Setting up a cyber threat intelligence process in big organizations : the example of the European Parliament

Προβολή/ Άνοιγμα
Λέξεις κλειδιά
Cybersecurity ; CTI ; Security ; European ParliamentΠερίληψη
In an era of increasing cyber threats, Cyber Threat Intelligence (CTI) has become a critical component of an organization's cybersecurity strategy. This thesis, "Setting up a Cyber Threat Intelligence Process in Big Organizations: The Example of the European Parliament," presents a comprehensive examination of CTI methodologies, implementation frameworks, and practical applications, with a specific focus on large organizations operating within complex regulatory and security environments.
The study begins by introducing CTI, exploring its significance in modern cybersecurity strategies, and reviewing foundational intelligence models such as the NIST SP 800-150 framework and the MITRE ATT&CK methodology. These models provide the theoretical foundation for threat identification, assessment, and mitigation while demonstrating how intelligence-driven security enables organizations to transition from reactive to proactive cyber defense mechanisms.
A critical aspect of this research is an in-depth literature review of 20 academic papers covering CTI methodologies, automation techniques, and intelligence-sharing models. By analyzing multiple frameworks, including STIX/TAXII, AI-enhanced threat intelligence, and cyber threat sharing networks, the thesis evaluates existing CTI approaches and their practical effectiveness in mitigating Advanced Persistent Threats (APTs), ransomware campaigns, and state-sponsored cyber espionage. The comparative analysis further highlights strengths, limitations, and emerging trends in CTI adoption across various industries.
The implementation of a CTI process in an organizational setting is examined through a structured methodology that includes intelligence collection, processing, analysis, and dissemination. This research builds on established CTI maturity models to propose a step-by-step framework for integrating CTI into Security Operations Centers (SOCs), Security Information and Event Management (SIEM) systems, and automated threat analysis platforms. Key implementation considerations include leveraging AI and automation, improving intelligence-sharing capabilities, and addressing common challenges such as intelligence overload and false positives.
A case study of the European Parliament (EP) provides a practical demonstration of CTI deployment in a high-profile, politically sensitive institution. By analyzing the EP's cybersecurity infrastructure, regulatory obligations, and collaboration with EU agencies such as ENISA and CERT-EU, the study outlines the unique security challenges faced by large government institutions and proposes a tailored CTI strategy to enhance cyber resilience.
The thesis concludes with lessons learned and best practices for CTI adoption, emphasizing the importance of a structured intelligence cycle, the role of automation in improving efficiency, the necessity of cross-sector collaboration, and the need for continuous adaptation to evolving cyber threats. Finally, the research identifies critical future directions for CTI, including the integration of blockchain technology for secure intelligence sharing, AI-driven predictive analytics, and enhanced regulatory frameworks for cross-border intelligence exchange.


