Skip to main content
Review and revision metadata
Review Date: 2026-07-05
Reviewer: Director

previous version on gdrive

A.5.7 Threat intelligence

1. Objective and Ingestion Architecture​

anDREa systematically collects, filters, and evaluates information regarding information security threats to produce actionable threat intelligence. This continuous ingestion lifecycle satisfies ISO/IEC 27001 Annex A.5.7, allowing the organization to maintain a proactive defensive posture, secure our cloud fabric, and protect critical health-data research environments from emerging attack vectors.

Threat indicators are gathered continuously from both internal infrastructure telemetry and external threat networks:

1.1 Internal Ingestion Sources​

  • Enterprise Cloud Telemetry: Live security alerts, misconfiguration signals, and hardening recommendations from Mcrosoft Defender Recommendations.
  • Proprietary Telemetry Matrix: Native infrastructure alerting pipelines and system performance monitoring loops deployed across the myDRE platform.
  • Identity & Workspace Signals: Threat alerts, anomalous authentication indicators, and access anomalies consolidated within the Google Security Center.
  • Audit Logging Infrastructure: Low-level environment logs, system events, and data access records preserved in accordance with A.08.15 - Logging.
  • User Telemetry: Anomalies, phishing attempts, or suspicious platform behaviors reported directly by end-users or Local Research Support (A.05.26 - Response to information security incidents).

1.2 External Threat Intelligence Channels​

  • Automated CERT Feeds: Automated consumption of structured security feeds and RSS alerts published by the Nationaal Cyber Security Centrum (NCSC-NL) and other global Computer Emergency Response Teams (see RSS Security).
  • Upstream Vendor Advisories: Direct monitoring of critical patch schedules, zero-day disclosures, and mitigation steps released via Microsoft Azure Security Advisories and Google Workspace Security Bulletins.
  • Automated Code & Supply Chain Scans: Real-time vulnerability telemetry and code security alerts derived from SonarCloud Automated Checks and GitHub Dependabot/Security Alerts during periodic evaluation windows.
  • Curated Threat Intelligence: Security newsletters, specialized cyber-defense bulletins (e.g., A51 Security Insights), and vetted intelligence publications (e.g., BleepingComputer) to monitor macro-level adversary techniques.

2. Threat Analysis, Profiling, and Operational Triage​

Raw threat data is aggregated, parsed, and converted into actionable intelligence to determine its operational impact on anDREa's architecture.


┌──────────────────┐      ┌──────────────────┐      ┌──────────────────┐
│ Inbound Threat   │ ───► │ Relevance Filter │ ───► │ Risk Profiling   │
│ Telemetry (Feeds)│      │ (Azure/Workspace)│      │ & Scenario Update│
└──────────────────┘      └──────────────────┘      └────────┬─────────┘
                                                             │
                                                             ▼
┌──────────────────┐      ┌──────────────────┐      ┌──────────────────┐
│ Google Chat      │ ◄─── │ Security Ticket  │ ◄─── │ Central Issue    │
│ Security Channel │      │ & Sprint Backlog │      │ & Risk Log Entry │
└──────────────────┘      └──────────────────┘      └──────────────────┘
  • Relevance Analysis: The Management Team filters incoming threat data against anDREa's specific operational footprint (primarily Microsoft Azure, Google Workspace, and the myDRE codebase) to filter out noise and focus on contextually relevant threats.
  • Threat Profiling: When a verified, relevant threat vector is confirmed—such as a novel exploit targeting cloud research environments—the Management Team updates anDREa's internal threat profiles and designs a corresponding, targeted risk scenario.
  • Operational Escalation & Action: Actionable intelligence that presents a valid risk to our architecture is indexed within our central tracking ecosystem to drive remediation. Urgent items trigger an entry in the Issues and Risk Logging Register, which generates a high-priority ticket to deploy technical mitigations, infrastructure patches, or configuration updates.

3. Collaboration and Trend Identification​

To ensure rapid internal coordination and identify broader security trends:

  • anDREa utilizes a dedicated, real-time communication channel (Google Chat: Security) alongside its secure ticketing system to aggregate all threat intelligence alerts.
  • The Management Team uses this centralized communication loop to continuously analyze data for underlying trends, malicious patterns, and emerging security risks, transforming raw threat data into long-term architectural improvements for the myDRE ecosystem (Periodic Security Controls).