Measures, Metrics, and a Scale for Appraisal of Cyber Threat Intelligence-Informed Decision-Making

Abstract

Cyber threat intelligence (CTI) is information from past, present, and evolving threats which, if correlated and put in context, aims to enhance cybersecurity decision-making at strategic, operational, and tactical levels. Despite the multiple benefits of CTI, such as identifying and profiling threat actors, tuning systems and cybersecurity controls, and providing context to incidents, the field faces challenges that must be overcome for effective implementation of CTI. The bulk of existing research tackling these challenges focuses on the technical aspects of collecting, analysing, using, and sharing CTI. However, one of the main benefits of CTI lies in its intelligence affordances to inform decision-making for key actors in cybersecurity. Unfortunately, there is generally a dearth of research on human factors associated with disseminating and utilising CTI. Further, while some research has been undertaken investigating the quality of CTI, there has not been much research investigating the quality of CTI-informed decision-making. This research is targeted to address this gap within the context of a larger project investigating the effectiveness of gamification in enhancing CTI use for defence against cyberattacks. To measure the benefits of CTI throughout the decision-making process, this research has developed a gamification platform and some of the relevant metrics and measures. Firstly, this paper presents these proposed measures and the derived metrics that can be used to quantify the benefits of using CTI at the individual decision level to measure the overall effectiveness of CTI. Secondly, the paper presents a scale that is developed to provide a yardstick for future CTI performance testing – specifically for CTI gamification solutions and generally for CTI-informed cybersecurity decision-making. The research addresses the need to quantify the impact of CTI on decision-making processes in cybersecurity through the measures, metrics, and a scale to inform the actual assessments.