To share or not to share: a behavioral perspective on human participation in security information sharing

Mermoud, A.; Keupp, Marcus Matthias; Huguenin, Kévin; Palmié, Maximilian; David, Dimitri Percia

doi:10.1093/cybsec/tyz006

Cited by 17 publications

(5 citation statements)

References 75 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…How can policymakers support discovering and disclosing software vulnerabilities in systems, products and services? The vulnerability-sharing process is a subset of cybersecurity information sharing (Libicki, 2015;Mermoud et al, 2019), and the research question covers the two stages that make it valuable for mitigating software vulnerability risks (Rajasooriya et al, 2016).…”

Section: Problem Definitionmentioning

confidence: 99%

Navigating vulnerability markets and bug bounty programs: A public policy perspective

Zrahia

2024

Internet Policy Review

View full text Add to dashboard Cite

As societies become increasingly dependent on digital means, organisations seek ways to prevent software exploitation by eliminating vulnerabilities or acquiring them as products. However, there is an ongoing debate regarding the extent to which governments should become involved in markets for vulnerability sharing. This paper examines the economics of vulnerabilities and outlines possible areas for governmental interventions. I survey three policy alternatives to support the discovery and disclosure of software vulnerabilities: integrating security and penetration testing into the software development life cycle, acquiring exploitable critical vulnerabilities by governments, and promoting bug bounty programs and platforms as vulnerability-sharing structures. For each suggested alternative, I present an impact matrix to qualitatively measure the effectiveness and efficiency of the vulnerability discovery process and the attractiveness, legality and trustworthiness of the disclosure process. I argue that bug bounty programs that bring together organisations and ethical hackers to trade vulnerabilities produce the highest impact. These gig economy structures are often based on two-sided digital market platforms as their foundation and offer a low entry barrier and assurance level for both market players. The discussion provides a foundation for governmental decision-makers to design effective policies for sharing vulnerabilities. Issue 1 1. Examples include the National Cyber Security Centre (NCSC) in the UK, and the Cybersecurity and Infrastructure Security Agency (CISA) in the US.

show abstract

Section: Problem Definitionmentioning

confidence: 99%

Navigating vulnerability markets and bug bounty programs: A public policy perspective

Zrahia

2024

Internet Policy Review

View full text Add to dashboard Cite

show abstract

“…The research exhibited the better financial performance of ISAC's participants in comparison to their industry peers. Mermoud et al [16] employed the behavioural theory to investigate the relationships between human activities and the extent of information sharing. The authors conducted a survey among 424 members of the Swiss national ISAC, MELANI-net, of whom 262 responded.…”

Section: Information Sharing and Analysis Centresmentioning

confidence: 99%

EE-ISAC—Practical Cybersecurity Solution for the Energy Sector

Wallis

2022

Energies

View full text Add to dashboard Cite

A recent survey of cybersecurity assessment methods proposed by the scientific community revealed that their practical adoption constitutes a great challenge. Further research that aimed at identifying the reasons for that situation demonstrated that several factors influence the applicability, including the documentation level of detail, the availability of supporting tools, and the continuity of support. This paper presents the European Energy Information Sharing and Analysis Centre (EE-ISAC)—a cybersecurity platform for the energy sector that has been adopted by multiple organisations. The platform facilitates sharing information about cybersecurity incidents, countermeasures, and assessment results. Prospectively, it is envisaged to be integrated with the threat intelligence platform that enables real-time situational awareness. By considering both fault and attack scenarios together, threat awareness can be mapped onto operational contexts to prioritise decisions and responses. This paper analyses EE-ISAC’s approach based on the conceptual applicability framework developed during the research, to improve the applicability and usefulness of this platform for energy sector participants and to identify areas that require further development.

show abstract

“…They found that earning a reputation, gaining promotion, and satisfying curiosity, all had positive effects on employees' attitudes, which in turn affected CTI sharing behavior. Expanding on earlier work taking economic perspectives on information security sharing [28,30], Mermoud et al proposed a behavioral framework theorizing how and why human behavior and sharing of security information may be associated [47]. They highlighted that human behavior may be at the core of the problem why CTI is underutilized despite being beneficial, yet cautioned not to infer that CTI sharing should be mandated as that could achieve the adverse effects of inducing compliance by sharing TI that may not be relevant, accurate, or timely [47].…”

Section: Human Cultural and Organizational Aspectsmentioning

confidence: 99%

What’s in a Cyber Threat Intelligence sharing platform?

Stojkovski

Lenzini

Koenig

et al. 2021

Annual Computer Security Applications Conference

View full text Add to dashboard Cite

The ever-increasing scale and complexity of cyber attacks and cybercriminal activities necessitate secure and effective sharing of cyber threat intelligence (CTI) among a diverse set of stakeholders and communities. CTI sharing platforms are becoming indispensable tools for cooperative and collaborative cybersecurity. Nevertheless, despite the growing research in this area, the emphasis is often placed on the technical aspects, incentives, or implications associated with CTI sharing, as opposed to investigating challenges encountered by users of such platforms. To date, user experience (UX) aspects remain largely unexplored.This paper offers a unique contribution towards understanding the constraining and enabling factors of security information sharing within one of the leading platforms. MISP is an open source CTI sharing platform used by more than 6,000 organizations worldwide. As a technically-advanced CTI sharing platform it aims to cater for a diverse set of security information workers with distinct needs and objectives. In this respect, MISP has to pay an equal amount of attention to the UX in order to maximize and optimize the quantity and quality of threat information that is contributed and consumed.Using mixed methods we shed light on the strengths and weaknesses of MISP from an end-users' perspective and discuss the role UX could play in effective CTI sharing. We conclude with an outline of future work and open challenges worth further exploring in this nascent, yet highly important socio-technical context. CCS CONCEPTS• Security and privacy → Usability in security and privacy; • Human-centered computing → User studies.

show abstract

To share or not to share: a behavioral perspective on human participation in security information sharing

Cited by 17 publications

References 75 publications

Navigating vulnerability markets and bug bounty programs: A public policy perspective

Navigating vulnerability markets and bug bounty programs: A public policy perspective

EE-ISAC—Practical Cybersecurity Solution for the Energy Sector

What’s in a Cyber Threat Intelligence sharing platform?

Contact Info

Product

Resources

About