Cyber Threat Intelligence (CTI) sharing has become a novel weapon in the arsenal of cyber defenders to proactively mitigate increasing cyber attacks. Automating the process of CTI sharing, and even the basic consumption, has raised new challenges for researchers and practitioners. This extensive literature survey explores the current state-of-the-art and approaches different problem areas of interest pertaining to the larger field of sharing cyber threat intelligence. The motivation for this research stems from the recent emergence of sharing cyber threat intelligence and the involved challenges of automating its processes. This work comprises a considerable amount of articles from academic and gray literature, and focuses on technical and non-technical challenges. Moreover, the findings reveal which topics were widely discussed, and hence considered relevant by the authors and cyber threat intelligence sharing communities.
Cyber threat intelligence sharing has become a focal point for many organizations to improve resilience against cyberattacks. The objective lies in sharing relevant information achieved through automating as many processes as possible without losing control or compromising security. The intelligence may be crowdsourced from decentralized stakeholders to collect and enrich existing information. Trust is an attribute of actionable cyber threat intelligence that has to be established between stakeholders. Sharing information about vulnerabilities requires a high level of trust because of the sensitive information. Some threat intelligence platforms/providers support trust establishment through internal vetting processes; others rely on stakeholders to manually build up trust. The latter may reduce the amount of intelligence sources. This work presents a novel trust taxonomy to establish a trusted threat sharing environment. 30 popular threat intelligence platforms/providers were analyzed and compared regarding trust functionalities. Trust taxonomies were analyzed and compared. Illustrative case studies were developed and analyzed applying our trust taxonomy.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.