PRACIS: Privacy-preserving and aggregatable cybersecurity information sharing

Abstract

Cooperative cyberdefense has been recognized as an essential strategy to fight against cyberattacks. Cybersecurity Information Sharing (CIS), especially about threats and incidents, is a key aspect in this regard. CIS provides members with an improved situational awareness to prepare for and respond to future cyberthreats. Privacy preservation is critical in this context, since organizations can be reluctant to share information otherwise. This is particularly critical when CIS is facilitated through an untrusted infrastructure provided by a third party (e.g., the cloud). Despite this, current data formats and protocols for CIS do not guarantee any form of privacy preservation to participants. In this paper we introduce PRACIS, a scheme for CIS networks that guarantees private data forwarding and aggregation. PRACIS leverages the well-known Structured Threat Information Expression (STIX) standard data format. Remarkably, PRACIS can be seamlessly integrated with existing STIX-based message brokering middleware such as publish-subscribe architectures. PRACIS achieves these goals by combining standard format-preserving and homomorphic encryption primitives. We discuss experimental results obtained with a prototype implementation developed for a subset of STIX. Results show that entities may create up to 689 incidents per minute, far beyond the estimated average of 81. Moreover, aggregation of 10 4 incidents can be carried out in just 2.1 seconds, and the transmission overhead is just 13.5 kbps. Overall, these results suggest that the costs incurred by PRACIS are easily affordable in real-world scenarios.

Threat intelligence platform for the energy sector

“…Cybersecurity IS is often presented as a primary instance of collaborative security . It relies on partners sharing with each other crucial incident–related knowledge including the descriptions of experienced disturbances, indicators of compromise, proposed remedies, and other security expertise.…”

“…It relies on partners sharing with each other crucial incident–related knowledge including the descriptions of experienced disturbances, indicators of compromise, proposed remedies, and other security expertise. The key aim of the information exchange is to enhance the organizations' SA to enable preparation for large‐scale incidents and future threats …”

“…To enable the effective exchange of cybersecurity information between heterogeneous actors, including not only individuals and organizations (eg, computer emergency response teams (CERTs) and ISACs) but also technical solutions (eg, intrusion detection and prevention systems and SIEMs), appropriate data models and formats are required . Over the last decade, multiple data specifications and standards have been developed.…”

“…Consequently, collaborative cybersecurity and cyberincident IS have been widely reflected in various initiatives . For instance, in response to the growing demand for European collaboration in protecting energy sectors, the European Energy – Information Sharing & Analysis Center (EE‐ISAC) was established in 2015.…”

“…However, organizations are reluctant to share information on experienced cyberincidents either with partners, governments, or competitors . Unease about admitting of being involved in a cyberincident, potentially negative consequences related to damaged reputation and a competitive disadvantage in the market, sensitivity, and criticality of data or natural, instinctive reluctance to sharing delicate data are just some examples of reasons for organizations not joining cyberincident IS initiatives.…”