A Shared Cyber Threat Intelligence Solution for SMEs

Abstract

Small- and medium-sized enterprises (SMEs) frequently experience cyberattacks, but often do not have the means to counter these attacks. Therefore, cybersecurity researchers and practitioners need to aid SMEs in their defence against cyber threats. Research has shown that SMEs require solutions that are automated and adapted to their context. In recent years, we have seen a surge in initiatives to share cyber threat intelligence (CTI) to improve collective cybersecurity resilience. Shared CTI has the potential to answer the SME call for automated and adaptable solutions. Sadly, as we demonstrate in this paper, current shared intelligence approaches scarcely address SME needs. We must investigate how shared CTI can be used to improve SME cybersecurity resilience. In this paper, we tackle this challenge using a systematic review to discover current state-of-the-art approaches to using shared CTI. We find that threat intelligence sharing platforms such as MISP have the potential to address SME needs, provided that the shared intelligence is turned into actionable insights. Based on this observation, we developed a prototype application that processes MISP data automatically, prioritises cybersecurity threats for SMEs, and provides SMEs with actionable recommendations tailored to their context. Subsequent evaluations in operational environments will help to improve our application, such that SMEs are enabled to thwart cyberattacks in future.

Methodological Framework to Collect, Process, Analyze and Visualize Cyber Threat Intelligence Data

“…Finally, Haastrecht et al [7] showed how small and medium size enterprises suffer from the lack of CTI tools and shared information. They created a CTI Feed that can provide these companies with actionable recommendations that are ordered by relevance and helped them avoid vulnerabilities and threats.…”

“…It is known that CTI must explore the collection while filtering, sharing and analyzing vulnerabilities in intel and threat data regardless of vendor, technology or source. For that, much research has been developed to address the collection and filtering of threat intelligence [4,5], as well as sharing and using that data to mitigate threats [6,7].…”

CYBER SECURITY IN SMALL AND MEDIUM ENTERPRISES (SMEs)

“…Typically, SMEs do not budget adequately for cybersecurity solutions such as purchasing products, services, and external consulting services. It is suggested that the government subsidise certain funding to assist SMEs in improving their cybersecurity posture, providing tools to reduce the cost of IT solutions based on effective procurement methods, and many other things (Tamyez, 2022;van Haastrecht et al, 2021). For example, after negotiation and consideration of authority, SMEs can subscribe to customised Service Legal Agreements (SLA) based on their size and suitability to fit SMEs cybersecurity needs.…”

BRIDGE: BRIDGing the gap bEtween CTI production and consumption

“…Other efforts focusing on the automatic collection and processing of can be found in the works of [13] and [14], where Indicators Of Compromise (IOCs) are extracted from the corresponding data. To both process and analyse the collected data, the authors of [15] propose a solution that processes Malware Information Sharing Platform (MISP) data automatically, prioritizes cybersecurity threats for Small and medium-sized enterprises (SMEs), and provides SMEs with actionable recommendations tailored to their context. On top of solutions like the ones mentioned above, in order to facilitate the automation of processes regarding the CTI, standardization efforts have been made.…”