How do you share threat intelligence with other analysts?

What is important is that Threat Intelligence is used to make informed decisions in defense. Therefore, when intelligence becomes "public," such as in a blog post, the details and information have already been disseminated through internal processes and trusted groups to protect customers and assets. In many cases, intelligence is not even made publicly available. However, it's true that in some cases, "public threat intel" is used for marketing purposes.

Before sharing threat intelligence, it's vital to know your goals and audience. Are you informing, alerting, or advising? Is it for a specific group or a broader community? Human or Machine-readable? Using the Traffic Light Protocol (TLP) can make this easier, as its color-coded system helps ensure information is shared with the right people. Define your objectives first, and let TLP guide the sharing process, aligning your message with the intended recipients.

Threat intelligence is a structured and constant process for collecting and analyzing the data which can cause potential cybersecurity threat and risk to the organization. The analysis is generally performed based on mentioned vectors but not limited to, i.e. likelihood, complexity, vulnerabilities, exposure, threat actors (internal & external). It provides insights to organization which helps them to prioritize remediation, early threat detection, enhancing security strategies to improve organization's entire security framework. To maintain the effectiveness of it, few pointers can be considered i.e. 1. Rich Data collection 2. Automation 3. Machine learning 4. Risk assessment 5. Training and Feedback loop

It is essential for collecting defence against cyber threats and enhancing overall cyber security. Sharing effectively threat intelligence helps others to stay ahead of evolving threats and make more informed decisions. Below are some steps for sharing threat intelligence with other analyst: 1. Select a secure platform 2. Ensure data privacy and compliance 3. Establish clear objectives 4. Maintain timelines 5. Establish trust relationship 6. Standardize data formats 7. Stay up-to-date 8. Education and training 9. Legal and ethical considerations. 10. Stay informed

TLP:CLEAR URL CredPhish to UrlScan; TLP:CLEAR as IPv4:Port or FQDN C2 to ThreatFox; TLP:CLEAR as URL Stages from Loaders to URLHaus; TLP:CLEAR Samples to VT, HA, and sometimes MalwareBazaar; if you have something TLP:AMBER to share, just make a YARA rule and post it up on Malpedia along with the TLP:AMBER samples

It is very important the anticipated "intelligence" are verified and validated before sharing with wider audience. There should be a mechanism where proposed indicators of compromise can be confirmed as authentic and realistic. There are a lot of false alarms generated, and we should priorities our efforts to address threat that really matters.

Choosing sources has always been a tightrope walk. I've been in situations where relying heavily on a single source led to skewed analysis. Diversifying and cross-verifying became my mantra, saving me from potential pitfalls more than once.

Collect Relevant Information: Gather all relevant information about the threat. This could include indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), malware samples, network traffic patterns, and any other relevant data. Normalize and Standardize: Ensure that the threat intelligence is normalized and standardized according to established formats and protocols, such as STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Indicator Information).

Absolutely, the quality of threat intelligence is highly dependent on the credibility and variety of the sources used. Utilizing multiple types of sources like OSINT, CSINT, and HUMINT allows for cross-verification and lends greater reliability to the intelligence. Properly evaluating and citing these sources not only avoids the spread of misinformation but also enhances one's reputation as a credible and trusted analyst.

Agree. However, human intelligence needs to be defined. For example. A representative of security vendor X is quoted in an open-source article, which provides additional information not contained in that vendor's formal product. Is that "open-source" or a secondary HUMINT source? (Secondary as you have not directly spoken to them).

Sharing threat intelligence comes with the responsibility to safeguard sensitive or confidential data. The potential risks include compromising your own security infrastructure and harming partners or stakeholders. To mitigate these risks, it's crucial to employ encryption, anonymization, and data classification techniques. Adhering to principles like data minimization and data protection by design ensures that you share only what is necessary, thereby maintaining trust and integrity while still contributing valuable insights to the community.

Yes data protection is critical to assessing threats from within and externally. However, with the IOT, there’s been an explosion of data, in the United States, is like years behind Europe, in terms of enforcing, or even establishing data protection laws. In addition., Folks are a little bit more concerned.

Depends on what you're sharing and with whom. If you're sharing indicators that you've seen against you're perimeter, a quick at time/date, traffic from X IP address/domain/URL associated with threat Y was seen, and your assessment was it was vulnerability scanning. Share it publicly. Otherwise, yes, anonymise the data. Plenty of vendors have shared plenty of details, including file paths, with sensitive data redacted from incidents they've responded to. Encryption is dramatic, pending certain circumstances.

