Threat information-sharing first started getting more attention and interest in the cybersecurity industry after the 9/11 terror attacks.
So you’d think by now it would be a routine process, especially with the volume of high-profile data breaches in the past few years. But while there has been much progress between the federal government and the vertical flavors of the Information Sharing Analysis Centers (ISACs), threat information-sharing still has been put on the back burner by many organizations.
“What’s happened is that CISOs are so busy today that information sharing has become the kind of thing that they know will make them a better CISO, or at least a better person, but they put it off,” says Paul Kurtz, founder and CEO of TruStar Technology. “They don’t always recognize the benefits of information sharing.”
Kurtz says the key principles of threat information-sharing are:
1. Information sharing is not altruistic. The objective of data exchange is to identify problems more quickly and mitigate attacks faster. When an industry vertical shares common threat data and other companies in the field don’t have to reinvent the wheel, everyone benefits.
2. Information sharing is also not about breach notification. Organizations need to share event data early in the security cycle – before an event happens – such as information about suspicious activity.
3. Sharing data with other organizations about exploits and vulnerabilities is legal so long as you don’t share personally identifiable information. For example, a victim’s email address is usually not shared. Typical types of information that are fair game include suspicious URLs, hash tags, and IP addresses. The Cybersecurity Information Sharing Act of 2015 provides more detail here.
4. The sharing system must be easy to use. Make sure the system is user-friendly and can easily integrate with your established workflow within a SOC, a hunting team, or a fraud investigation unit.
Neal Dennis, a senior ISAC analyst at the Retail Cyber Intelligence Sharing Center (R-CISC), says companies that don’t know where to start or don’t have deep pockets for security tools should contact their industry ISAC. “A lot of our members are smaller retail companies that don’t have the resources of a Target or Home Depot, so it makes sense for them to seek of the retail ISAC for threat information and guidance on potential tools to deploy,” Dennis says.
Read the full article and tips on how to get started with sharing threat intelligence at Dark Reading.
Source: Dark Reading