TIPS #8 Closing Keynote: Threatscaping like a CERT

Noortje Henrichs (NCSC)

One of the first rules for CTI is to work with clear requirements. Intelligence has to be tailor-made for the recipient to be an effective predictor of threats. But what if your constituency consists of multiple organizations with different requirements each? As a CERT, meeting everybody's intel requirements can be a bit overwhelming. How can you deliver timely and relevant information and for whom? Especially with limited resources, that can be a challenge for every CERT.

In this talk, the Dutch NCSC wants to show you their method of compiling and disseminating threat intelligence. With a wide range of organizations, institutions and information requirements in mind, we try to show our constituency a complete threat-landscape by focusing on generic, but also sector-specific digital threats.

We realize the process of CTI is different for everybody. With this presentation, we hope we can bring some inspiration and thought on the already diverse world of threat intelligence.

Noortje Henrichs

NCSC Noortje works at the Dutch National Centre for Cybersecurity (NCSC) and leads the Threat Analysis team and the Cyber Threat Intelligence team. From collection to dissemination, she is responsible for the execution of all phases of the threat intelligence lifecycle. She aims to deliver relevant and timely information on generic as well as sector-specific digital threats to the NCSC constituency. As part of a national CERT, it is her mission to offer partners, institutions and organizations a complete national threat landscape, that combines technical information with tactical context (and vice versa).