Digital Shadows' Rick Holland spoke at the 2017 SANS Forensics CTI Summit. He discussed how World War II provides countless lessons for the intelligence analyst in his talk, "Inglorious Threat Intelligence."

1. INGLORIOUS
THREAT
INTELLIGENCE
@rickhholland
Rick Holland
VP Strategy, Digital Shadows

5. “Now this is not the end.
It is not even the
beginning of the end. But
it is, perhaps, the end of
the beginning.”

6. Chapter One
Wild Bill Donovan
@rickhholland

7. US Intelligence - 1941
7
Primitive
Parochial
Underfunded
Undermanned
Dumping ground

9. “Information is useless
unless it is intelligently
directed to the strategic
purpose.”

10. Office of Strategic Services

11. Behind enemy lines

13. Chapter Two
Operation Torch
@rickhholland

15. 1. Inspire guerrilla warfare
campaign against French

16. 2. Ensure French forces wouldn’t
resist landing US troops

17. 3. Provide intel on French troop
strength and disposition

18. 4. Provide intel on landing
conditions at ports and beaches

19. OSS enabled the path
to the “soft underbelly”
of Europe.
Align to the “strategic purpose”

20. Chapter Three
Operation Barbarossa
@rickhholland

22. Avoid winter warfare in Russia

23. Also never get involved in a land war in Asia

24. Admiral Wilhelm Canaris
Head of the Abwehr

26. 1. SOC analyst
2. Threat hunter
3. Chief Information Security Officer
4. Other C level executives
5. Business unit / Line of business leader
Use personas to better understand your intel
customers

29. • Specific to the individual
• What are their triggers?
• What are they passionate about?
• Document!
Build dossiers on your intel customers

30. 5 ways to connect
with your intel
customers

31. 1. Use their terminology; not yours

32. 2. Focus on what they care about

33. 3. Create a personal story that resonates

34. 4. Be flexible, adjust your process

35. 5. Engage outside of work

36. Chapter Four
Operation North Pole
@rickhholland

38. Major Hermann Giskes of the Abwehr

39. Huub Lauwers

40. ‣ 90 Royal Air Force sorties
flown
‣ 54 Dutch SOE agents died
‣ 83 RAF crew died

41. 500,000 Guilders

42. 53 SOE radio sets

43. > 4,000 machine guns

44. 50,000 rounds of ammunition

46. “Whenever you will come to pay a visit to
the Continent you may be assured that you
will be received with the same care and
result as all those who you sent us before.”

48. Don’t let rivalries impact analysis

49. Leave the drama at home

50. Structured analytic techniques should be 2nd
nature

53. 1. Align to the “strategic purpose”
2. Use personas to better understand your intel
customer
3. Build dossiers on your intel customer
4. Connect with your intel customer
Summary

54. 5. Don’t let rivalries impact analysis
6. Leave the drama at home
7. Structured analytic techniques should be 2nd nature
Summary

55. 55
Thank you!
@rickhholland

56. • Wild Bill Donovan: The Spymaster Who Created the OSS and Modern American Espionage
• Hitler's Spies: German Military Intelligence in World War II
• German Military Intelligence In World War II
• Volume 1 War Report Office of Strategic Services Washington Organization,
https://searchworks.stanford.edu/view/11645521
• Volume 2 War Report: Office of Strategic Services: Operations in the Field,
https://searchworks.stanford.edu/view/11645521
• Analysis of The Personality of Adolph Hitler http://lawcollections.library.cornell.edu/nuremberg/analysis
• A Timeline for Using Analytic Techniques Throughout an Analytic Project https://www.cia.gov/library/center-for-the-
study-of-intelligence/csi-publications/books-and-monographs/Tradecraft%20Primer-apr09.pdf
• The Science of Building Buyer Personas, https://www.singlegrain.com/blog-posts/content-marketing/science-
building-buyer-personas/
• Trump and intelligence: 6 ways to deal with challenging intelligence consumers
https://www.digitalshadows.com/blog-and-research/trump-and-intelligence-6-ways-to-deal-with-challenging-
intelligence-consumers/
• Two ways to effectively tailor your intelligence products https://www.digitalshadows.com/blog-and-research/two-
ways-to-more-effectively-tailor-your-intelligence-products/
References: