Examkin

Question

Difficulty: HardThreat Intelligence Sources and Research

A security operations analyst is categorizing threat intelligence sources to build a tiered threat data pipeline. Match each threat intelligence source classification on the left with its primary operational characteristic on the right.

  • Open-Source Intelligence (OSINT)Unclassified, publicly accessible information gathered from web scraping, social media, and security research blogs without subscription fees.
  • Information Sharing and Analysis Center (ISAC)Trusted sector-specific communities facilitating non-profit, peer-to-peer threat indicator sharing among member organizations.
  • Commercial / Proprietary Threat IntelligenceFee-based subscription services delivering curated threat actor profiling, finished strategic reporting, and dark web monitoring.
  • Vulnerability Databases (e.g., NVD / CVE)Standardized public repositories providing technical flaw metrics, remediation references, and CVSS severity scoring.

Answer

Open-Source Intelligence (OSINT) matches unclassified, publicly accessible web data. Information Sharing and Analysis Center (ISAC) matches trusted sector-specific peer indicator sharing. Commercial / Proprietary Threat Intelligence matches fee-based subscriptions for dark web and actor profiling. Vulnerability Databases match standardized public repositories providing CVSS scores and CVE flaw metrics.
Each threat intelligence source corresponds directly to its operational delivery model: Open-Source Intelligence relies on publicly available data without cost; ISACs provide sector-restricted peer collaboration; Commercial/Proprietary feeds deliver paid tailored analytics and dark web visibility; and Vulnerability Databases offer standardized flaw listings with CVSS scoring.

Step-by-Step Solution

1
Identify the governance and access constraints of each intelligence source type.
Distinguish between completely open data, sector-restricted peer data, commercial subscription feeds, and vulnerability registries.
Threat intelligence categorization relies on data origin, access licensing, and intended utility.
2
Map OSINT and Vulnerability Databases to their respective public frameworks.
OSINT pairs with freely available online research; vulnerability databases pair with standardized flaw registries like NVD/CVE.
Both are publicly accessible, but OSINT focuses on broad threat data while NVD focuses on software weakness scoring.
3
Differentiate between collaborative sector sharing and vendor-provided commercial intelligence.
ISAC pairs with peer-to-peer industry sharing; commercial intelligence pairs with paid bespoke threat actor and dark web monitoring.
ISACs operate on non-profit sector collaboration, whereas commercial vendors operate on paid subscription models.

Key Concept

Categorization and Characteristics of Threat Intelligence Sources
Rate this question

Topics

Threat Intelligence Sources and Research

More questions from this topic