Review

Lesson 1: Understanding Organization’s Current Threat Landscape

Lesson 2: Understanding Requirements Analysis

Lesson 3: Planning Threat Intelligence Program

Lesson 4: Establishing Management Support

Lesson 5: Building a Threat Intelligence Team

Lesson 6: Overview of Threat Intelligence Sharing

Lesson 7: Reviewing Threat Intelligence Program

Module 4: Data Collection and Processing

Lesson 1: Overview of Threat Intelligence Data Collection

Lesson 2: Overview of Threat Intelligence Collection Management

Lesson 3: Overview of Threat Intelligence Feeds and Sources

Lesson 4: Understanding Threat Intelligence Data Collection and Acquisition

Lesson 5: Understanding Bulk Data Collection

Lesson 6: Understanding Data Processing and Exploitation

Module 5: Data Analysis

Lesson 1: Overview of Data Analysis

Lesson 2: Understanding Data Analysis Techniques

Lesson 3: Overview of Threat Analysis

Lesson 4: Understanding Threat Analysis Process

Lesson 5: Overview of Fine-Tuning Threat Analysis

Lesson 6: Understanding Threat Intelligence Evaluation

Lesson 7: Creating Runbooks and Knowledge Base

Lesson 8: Overview of Threat Intelligence Tools

Module 6: Intelligence Reporting and Dissemination

Lesson1: Overview of Threat Intelligence Reports

Lesson 2: Introduction to Dissemination

Lesson 3: Participating in Sharing Relationships

Lesson 4: Overview of Sharing Threat Intelligence

Lesson 5: Overview of Delivery Mechanisms

Lesson 6: Understanding Threat Intelligence Sharing Platforms

Lesson 7: Overview of Intelligence Sharing Acts and Regulations

Lesson 8: Overview of Threat Intelligence Integration

Prerequisites

There are no hard set prerequsites for course attendance, however in order to apply to take the exam you must be able to show a minimum of 3 years working experience in information security or software design.

Course Agenda

Technical Requirement 

1. Laptop with minimum 8GB Ram

2. Connected Monitor for iLabs.

3. Hi speed Internet Connection as All the labs it will be accessed through EC-Council Cloud

Exam Voucher Validity

It will be valid for 12month starting from the last day of the course.

Certification Expiry

It will be valid for 3 years.