Sharing is caring but it should be done carefully to avoid the risk of exposing the confidential data or PII/SPI. It is essential to define scope and be aware, be able to manage any risk as an outcome of sharing threat intelligence. As we see that many regulation are there across globe i.e. GDPR, HIPAA, sharing information can cause regulatory issues. we can adhere few points while sharing threat intelligence data i.e. Data Anonymization, transmission of information through encrypted means only, limited recipient, privacy and legal checks, incident response and most importantly security awareness training.

The platform used for sharing threat intelligence can greatly influence its effectiveness. Depending on your objectives and audience, different platforms like email, web portals, or social media may be more suitable. While direct methods like email or phone are useful for time-sensitive communication, blogs and podcasts allow for a broader distribution. Security, privacy, and reliability are critical factors to consider in choosing a platform, as well as compliance with any platform-specific guidelines and policies.

When sharing sensitive or industry-specific threat intelligence, consider providing your data to a national entity such as the Federal Bureau of Investigation (FBI) or Cybersecurity and Infrastructure Agency (CISA) in the US, your national Computer Emergency Response Team (CERT, ex: US-CERT, AusCERT, NCIC, etc), or an industry-specific Information Sharing and Analysis Center (ISAC, ex: E-ISAC, FS-ISCA, ONG-ISAC, etc.)

Sharing is caring, and it's important to help grow the professional field, nevertheless it's important to take in account the content of your post in any platform. Do not share specific context or situation that might lead to identify a person, a company you work or worked for or any other confidential data.

The efficacy of threat intelligence can be significantly impacted by the medium employed for its dissemination. Whether you should use email, web portals, or social media to reach your audience and achieve your goals will depend on both. Blogs and podcasts enable a wider distribution, while direct channels like email and phone are helpful for time-sensitive communication. When deciding on a platform, it's important to think about how secure, private, and reliable it is, as well as how well it conforms to the platform's own policies and guidelines.

Podcasts are too much for me. They are usually too long and filled with a lot of white noise. Otherwise, the rest are great options.

A combination of all options will reach the widest audience. I've embedded videos and interactive images with some of my products. Fonts, grammar, spelling and presentation count for more than people give credit for determining whether your product is engaging. If a product is incoherent or poorly worded, I'm not reading it.

The format in which you present threat intelligence can have a significant impact on how effectively it is received and utilized. Text, images, or videos may be suitable for explanatory purposes, while tables and charts can help in visualizing trends and patterns. Using established standards like STIX, TAXII, or MISP helps in ensuring compatibility and ease of exchange. It's important to consider not just what you are conveying, but how easily it can be understood, used, and scaled, adhering to best practices for each format used.

In an effort to better prevent and mitigate cyber-attacks, standards such as STIX and TAXII have been developed. While TAXII specifies "how" threat intelligence is communicated, STIX lays out "what" threat intelligence is. STIX and TAXII are machine-readable and hence may be automated, unlike earlier ways of sharing. The goal of STIX/TAXII is to tighten security in several ways: Enhance the current capacity for exchanging information about potential dangers Combine reactive measures with preventative monitoring Prompt a comprehensive method of gathering threat information

Sharing is Caring, But Avoid Oversharing. In my early days as a cybersecurity analyst, I equated sharing data with adding value. However, during a threat intelligence sharing session, a seasoned colleague highlighted the potential risks of "data dumping." Oversharing can easily cloud essential signals with unnecessary noise, compromising the efficacy of shared intelligence. One vivid instance: a team shared detailed logs without vetting, inadvertently including sensitive customer data. Not only did this raise privacy concerns, but it also sidetracked analysts who had to sift through the extraneous details. It was a stark reminder: while sharing intelligence is crucial in a collaborative cyber defense, it's equally vital to be discerning.

Sharing threat intelligence with other analysts is crucial in collaborating and strengthening the collective defense against cyber threats. Here are some effective methods to share threat intelligence: 1. Email Lists and Mailing Lists 2. Secure Collaboration Platforms 3. Threat Intelligence Platforms (TIP) 4. Information Sharing and Analysis Centers (ISACs) 5. Information Sharing Forums and Groups 6. Private Sharing Networks 7. Structured Threat Intelligence Exchange Formats 8. Incident Response Exercises Remember, when sharing threat intelligence, always consider privacy, legal, and compliance aspects to ensure sensitive information is shared only with authorized parties and in a secure manner.

The interaction and relationships between OSINT, HUMINT, abd artificial intelligence is an important juncture in the current climate as they have strong influences on one another but also opens the gates to lots of misinformation and exaggerated details, or lack thereof. Currently we are in a dynamic field of development in this regard, and the lines between AI generated information and human intelligence is becoming more and more blurry. Thus the need for continuous verification processes become ever important.