Leveraging cyber threat intelligence for a dynamic risk framework

Abstract

One of the most important goals in an organization is to have risks under an acceptance level along the time. All organizations are exposed to real-time security threats that could have an impact on their risk exposure levels harming the entire organization, their customers and their reputation. New emerging techniques, tactics and procedures (TTP) which remain undetected, the complexity and decentralization of organization assets, the great number of vulnerabilities proportional to the number of new type of devices (IoT) or still the high number of false positives, are only some examples of real risks for any organization. Risk management frameworks are not integrated and automated with near real-time (NRT) risk-related cybersecurity threat intelligence (CTI) information. The contribution of this paper is an integrated architecture based on the Web Ontology Language (OWL), a semantic reasoner and the use of Semantic Web Rule Language (SWRL) to approach a Dynamic Risk Assessment and Management (DRA/DRM) framework at all levels (operational, tactic and strategic). To enable such a dynamic, NRT and more realistic risk assessment and management processes, we created a new semantic version of STIX™v2.0 for cyber threat intelligence as it is becoming a de facto standard for structured threat information exchange. We selected an international leading organization in cybersecurity to demonstrate new dynamic ways to support decision making at all levels while being under attack. Semantic reasoners could be our ideal partners to fight against threats having risks under control along the time, for that, they need to understand the data. Our proposal uses an unprecedented mix of standards to cover all levels of a DRM and ensure easier adoption by users.

Cybersecurity threat intelligence knowledge exchange based on blockchain

“…It uses semantic variables in an OWL 2 version of STIX™v2 format, to support complex representations with more expressivity. Rules are provided in the format of semantic rule language rules (SWRL 3 ), as proposed by Riesco et al [9]. The use of ontologies, by definition, enables the interoperability and unambiguity of concepts.…”

Measuring and visualizing cyber threat intelligence quality

“…1, we can think of a power plant operating a state-of-the-art security operations center (SOC). At some point in time, the alerting mechanisms 2 https://www.json.org/. of the plant's intrusion detection systems (IDS) indicate an ongoing attack affecting various critical systems.…”

“…The last years have seen the emergence of sharing information about threats, cyber attacks, and incidents by organizations. The urge to join forces in the fight against cyber criminals originates from an ever-increasing number of attacks and the related risks for organizations [1,2]. Not only the number but also the complexity of attacks has increased over the years resulting in successful intrusions with more severe forms of security breaches.…”

Ontology-Based System for Dynamic Risk Management in Administrative Domains

“…Analyzing and sharing information obtained through TI in an effective manner requires common representation, standards, and exchange protocols. Again, the use of ontologies arises as an interesting approach to address this problem, and therefore, several authors have carried out studies and developments in this sense [12][13][14][15][16].…”

“…as a very interesting contribution, for example, to the verification of the impact of supplier change. Most recently, Riesco R. et al proposed in [15] a new dynamic risk management and threat intelligence methodology for generating inference rules to be used in different application domains. The feasibility of this research was addressed in [16], where the authors proposed blockchain and Smart contracts as a solution for fostering cyber threat and risk intelligence exchange of information.…”