Rethinking information sharing for threat intelligence

Abstract

In the past decade, the information security and threat landscape has grown significantly making it difficult for a single defender to defend against all attacks at the same time. This called for introducing information sharing, a paradigm in which threat indicators are shared in a community of trust to facilitate defenses. Standards for representation, exchange, and consumption of indicators are proposed in the literature, although various issues are undermined. In this paper, we rethink information sharing for actionable intelligence, by highlighting various issues that deserve further exploration. We argue that information sharing can benefit from welldefined use models, threat models, well-understood risk by measurement and robust scoring, well-understood and preserved privacy and quality of indicators and robust mechanism to avoid free riding behavior of selfish agent. We call for using the differential nature of data and community structures for optimizing sharing.

Cyber threat intelligence sharing: Survey and research directions

“…Internal information may include e-mail addresses, names, and other PII. CTI that was intercepted by an adversary could be used to attack stakeholders who have not yet patched their system [50,51]. Every shared information should have a risk calculation according to its sensitivity and impact.…”

“…The Quality may be evaluated by the correctness, relevance, timeliness, usefulness, and uniqueness [50]. Furthermore, a member of the CTI sharing community who has always shared useful and timely information may be labeled as a quality stakeholder [51].…”

DEALER: decentralized incentives for threat intelligence reporting and exchange

“…Dandurand et al [13] defined requirements for the exchange of information, emphasizing the necessity of assuring data integrity and availability, which is also supported by the work of Brown et al [14]. Mohaisen et al pointed out various open research questions in that field, such as possible dangers and negative incentives that may relate to the exchange of CTI [15]. In addition to this, there are also works that deal with specific implementations of CTI platforms, such as the MISP platform by Wagner et al [8].…”

Handling of advanced persistent threats and complex incidents in healthcare, transportation and energy ICT infrastructures

“…Another example is presented in De Fuentes et al (2016), which proposes a protocol that provides privacy-preserving and agreeable cybersecurity information sharing, by leveraging existing format-preserving and homomorphic encryption techniques and adapting them to the particularities of standard message formats, such as the previous mentioned STIX. Finally, issues associated to the realization of an efficient and effective information sharing paradigms for actionable intelligence have been studied, focusing also on architectural solutions for ensuring privacy, considering many different standards for representing cyber threat information (Mohaisen et al 2017).…”