Proof-of-Concept for a Granular Incident Management Information Sharing Scheme

Abstract

Trust is a key ingredient in collaboration between security operations centers (SOCs). The collaboration can enhance defense and preparedness against cyberattacks, but it is also important to limit the attacker's ability to infer their potential for success from the communication between SOCs. This paper presents a proof-of-concept for a granular information sharing scheme. The information about a security incident is encrypted and the SOCs can decide with great precision which users or user groups can access it. The information is presented in a web-based dasboard visualization, and a user can communicate with other SOCs in order to access relevant incident information.