Towards Better Understanding of Cyber Security Information Sharing

Abstract

There is an increased recognition of the importance of information sharing within cyber security. Nevertheless, and despite the widespread use of the term "information sharing", it is difficult to associate a precise meaning with it -not least because it is used to describe a range of different activities that are driven by a variety of goals. Furthermore, when it comes to distinguishing between the various forms of information-sharing efforts, there is evidence of a degree of inconsistency between stakeholders. In this paper we seek to understand the various definitions of cyber security information sharing; we also seek to develop a better categorisation of its different forms. In addition, we try to assess the extent to which practitioners are willing to engage in each of the derived categories. A literature review, combined with an online survey, were used to capture stakeholders' perspectives. We analyse the data with a view to establishing a more nuanced conceptualisation of information sharing. The hope is that our findings will have the potential to serve as a basis for future studies.

Sharing Is Caring: Hurdles and Prospects of Open, Crowd-Sourced Cyber Threat Intelligence

“…Furthermore, this is closely related to the perception that most participants will consume CTI and only a few will contribute, creating a free-riding effect or a "forward paying" attitude where participants share only if others do [19], [25]. There is clearly a network effect, similar to the well-known Metcalfe's law of networks, where the value of a network is quadratic with the number of participants.…”

“…The issues raised seem mostly perceptional and compound the overall issues this section overviews, such as legal liability, lack of open platforms, etc. Other factors exist that are associated with lack of scale and difficulty in operationalizing CTI as "a product" [18]-examples are the cost to run a CTI team [19] and the lack of professional skills [8], [19]. A further challenge is operationalizing CTI to effective and practical measures [6], [8], [10], [20], often connected to the quality of the information shared or how to integrate a CTI function transversally in an organization, e.g., CTI as a (internal) service [21].…”

“…This ties to a second factor: managing competitors. Despite an open, collaborative approach to CTI being accepted to be of benefit to the whole community [24], it has been shown [19] that organizations generating CTI are conscious about what they share. They are willing to share simple indicators of compromise (IoC) (e.g., malware hashes), but less willing to share more complex defense strategies as they may give away a competitive advantage to competitors.…”

“…6) Confidentiality Risks: Confidentiality risks are usually the top concern and reason for not sharing [5], [6], [7], [9], [17], [19], [25], [26], [29], [36], [37], even if at times under the umbrella of trust, regulatory compliance, or market factors, as discussed. As has been identified (e.g., [9], [25]), this is often an inconsequential perception effect that quickly becomes unimportant.…”

“…On the one hand, there are straightforward sources, such as IP addresses deemed malicious; on the other hand, there are highly complex and abstract behaviors, such as multistep tactics observed in APTs. We note that CTI can range in, broadly speaking, operational, tactical, or strategic [19], [73], and it can either be directed-identifying threats to a specific organization [74]-, or undirected (the most common case).…”