PROTECT YOUR SECTOR: THE IMPORTANCE OF THREAT SHARING

What Is Threat Sharing?

Essentially, threat intelligence is the compiled data that can be circulated with the aim of boosting protection against a particular attack on a current or evolving cyber threat. Security analysis offers vital insight around a threat behavior, including Indicators of Compromise (IoC), Indicators of Attack (IoA), the strategies used, and, theoretically, the attacker’s motives and personality, while going beyond IP addresses, hashes, and other key threat identifiers. Cybersecurity experts help clients quickly detect and avoid attacks, leveraging leadership skills within the threat information sharing network and through creating tools to communicate and use threat intelligence more effectively.

Cyberattacks have grown exponentially in terms of frequency and complexity, posing major obstacles for companies that must protect their data and infrastructure from powerful threat actors. Working as part of a criminal organization or on behalf of a nation-state, these perpetrators range from lone-wolf attackers to well-resourced and funded organizations acting in a coordinated way.

It’s true that many employees — especially in the public sector — remain ill-informed when it comes to data security. However, even the best-prepared business can fall victim to malware if they are not made aware of threats as they occur. Even if your company has excellent data protection protocols in place, zero-day exploits remain a huge problem.

Threat information sharing allows access to threat data that may otherwise be inaccessible to an enterprise. Organizations may strengthen their security posture through the use of common assets by proactively incorporating their partners’ expertise and skills. Allowing the identification of one entity to become the avoidance of another is a valuable strategy that can advance the overall defense of organizations that regularly exchange threat data.

What Are Threat Groups?

Advanced persistent threat (APT) groups, like all attackers, attempt to steal information, interrupt processes, or damage facilities. APT offenders, unlike most cyber criminals, need months or years to achieve their targets. They respond to cyber defenses and retarget the same victim on a daily basis.

What Is the Threat Intelligence Sharing Framework?

The aim of the Threat Intelligence Sharing Framework is to identify the existing processes for enabling the flow of threat information between and among all organizations engaged in the critical infrastructure protection and resilience mission, as well as to provide an overview of the main threat information-sharing entities that help with this. The aim is to help owners and administrators of vital facilities, as well as other organizations, better understand when and how to receive and exchange vulnerability information with information-sharing hubs.

The U.S. government has sought to enhance standardized knowledge exchange across various fields and cultures since the September 11, 2001 attacks. Despite the fact that this approach is targeted at the vital infrastructure sector, it acknowledges that knowledge exchange mechanisms are multidisciplinary.

This Framework does not present new legislation and focuses on current authorities, procedures, regulations, plans, and activities that identify the functions and obligations of Federal departments and agencies, as well as the other institutions in the critical infrastructure sector, which share vulnerability information.

The scope of this system is restricted to vulnerability intelligence exchange relating to man-made risks to critical infrastructure, covering both cyber and physical threats. Owners and operators in some industries, such as chemical, nuclear, healthcare, and public health, are required by law to report incidents to their regulators. These specifications are not discussed in this Framework.

The goal of this system is to improve the exchange of reliable, actionable, timely, and appropriate vulnerability information between and within the Federal Government, essential infrastructure owners and operators, and other agencies. Such sharing improves situational awareness, allows risk-informed decision-making, and thus improves the stability of vital infrastructure in the U.S.

Top Threat Types

Because of their limited scale and lack of valuable records, many people assume that small companies are rarely attacked by hackers. Some information stored on your systems, though, may be of interest to offenders. Here are the top five cyber threats you should be aware of right now.

1. Ransomware: This is a form of malware (malicious software) that encrypts (scrambles) your data and then requests a ransom in return for a key to decrypt it. The majority of ransomware is distributed via malicious emails.
2. Phishing: Phishing is an attempt to access confidential information by impersonating a reliable contact, such as a bank or an online service. Spear phishing is a highly focused effort to collect information from a person. Phishing emails will seem absolutely authentic to the target, with perfect language and real logos. Whaling is a form of spear phishing in which a bogus email from a CEO puts pressure on a CFO to make an immediate payment. It’s worth worrying about how to incorporate more protections to secure CEO and CFO identities from impersonation.
3. Data leakage: Although office cyber protection can seem daunting, it is important to note that security nowadays stretches well beyond the office. Smart phones and tablets are becoming increasingly popular. Portable storage devices are a valuable method for data backup and transportation due to their universal availability and low cost. Because of these attributes, they are also a target for data pirates.
4. Insider moles: When a company hires employees (full-time or contract), there’s always a risk they’ll spill data accidentally or maliciously. The implications of a record breach should not be underestimated.
5. Hacking: Criminals can also make a killing by getting access to an organization’s IT systems from the outside. They’ve managed to get access to bank account records or credit card databases in the past. Intellectual property, on the other hand, is a valued commodity. Social engineering, which entails tricking workers into exposing usernames and passwords, is also a threat.

