An architecture for privacy-preserving sharing of CTI with 3^rd party analysis services

Abstract

Abstract-Increasing numbers of Small and Medium Enterprises (SME) are outsourcing or hosting their services on different Cloud Service Providers (CSP). They are also using different security services from these CSPs such as firewalls, intrusion detection/prevention systems and anti-malware. Although for the SMEs the main purpose of using these security services is to protect their cyber assets, either physical or virtual, from security threats and compromises, a very useful and valuable by-product of these security services is the wealth of Cyber Threat Information (CTI) that is collected over time. However, a common problem faced by SMEs is that they lack the resources and expertise for monitoring, analysing and reacting to any security notifications, alerts or events generated by the security services they have subscribed to. An obvious solution to this problem is that the SMEs outsource this problem to a cloud based service as well, by sharing their CTI with this service and allowing it to analyse the information and generate actionable reports or patches. The more CTI obtained from different SMEs, the better the analysis result. In this paper, we try to address some of the privacy and confidentiality issues that arise as a result of different SMEs sharing their CTI with such a third party analysis service for the aggregate analysis scenario we just described. We present the design and architecture of our solution that aims to allow SMEs to perform policy-based sharing of CTI, while also offering them flexible privacy and confidentiality controls.

Data Sanitisation and Redaction for Cyber Threat Intelligence Sharing Platforms

“…In [11] and [12], security analysis of CTI sharing with third party analysis platforms over cloud are presented. Both studies address the studies conducted towards this aim in the EU project of Collaborative and Confidential Information Sharing and Analysis for Cyber Protection (C3ISP).…”

Trust and Quality Computation for Cyber Threat Intelligence Sharing Platforms

“…The quality of data of the shared feeds can be seen as a vector compiled by the criteria of timeliness, accuracy, scope, relevance and completeness are used in references [9], [10] to measure the quality of the data and further evaluate the available threat intelligent feeds. In [11], a threat score function is introduced to evaluate Indicators of Compromise (IoC) collected from various sources in order to support Security Operations Centre (SOC) analysts prioritise the incidents' analysis.…”

“…In [11], a threat score function is introduced to evaluate Indicators of Compromise (IoC) collected from various sources in order to support Security Operations Centre (SOC) analysts prioritise the incidents' analysis. Another study [10] investigates the data quality dimensions of IoCs which are collected by several open sources in order to assess their effectiveness.…”

Cyber Security Threats and Challenges in Collaborative Mixed-Reality

“…Collaboration platforms are not limited to meetings or learning, and often aid users to achieve a common goal. Examples exist in the Intrusion Detection System (IDS) community, which has examined Collaborative Intrusion Detection Systems (CIDSs) for sharing Cyber Threat Intelligence (CTI) across different platforms (see Wagner et al, 2016;Giubilo et al, 2017;Happa, 2017;Nair et al, 2018). While these are driven by automation in sending event logs, the importance of making good use of the combination of automation and human analysts cognition cannot be understated.…”