I have just read Max Hasting’s book, The Secret War; Spies, Codes and Guerrillas 1939-1945. It contains a key message on the use of Intelligence: It often isn’t used.

If you don’t use the information then the cost of obtaining it is waste.

When protecting a Organisation there are two sources of information about what the “opponent” is up to:

• Threat Analysis. Threat Landscaping, and similar studies that identify what may happen to you.
• Security Event Logs that identify what is happening and has happened to you.

What Max Hastings, and others, identified is during WWII information was often not believed because it conflicted with an existing mindset, or there was no ability to act on it.

For example,

• The Japanese Intelligence services identified in 1942 that the key threat was from the USA, however the Japanese High Command were obsessed with the threat from Russia until 1944 and ignored their warnings.
• The Germans had good information on Allied intentions in late 1944 and 1945, but did not have the capacity to exploit that knowledge.

In an Organisation which is looking to deploy information gathering tools – commissioning a Threat Landscape report, or purchasing an Security Information Event Management (SIEM) system – should consider what they are going to do with the information and how they can best benefit from their expenditure on it. It may be culturally challenging to do so.