A Pragmatic Approach To Build A Threat Landscape

A cyber defense team at a chemical company kept receiving stakeholder questions about which threats and actors actually mattered to them. With no budget for paid threat intelligence services, the team needed a method that was practical, grounded in its own environment rather than general public reporting, and simple enough for anyone on the team to repeat.

The approach starts by gathering threat actors from free or already-paid sources: community exchange, MISP, MITRE resources, threat report collections, feed readers, vendor portals, and the team's own cases and detections, which received a scoring bonus. Filtering by the chemical sector alone left too little data, so the scope widened to customer sectors such as pharma, food, and personal care. Opportunistic threats were also considered, and actor aliases that differ between sources were accepted as a known inaccuracy. Techniques tied to the relevant actors were scored by how many sources agreed, then normalised. The outputs included ATT&CK Navigator layers, spreadsheets with mitigation and data source mappings, and a selection of Atomic Red Team tests.

The speaker stressed that mitigation mappings are only partial and that only about a fifth of techniques ended up rated relevant. Remaining techniques should not be ignored, since sources are biased and threats change, and low-coverage areas reveal gaps to fill. Endpoint telemetry proved especially important. Technique changes were around ten percent over a year, so a yearly refresh was judged enough. Planned improvements include decaying scores for older threats, adding related sectors, weighing source credibility, and including opportunistic threats at a lower score.