Purpose
This document establishes the process for collecting, analysing, and acting on threat intelligence at Carriyo. Effective threat intelligence enables the organisation to proactively identify, assess, and respond to cybersecurity threats that could affect the confidentiality, integrity, or availability of information assets. This process supports ISO 27001:2022 Annex A control A.5.7 (Threat intelligence).
Scope
This process applies to all threat intelligence activities conducted by or on behalf of Carriyo, including the collection, analysis, dissemination, and operationalisation of intelligence related to cybersecurity threats. It covers threats to:
- Carriyo's cloud infrastructure (AWS, GCP)
- Carriyo's SaaS platform and applications
- Customer data processed by Carriyo
- Third-party services and supply chain components
- Carriyo's workforce (social engineering, credential compromise)
Threat Intelligence Sources
Strategic Intelligence Sources
Strategic intelligence provides a high-level understanding of the threat landscape and informs risk management and security strategy.
| Source | Type | Frequency |
|---|---|---|
| Industry threat reports (e.g., Verizon DBIR, CrowdStrike Global Threat Report, ENISA Threat Landscape) | Published report | Annual / upon publication |
| Regulatory advisories and guidance (e.g., GDPR enforcement trends, UAE PDPL guidance) | Regulatory publication | As published |
| Cloud provider security bulletins (AWS Security Bulletins, GCP Security Notes) | Provider advisory | As published |
| Peer and industry information sharing (ecommerce and logistics sector) | Community intelligence | Ongoing |
Tactical Intelligence Sources
Tactical intelligence provides information about specific threat actor techniques, tactics, and procedures (TTPs) and supports detection and response.
| Source | Type | Frequency |
|---|---|---|
| CISA (Cybersecurity and Infrastructure Security Agency) advisories and alerts | Government advisory | As published |
| NIST National Vulnerability Database (NVD) | Vulnerability database | Continuous |
| GitHub Security Advisories (for open-source dependencies) | Advisory | Continuous / automated |
| Cloud provider vulnerability notifications (AWS, GCP) | Provider advisory | As published |
| Vendor security advisories (SaaS tools, infrastructure components) | Vendor advisory | As published |
Operational Intelligence Sources
Operational intelligence provides real-time or near-real-time information about active threats and is used for immediate detection and response.
| Source | Type | Frequency |
|---|---|---|
| AWS GuardDuty findings | Automated threat detection | Continuous |
| GCP Security Command Center findings | Automated threat detection | Continuous |
| Dependency vulnerability scanning (automated in CI/CD) | Automated scanning | Per build / daily |
| DNS and domain monitoring (for brand impersonation, typosquatting) | Monitoring service | Continuous |
| Dark web monitoring (if applicable) | Monitoring service | Periodic |
Collection Process
Automated Collection
- Vulnerability feeds — Automated tools monitor vulnerability databases and dependency advisories. Alerts for vulnerabilities affecting Carriyo's technology stack are generated automatically.
- Cloud security services — AWS GuardDuty and GCP Security Command Center continuously monitor Carriyo's cloud environments and generate findings based on threat detection algorithms.
- CI/CD dependency scanning — Each build triggers automated scanning of application dependencies against known vulnerability databases.
Manual Collection
- Advisory review — The Information Security Specialist reviews published advisories from CISA, cloud providers, and key vendors on a weekly basis.
- Industry report review — Major annual threat reports are reviewed upon publication and key findings are documented.
- Peer intelligence — Information shared through industry contacts, security communities, or customer notifications is evaluated and recorded.
Collection Schedule
| Activity | Frequency | Responsible |
|---|---|---|
| Review CISA and government advisories | Weekly | Information Security Specialist |
| Review AWS and GCP security bulletins | Weekly | Information Security Specialist / Engineering |
| Review vendor security advisories | Weekly | Information Security Specialist |
| Automated vulnerability scanning | Continuous (per CI/CD build and daily scheduled scans) | Engineering (automated) |
| Cloud threat detection monitoring | Continuous | Engineering (automated), reviewed by Information Security Specialist |
| Industry report review | Upon publication (at least annually) | Information Security Specialist |
Analysis Process
Triage
All collected intelligence is triaged to determine its relevance and urgency to Carriyo.
Relevance Assessment
Each piece of intelligence is evaluated against the following criteria:
- Technology relevance — Does this affect technologies in Carriyo's stack (AWS services, GCP services, programming languages, frameworks, libraries, operating systems, container platforms)?
- Threat actor relevance — Does this involve threat actors known to target SaaS platforms, ecommerce, logistics, or cloud infrastructure?
- Data relevance — Could this threat affect the types of data Carriyo processes (customer PII, order data, shipment data, carrier credentials)?
- Geographic relevance — Does this threat affect the regions where Carriyo stores data (AWS eu-west-1, Ireland; Google Cloud europe-west2, London) or the countries where Carriyo personnel work (United Arab Emirates, India)?
