Speaking at The European Information Security Summit 2019 in London, Condé Nast International CISO Nick Nagle said that threat intelligence is easily collected, but it can also be translated across the business.
In his talk 'Effective threat intelligence communication strategies: Upwards, downwards and outwards' Nagle explained that threat intelligence is readily available, but turning it into actionable awareness points for the business requires another level of capability.
He said: “Know your audience, who are you trying to translate it to? What is the culture of the organization? How is the message going to land? What is the best way to send that message out? What is really going to grab people’s attention? Everyone has email overload, so how do you get that threat intel out there?”
Nagle recommended getting the basic points across, and to avoid “a condescending explanation” as executives often know the basics, but give them the option to learn more.
To deliver successful communications, Nagle suggested using the “AIM” structure of audience, intent and message, and ask yourself questions as you structure your message based on those three factors
He gave the example of communicating with the board: detailing an active attack, what existing technology the company has in place and a request for budget for what else is needed.
“That works, but it is a bit dull, a bit dry, but if that is what the board want that is what they will respond to,” he said, recommending using a threat radar or even using the threat intelligence in your email signature or an instant message.
This was part of moving it “away from text and boring” and into a PowerPoint template to highlight the issue, so it gives you a feedback loop, and you know the employee has read it.
He concluded by saying that building this sort of material gives you a toolkit for education and awareness, and “one that you can use internally, externally and across any other interested parties.”