In Whom Do We Trust - Sharing Security Events

Abstract

Abstract. Security event sharing is deemed of critical importance to counteract large-scale attacks at Internet service provider (ISP) networks as these attacks have become larger, more sophisticated and frequent. On the one hand, security event sharing is regarded to speed up organization's mitigation and response capabilities. On the other hand, it is currently done on an ad-hoc basis via email, member calls or in personal meetings only under the premise that participating partners are personally known to each other. As a consequence, mitigation and response actions are delayed and thus security events are not processed in time. One approach to reduce this delay and the time for manual processing is to disseminate security events among trusted partners. However, exchanging security events and semi-automatically deploying mitigation is currently not well established as a result of two shortcomings. First, the personal knowledge of each sharing partner to develop trust does not scale very well. Second, current exchange formats and protocols often are not able to use security mechanisms (e.g., encryption and signature) to ensure both confidentiality and integrity of the security event information and its remediation. The goal of this paper is to present a trust model that determines a trust and a knowledge level of a security event in order to deploy semi-automated remediations and facilitate the dissemination of security event information using the exchange format FLEX in the context of ISPs. We show that this trust model is scalable and helps to build a trust community in order to share information about threats and its remediation suggestions.

Sharing Is Caring: Hurdles and Prospects of Open, Crowd-Sourced Cyber Threat Intelligence

“…Literature seems to indicate that trust is not a true requirement; furthermore, it is either "mostly neglected" [9] or is a soft barrier that is quickly ignored as long as there is confidentiality [25]. The term trust may also mean that information can be trustworthy and actual, rather than low-quality copies or not actionable or useful [33] (see Section II-C4. Trust may also mean that there is good faith in terms of the ratio sharing/consuming [5], [10], which is simply the "free-riding" problem discussed.…”

“…Essentially, reputation is a graph of relationships G = (V, E), where edges E can have only a few values which are, typically, trusted, nontrusted, marginal. The full graph of trust then takes advantage of trilateral A − B − C relationships to derive trust for any arbitrary node e ∈ E. Steinberger et al [33] propose MiRTrust that mirrors this approach by locally updating trust in sources (from the trust graph) as CTI information is confirmed or invalidated and broadcast to adjacent members. This approach is similar to what others call Traffic Light Protocol which is used, for example, in the U.K.'s CiSP platform, where a green light means encouragement to share anything as the trust level is high [25].…”

Report on the 10th International Conference on Autonomous Infrastructure, Management, and Security (AIMS 2016)

“…The program included papers with a high technical expertise, such as ''Analysis and Evaluation of OpenFlow Message Usage for Security Applications'' by Sebastian Seeber [7], which describes mitigation and defense mechanisms that are currently used in SDN 3 environments, analyzes their dependencies with respect to OpenFlow messages, and quantifies their performances with different implementations. It also covered papers related to high level methodologies, such as ''In Whom Do We Trust-Sharing Security Events'' by Jessica Steinberger [8], which specifies a trust model for security events in order to deploy semi-automated remediations and facilitate the dissemination of security event information, using the exchange format FLEX 4 in the context of ISPs. 5 The best paper award went to ''Cloud Flat Rates Enabled via Fair Multi-resource Consumption'' by Patrick Poullie and Burkhard Stiller (University of Zürich-Switzerland) [9], which proposes a fair multi-resource cloud sharing approach, and shows its enforcement to enable cloud flat rates.…”