2017-Sept-07

Did you know? You can share this story using the social media icons on the left. Please include the hashtag #WeAreCisco. You can also rate and comment on the story below.

The Path to Intelligence

Henry graduating from Mercyhurst University with a degree in Intelligence Studies

Henry Peltokangas remembers what he was doing on September 11, 2001: He was a teenager on his way home from church camp in his native Finland. When he turned on the TV and saw the attacks on the World Trade Center, he felt a calling to help prevent future attacks.

"It impacted what I wanted to do with my life," he says.

From that moment on, Henry's life was put on a new track—one that centered on security and led him, years later, to play a key role in creating Cisco Threat Intelligence Director (TID). The technology enhances customers' ability to rapidly and accurately analyze and respond to security threats. It plays an important role in our security strategy of being effective and open.

After graduating high school in Finland, Henry did a year of military service, specializing in long-range reconnaissance. It was his first exposure to intelligence collection, and he liked it. In fact, it sparked a desire to study intelligence, which in turn led him to pursue a degree in the United States. In order to help pay for his studies, he took an instructor job in the military for another year and worked at Helsinki Airport, running X-ray machines and checking passengers' baggage.

Henry participating in a GORUCK Challenge in Washington D.C.

Henry earned a B.A. in Intelligence Studies at Mercyhurst University in Erie, Pennsylvania—one of the first schools anywhere to offer such a program. The focus was traditional intelligence analysis of the kind done by the CIA and the intelligence community, with potential applications in the fight against terrorism.

"It wasn't so much the cyber part," Henry says.

After he graduated in 2009, Henry landed his first job as a threat analyst with U.S. threat intelligence firm iSIGHT Partners (acquired last year by FireEye). The job took him back to Europe for two years (Amsterdam), and moved him towards the cyber end of the security spectrum. At iSIGHT, he was promoted to team manager of cyber threat intelligence and later moved back stateside via internal transfer to Washington, D.C. A career highlight was his role in the design and development of data models that iSIGHT was using and contributing to STIX and TAXII—open industry standards in information security.

Another career highlight came in 2013 after Henry joined Symantec as the primary product manager for its DeepSight Intelligence Portal. The role gave him a chance to build an intelligence team from the ground up.

"As someone who is really interested in the intelligence side, it was an offer I couldn't turn down," he recalls.

Henry visiting the European Parliament in Belgium, as part of a Summer School on Organized Crime—organized by the Leuven Institute of Criminology

The team he created was responsible for cyber-threat research and analysis and for producing finished cyber threat intelligence reports. But its crowning achievement was the creation and release of a new service offering around cyber-threat intelligence analysis that came to be known as Managed Adversary and Threat Intelligence (MATI).

All of these experiences laid the groundwork for what Henry would do when he joined Cisco in 2016 as product manager for Cisco. It was here that he pursued what would become another career highlight—his work as Threat Intelligence Director. The project in some respects represented a confluence of two visions. On one hand, Henry's predecessor at Cisco (Leon Ward, now with ThreatQ) had already conceived and started work on the project. But Henry was already moving in the same direction when he took the project over.

"The concept was something I had been thinking about in my previous job," Henry says. "But there were a lot of details that were not figured out."

In short, part of the genius of Threat Intelligence Director is its ability to ingest third-party threat intelligence and operationalize it with Cisco's network security devices. The ability to have these two parts work together—intelligence on one hand and security technologies on the other—was the missing link in earlier iterations.

Quote "In my previous job, every time we went to sell the intelligence we were creating, customers would say, ‘OK, we like your intelligence, but can you show us how you operationalize it with our security technologies?' We never had a good answer to that."

While the engineering team was very knowledgeable on the network security device side of the equation, it was Henry's expertise in intelligence analysis—the customer side of the equation, if you will—that provided the all-important insight into how the technology should be used to fit the use case.

Henry practicing his Parkour skills at a Parkour gym in Manassas, Virginia.

Today, Threat Intelligence Director is targeted for release with Cisco FirePower 6.2.2 in early September. After that, Henry's priorities are continuing to develop the technology and expanding it to other standards—such as adding support for Yara and OpenC2.

For Henry, his journey from Finland to America and from security to cyber security has exceeded his expectations. When he started out, cyber security was at the bottom of the list of his professional goals. But over the years, he says he has watched it become an even larger issue than what terrorism used to be.

"I'm completely growing into the field and there are always new things to learn," he says. "It's something I fell into, but I'm happy I did."

The Path to Intelligence

Related Links:

Share your thoughts!