From the Vault: Remember When Computer Viruses Were The Scary Viruses?

Intelligence Integration

Rick Holland, Chief Information Security Officer at Digital Shadows, highlights the integration of intelligence services into cybersecurity strategies. He emphasizes the importance of actionable intelligence, which requires more than just data; it needs analysis, relevancy, and timeliness 1. Drawing from his military background, Rick criticizes the cybersecurity industry's tendency to label raw data as intelligence without proper analysis. He notes, "You need more than data. You need analysis, you need relevancy, you need timeliness, all the attributes of actionable intelligence."

You need more than data. You need analysis, you need relevancy, you need timeliness, all the attributes of actionable intelligence.

--- Rick Holland

This approach is crucial for both the private sector and military operations, where actionable intelligence can significantly impact decision-making 2.

   

Learning from Incidents

Learning from past cybersecurity incidents is vital for improving current practices. Rick Holland stresses the importance of conducting after-action reviews to capture lessons from security incidents within organizations 3. He explains that understanding one's own environment is crucial, as it provides the most relevant insights into potential threats. Rick states, "We actually have to capture and learn from our own environments, because there's nothing more relevant than that."

We actually have to capture and learn from our own environments, because there's nothing more relevant than that.

--- Rick Holland

Additionally, he compares digital forensics to traditional counterintelligence investigations, highlighting the need for good visibility into internal environments to effectively track and manage cyber threats 4.