Tactical Intelligence

Tactical intelligence is about the ability to cope with unanticipated problems. It is a subset of what we might call improvisational intelligence, but while improvisation implies a rapid response, tactical intelligence is about the ability to keep functioning when your plans fall apart. And this comes up surprisingly often in daily life. You can find yourself in an emergency and not know how to react to it, but you don't want to make things worse by panicking. Or you can be faced with a challenge you've never seen before and need to invent a novel strategy for dealing with it.
Tactical intelligence doesn't mean that you should be able to solve any problem that comes along; if that were true, we'd all be geniuses all the time. Instead, it means that we should be able to recognize which problems we can deal with and which ones are beyond us. It means being able to tell when someone's asking for superhuman effort and when they're just being unreasonable. It means being able to tell when you're being set up for failure or when the situation is just genuinely hopeless.

In business and in life, tactical intelligence is a method of approaching problems that combines two elements:

1. The scientific method A mental model of reality is created and tested when you are trying to solve a problem or test a hypothesis. Exceptions and failures are discovered as you test your model of reality. The model must be trusted and followed; if not, the model must be changed and the process must be restarted from the beginning.
2. The art of war Essentially, war is a state of continuous emergency: in times of peace, prepare for war, and in times of war, prepare for peace (or vice versa). You must be prepared to change your mind about what you're doing or how you're going about it at any point in time. The difference between a good general and a bad general is that the good general knows when to do what he or she is supposed to be doing at the time.

The following seven steps will help you get started with your operational intelligence initiative, starting with objectives and progressing through to the initial pilot:

Understand what you want to achieve: While OI has a broad range of applications, it is necessary to identify those areas where it will have the greatest impact. Discovering key pain points in the organisation can help you identify problems that OI can help you solve. Build a team: Once your challenges have been identified, it is time to begin putting

Build a team: Once your challenges have been identified, it is time to begin putting together a team that will select, build, and operate the OI solution for your organisation. Depending on the specifics of the problem you're attempting to solve, this is often spearheaded by someone in the executive suite.

Take stock of your operational data: In order to be effective, OI requires data. If your raw data feeds are insufficient, or if operational data is not accessible, OI will fail immediately and without warning. Audit your data stores to find out what is being generated, where it is being stored, and how it is currently being analysed at this point in time.

Develop a better understanding of your data: you may discover that some of your data is either insufficiently collected or insufficiently high-quality or that some of your data is out-of-date or all of the above. Clean up your data feeds before launching an OI initiative; otherwise, you run the risk of having bad data, which leads to poor analysis and poor decisions.

Set up metrics: At the same time as step four, you'll want to identify in quantitative terms specific key performance indicators (KPIs) for the areas where your OI solution is intended to make a difference.

Tactical CTI seeks to identify how a Threat Actor plans to attack an organization and match that with detection and mitigation strategies. Examples of Tactical CTI are malware signatures, IP and URL blacklists, traffic patterns, log files, and credentials found in APT, ransomware, and phishing campaigns.
Tactical threats come in two forms: questions and problems. Questions are requests for information; problems are requests for action. Questions are better than problems because everyone has more information than action; thus questions take less effort to resolve than problems do.
But questions can also be tactical threats if there's something wrong with them: if they're unclear, or loaded with assumptions.

Providing relevance and context to a massive amount of data

Tactical threat intelligence comes with methodical processes that manage diverse datasets, turning them into actionable threat intelligence that fulfills an organization’s threat information needs.

Driving a proactive cybersecurity posture

By identifying vulnerabilities in networks and organizations, along with adversarial attack patterns, tactical threat intelligence can provide insights about the highest risk areas. It can, furthermore, detect business, mission, or technical weaknesses and help define and address the organization’s risk.

Aiding incident response

Tactical threat intelligence is consumed by incident responders to guarantee that their investigation and defenses are strong enough to withstand current tactics employed by adversaries.

Use Cases

Effective tactical threat intelligence solutions accumulate intelligence from disparate sources and internally deployed security tools. They enable security teams to identify trends from the cyber kill chain in the post-exploitation stage and associate them with reported intel.