What Is CybOX?

Cyber Observable Speech (CybOX) is a structured language for communicating and transmitting some observable and notable occurrence or property in the cyber domain. This can be thought of as a more advanced way of using a Structured Query Language (SQL) to handle all Relational Database Transactions. All standard products based on Relational Databases may use the same SQL format, allowing information to be exchanged between various intelligence systems or products.

CybOX may assist in the sharing of high-fidelity data regarding cyber observables (such as stateful steps, complex incidents, and so on) between various cybersecurity systems. Threat assessment, ransomware characterization, tactical event detection, event recording, incident resolution, cyber forensics, and situational awareness are just some of the cybersecurity practices that CybOX may assist with.

Importance of Threat Sharing

In business, there is always a tendency to view your peers as competitors. That can be useful — after all, you are in competition with them — but when it comes to cybersecurity, this can have some unfortunate consequences.

If companies do not share their experiences of cyberattacks, they leave the rest of their sector open to attack. Not only are cyber criminals able to perform essentially the same attack on many companies in turn, but each company has to learn to respond to different threats on its own. This system hurts the profitability of sectors as a whole and is hugely inefficient.

In addition, even large companies cannot typically retain a knowledge base that is sufficient to protect all of the systems they use. If you employ systems from many different vendors in deeply interconnected ways, you cannot be expected to know everything about each part. This is one of the reasons why complex networks are getting harder to secure, but it also points to the importance of threat sharing.

The easiest way to share your experiences of cyberattacks is to use one of the many systems available for this. There are plenty of Information Sharing and Analysis Organizations (ISAO) which cover individual sectors and allow both companies and state agencies to pool their resources.

Other useful tools when it comes to information exchange are industry events and symposia. Whichever sector you are in, you probably send employees to trade shows, but perhaps you haven’t considered the advantages of these when it comes to cybersecurity. These events can promote knowledge sharing and exchange, and be the first step towards your industry, building a united front against cyber criminals.

What Is Malware Information Sharing Platform (MISP)?

Malware Information Sharing Platform (MISP) is an open-source platform developed by a team of developers from CIRCL, Belgian Security, NATO, and NCIRC that enables sharing, saving, and correlating of Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, and even counter-terrorism information.

MISP supports defence departments in ingesting and reviewing vulnerability data on detected ransomware threats, as well as generating and storing data in a standardized format. MISP also assists in the development of network intrusion detection system (NIDS) guidelines and allows for the exchange of malware data with third parties. MISP, to put it another way, aims to develop a trust platform by storing vulnerability information locally and improving malware detection to enable information sharing among organizations.

Vulnerability vs. Sharing

There is a balance to be struck between protecting your own security and ensuring the resilience of your sector.

You should not, for instance, immediately publicize every minor attack that you experience. Not only does this undermine trust in your business, but it also represents a security threat in itself. According to a recent analysis published by Gary Stevens, CISO at HostingCanada.org, “You wouldn’t want your web host to announce every security hole in their operation immediately: doing that is an invitation for cyber criminals to take advantage of them.”

Because of this, your first priority during a cyberattack should be to avoid damage to your organization. Then, you can address the vulnerability that led to the attack. Then, and only then, should you share your experience.

Sharing your experience need not just be of benefit to your competitors. In fact, if you build threat sharing into broader threat detection and avoidance systems, a post-mortem analysis of what went wrong can be a powerful learning experience for your own employees. Sharing this analysis with your peers not only protects them but also cements your reputation as a leader when it comes to security.

It may well be that once your competitors see how well you’ve responded to malware attacks, they seek to consult your company on these issues. This can be a lucrative source of extra income and turn a potentially disastrous attack into a business opportunity.

Conclusion

Cybersecurity, contrary to popular belief, is often not about avoiding attacks. Rather, the best organizations are those that recognize that it is inevitable to become the victim of an attack one day and are proactive in planning for this.

This can involve sharing compliance processes with other companies in your sector, or merely staying on top of your threat profile by checking for recent cyberattacks. Ultimately, your goal should be to turn every cybersecurity incident into an opportunity to improve your resilience through threat sharing.

Everyone benefits when you can share this knowledge with the wider community.