What’s in a Cyber Threat Intelligence sharing platform?

Abstract

The ever-increasing scale and complexity of cyber attacks and cybercriminal activities necessitate secure and effective sharing of cyber threat intelligence (CTI) among a diverse set of stakeholders and communities. CTI sharing platforms are becoming indispensable tools for cooperative and collaborative cybersecurity. Nevertheless, despite the growing research in this area, the emphasis is often placed on the technical aspects, incentives, or implications associated with CTI sharing, as opposed to investigating challenges encountered by users of such platforms. To date, user experience (UX) aspects remain largely unexplored.This paper offers a unique contribution towards understanding the constraining and enabling factors of security information sharing within one of the leading platforms. MISP is an open source CTI sharing platform used by more than 6,000 organizations worldwide. As a technically-advanced CTI sharing platform it aims to cater for a diverse set of security information workers with distinct needs and objectives. In this respect, MISP has to pay an equal amount of attention to the UX in order to maximize and optimize the quantity and quality of threat information that is contributed and consumed.Using mixed methods we shed light on the strengths and weaknesses of MISP from an end-users' perspective and discuss the role UX could play in effective CTI sharing. We conclude with an outline of future work and open challenges worth further exploring in this nascent, yet highly important socio-technical context. CCS CONCEPTS• Security and privacy → Usability in security and privacy; • Human-centered computing → User studies.

Practical Cyber Threat and OSINT Analysis based on Implementation of CTI Sharing Platform

“…CTI sharing platforms are becoming essential tools for collaborative and cooperative cybersecurity, the focus is often on the technical aspects, incentives or implications associated with CTI sharing instead of examining the challenges experienced by platform users. MISP is an open source CTI sharing platform used by over 6,000 organizations worldwide, as a technologically advanced CTI sharing platform, aims to accommodate a diverse range of security information workers with distinct needs and goals [17].…”

CTI Sharing Practices and MISP Adoption in Finland’s Critical Infrastructure Protection

“…Various platforms have been developed to improve threat intelligence sharing through automation and standardisation (Stojkovski et al, 2021). These platforms, while varying in capabilities, are essential for efficient Cyber Threat Intelligence (CTI) sharing among organisations and have been widely adopted due to their demonstrated benefits (Dandurand & Serrano, 2023;Bauer et al, 2020;De Melo e Silva et al, 2020).…”

“…Evolving from its initial purpose of malware information sharing within military circles, MISP has expanded its scope to encompass a wide range of cybersecurity intelligence (Wagner et al, 2016;Stojkovski et al, 2021) and even other domains like dissemination of COVID information (Ramallo-Gonzále, 2021). With the backing of the Computer Incident Response Center Luxembourg (CIRCL) and the European Union (MISP 2024), MISP operates as an open-source collaborative platform, serving a diverse user base ranging from NATO agencies to private sector entities (Stojkovski et al, 2021). Organisations can join established MISP communities or establish their own MISP instances, which function as centralised or decentralised servers within a network to enable efficient CTI exchange (Stojkovski et al, 2021).…”

“…With the backing of the Computer Incident Response Center Luxembourg (CIRCL) and the European Union (MISP 2024), MISP operates as an open-source collaborative platform, serving a diverse user base ranging from NATO agencies to private sector entities (Stojkovski et al, 2021). Organisations can join established MISP communities or establish their own MISP instances, which function as centralised or decentralised servers within a network to enable efficient CTI exchange (Stojkovski et al, 2021).…”

Intelligent Process Automation and Business Continuity: Areas for Future Research

“…A total of 71 results report that some new and disruptive technologies are not well known or understood and can present a range of unknown types of risks if no mitigation response is prepared in advance [142][143][144][145][146][147]. On the one hand, some literature points to an increased risk arising from the adoption and use of new technologies and the lack of knowledge of their real impact on organizations, while other authors point to evidence that technology helps to mitigate many types of risk [137,[148][149][150][151][152][153][154][155][156][157][158][159].…”