Certification

I got the opportunity to take course FOR578, Cyber Threat Intelligence. I'd always been curious about how to do it properly. As I discovered after completing the course and during exam preparation, it's a hugely complex area. Only then do you really realise how common cognitive bias is in analytical thinking and how hard it is to guard against.

But it's not just about that, of course. How to process data and how to disseminate it — that's part of it too. In a world where good indicators of compromise are worth their weight in gold, I consider this the best-invested time.

Attribution and the whole process of building a threat actor/group from data deserves its own chapter. Not to mention attributing a nation-state actor. The course materials are full of practical examples, so you can learn from others' mistakes and take note of good practice.

The exam itself was fairly demanding — 75 questions within 120 minutes, which when you're evaluating hypotheses (and there are quite a few) is a pretty tight deadline. In my case COVID made it even harder; I had to wear a respirator the entire time, which certainly doesn't help you feel calm and collected.

I can only recommend the course and the subsequent certification.