Severity Classification
Relevant intelligence items are classified by severity:
| Severity | Criteria | Response Timeframe |
|---|---|---|
| Critical | Active exploitation of a vulnerability affecting Carriyo's production systems or infrastructure; imminent threat to customer data | Immediate (within 4 hours) |
| High | Known vulnerability in Carriyo's technology stack with public exploit code available; credible targeted threat against the sector | Within 24 hours |
| Medium | Vulnerability or threat relevant to Carriyo's environment but no known active exploitation; advisory requiring configuration review | Within 7 days |
| Low | General intelligence for awareness; vulnerability in non-production or low-impact components | Within 30 days or next scheduled review |
Contextual Analysis
For Critical and High severity items, deeper analysis is performed:
- Assessment of Carriyo's specific exposure (which systems, services, or data are affected)
- Evaluation of existing controls that may already mitigate the threat
- Identification of indicators of compromise (IOCs) that can be used for detection
- Assessment of potential business impact if the threat materialises
- Recommended actions (patch, configuration change, monitoring enhancement, customer notification)
Documentation
All analysed intelligence items are recorded in the threat intelligence log, which includes:
| Field | Description |
|---|---|
| Intel ID | Unique identifier |
| Date Received | Date the intelligence was collected |
| Source | Origin of the intelligence |
| Description | Summary of the threat or vulnerability |
| Relevance Assessment | How it relates to Carriyo |
| Severity | Critical, High, Medium, or Low |
| Affected Assets | Carriyo systems, services, or data affected |
| Existing Mitigations | Controls already in place |
| Recommended Actions | Specific response actions |
| Action Owner | Person responsible for response |
| Status | New, Under Analysis, Action In Progress, Resolved, Informational |
| Resolution Date | Date actions were completed |
Response and Operationalisation
Integration with Incident Response
- Critical and High severity intelligence items that indicate an active or imminent threat trigger the Incident Management process (CAR-ISMS-POL-011)
- IOCs identified through threat intelligence are fed into monitoring and alerting systems
- Threat intelligence findings inform incident response playbooks and procedures
Integration with Vulnerability Management
- Vulnerabilities identified through threat intelligence are added to the vulnerability tracking system
- Remediation is prioritized based on the threat intelligence severity classification and the remediation SLAs defined in the ISMS Monitoring and Measurement Plan
- Intelligence about active exploitation elevates the remediation priority of affected vulnerabilities
Integration with Risk Assessment
- Strategic and tactical intelligence informs the periodic risk assessment process
- New threat categories or significant changes to the threat landscape may trigger an update to the risk register
- Threat intelligence trends are included as input to the annual management review
Integration with Security Awareness
- Relevant threat intelligence (particularly phishing trends, social engineering techniques, and credential compromise methods) is shared with staff through security awareness communications
- High-profile incidents or breaches in the ecommerce and logistics sector are used as case studies in security awareness training
Dissemination
Internal Dissemination
| Audience | Content | Method | Frequency |
|---|---|---|---|
| Engineering / DevOps Team | Vulnerability advisories, patching requirements, IOCs, configuration guidance | Direct notification (messaging channel, email), ticket creation | As needed based on severity |
| CTO / Head of Engineering | Summary of significant threats, vulnerability status, recommended actions | Written briefing or verbal briefing | Weekly and ad-hoc for Critical/High items |
| Management (CISO) | Strategic threat landscape summary, significant incident intelligence, risk implications | Monthly security report, management review input | Monthly and ad-hoc for Critical items |
| All Staff | General security awareness (phishing trends, social engineering warnings) | Security awareness communications | As needed |
External Dissemination
- Carriyo does not routinely share threat intelligence externally unless required by contractual obligation (e.g., customer notification of a breach), legal requirement, or through participation in an information-sharing community
- Any external dissemination of threat intelligence is approved by management and reviewed for sensitivity before release
- Customer notifications regarding threats or vulnerabilities affecting their data follow the notification procedures defined in the Incident Management Policy
Responsibilities
| Role | Responsibilities |
|---|---|
| Information Security Specialist | Owns the threat intelligence process; manages collection, analysis, and dissemination; maintains the threat intelligence log; integrates intelligence into risk assessment and incident response; reports to management |
| CTO / Head of Engineering | Supports analysis of technical intelligence; ensures engineering team acts on vulnerability advisories and IOCs; provides input on technology-specific threats |
| Engineering / DevOps Team | Monitors automated threat detection tools (GuardDuty, Security Command Center); implements technical responses (patching, configuration changes, IOC blocking); maintains CI/CD security scanning |
| Management (CISO) | Provides strategic direction for threat intelligence priorities; approves resource allocation for intelligence activities; reviews threat landscape summaries during management reviews |
Metrics
The following metrics are tracked to evaluate the effectiveness of the threat intelligence process:
| Metric | Target |
|---|---|
| Critical/High intelligence items triaged within defined timeframes | 100% |
| Percentage of relevant advisories reviewed within one week of publication | >= 95% |
| IOCs operationalised into detection systems within 24 hours of identification | >= 90% |
| Threat intelligence items referenced in risk assessment updates | Tracked quarterly |
| Time from intelligence receipt to action initiation (Critical/High) | Critical: < 4 hours, High: < 24 hours |
Review
This document is reviewed annually or when significant changes occur to the threat landscape, Carriyo's technology stack, or ISMS scope. Updates are processed through the standard document control procedure (CAR-ISMS-PRC-001).
Enforcement
All personnel with threat intelligence responsibilities are expected to fulfil their obligations as defined in this document. Failure to act on Critical or High severity intelligence within the defined timeframes is treated as a non-conformity and addressed through the corrective action process.