How do you collaborate and share CTI with other organizations and sectors?

1 CTI Sharing Models

Different models of CTI sharing exist, depending on the type, level, and scope of the information, as well as the trust and relationship among participants. These models include bilateral exchanges between two organizations that have a mutual interest in the same threat or incident, multilateral exchanges between multiple organizations within the same sector or region, and cross-sectoral exchanges between organizations from different sectors or regions that have overlapping or complementary interests. For example, banks may share CTI about a phishing campaign targeting their customers, a sector-specific ISAC may facilitate CTI sharing among its members, and an ISAO may enable the sharing of CTI among critical infrastructure providers, government agencies, and academic institutions.

2 CTI Sharing Standards and Formats

In order to facilitate collaboration and sharing of CTI, it is essential to use common standards and formats that enable the interoperability, consistency, and quality of the information. Structured Threat Information Expression (STIX) is a standardized language for expressing and exchanging CTI in a machine-readable and human-readable way. STIX defines different objects related to CTI, such as indicators, tactics, techniques, procedures, campaigns, incidents, and threat actors. Additionally, Trusted Automated Exchange of Intelligence Information (TAXII) is a standardized protocol for transporting and exchanging CTI over the internet. TAXII defines methods, services, and messages for requesting, sending, receiving, and subscribing to CTI using STIX. Cyber Observable Expression (CybOX) is another standardized language for describing and characterizing cyber observables such as files, processes, network connections, and registry keys. CybOX is used as part of STIX to represent the observable elements of CTI.

3 CTI Sharing Platforms and Tools

To facilitate collaboration and the sharing of CTI, there are various platforms and tools available. Threat Intelligence Platforms (TIPs) are software applications that aggregate, correlate, enrich, and manage CTI from multiple sources. Threat Intelligence Sharing Platforms (TISPs) are online platforms that enable the secure exchange of CTI among trusted groups, such as ISACs or ISAOs. Additionally, Threat Intelligence Analysis Tools can help users analyze, visualize, and understand CTI from various sources. For instance, Maltego can map out the relationships between different CTI objects like domains, IP addresses, emails, and threat actors.

4 CTI Sharing Benefits and Challenges

Collaborating and sharing CTI with other organizations and sectors can bring many benefits, such as enhancing situational awareness, improving detection and response capabilities, and reducing costs and resources. However, there are challenges to consider, such as establishing trust and governance, balancing timeliness and quality, and overcoming technical and operational barriers. To effectively share CTI, organizations need to define the roles, responsibilities, expectations, and obligations of the participants. They must also ensure that the information is relevant, accurate, complete, and actionable for the intended recipients. Additionally, they should strive to make shared platforms, tools, standards, and formats interoperable, compatible, and usable.

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?