Distributed Security Framework for Reliable Threat Intelligence Sharing

Sharing of Cyber Threat Intelligence (CTI) has turned out to be an indispensable pillar of the modern cybersecurity landscape, it is enabling organizations to defend against the evolving threats. In this white paper, we will discuss the strategies to optimize the sharing of threat intelligence across multiple security platforms in the enterprise and community context. We will observe the current standards and practices, like Structured Threat Information eXpression (STIX) and trusted Automated Exchange of Indicator Information (TAXII) protocols, and also examine the role of these standards in integrating the Threat Intelligence Platforms (TIPs) with Security Information and Event Management (SIEM) systems. We will observe the impact of threat intelligence exchange through real-world case studies and how the cybersecurity attacks are mitigated, along with the challenges that are encountered (e.g., technical integration gaps, data overload, trust and privacy issues). We will also discuss the limitations in the current approaches, which include the inconsistent adoption of the standards, there is a prevalence of indicators with low context, and siloed systems that impede the information flow. The landscape of the emerging solutions, the future directions will be explored, machine learning prioritized to reduce the false positives, a decentralized sharing architecture by leveraging blockchain and federated learning for privacy, and also trust frameworks to incentivize collaboration. Through addressing the present challenges and leveraging the advanced technologies, organizations will be able to create a unified and effective threat intelligence sharing ecosystem that will strengthen the collective cyber defense.

Computer Security Incident Response Teams (CSIRTs) provide information security incident response services to communities. The South African Cybersecurity Hub (SACH) acts as a national point of contact for the coordination of cybersecurity incidents in South Africa, but to date has only been successful in assisting with the establishment of a finance sector CSIRT. No mention of a transport or critical infrastructure sector CSIRT, under which an aviation CSIRT can report aviation sector cyber-attacks is made. The aviation community is mandated to sustain safety and security of operations and passengers in Southern Africa. Acknowledging the urgency and importance of protecting civil aviation’s critical infrastructure, information and communication technology systems and data against cyber threats this research identifies that there is a need for a CSIRT framework for the Sub-Saharan aviation community. An aviation CSIRT should implement frameworks, programs and international information security standards, and aviation communities need to share cyber information with the CSIRT. To achieve such a framework, globally established CSIRTs are reviewed. Since the aviation sector is complex to manage, there is a need to establish an integrated CSIRT approach that include stakeholders within the ecosystem. A proposed aviation CSIRT requires the adoption of best practice cyber security incident response standards as a practical solution to manage aviation cyberattacks.

Today’s threats use multiple means of propagation, such as social engineering, email, and application vulnerabilities, and often operate in different phases, such as single device compromise, lateral network movement, and data exfiltration. These complex threats rely on advanced persistent threats supported by well-advanced tactics for appearing unknown to traditional security defenses. As organizations realize that attacks are increasing in size and complexity, cyber threat intelligence (TI) is growing in popularity and use. This trend followed the evolution of advanced persistent threats, as they require a different level of response that is more specific to the organization. TI can be obtained via many formats, with open-source intelligence one of the most common, and using threat intelligence platforms (TIPs) that aid organizations to consume, produce, and share TI. TIPs have multiple advantages that enable organizations to quickly bootstrap the core processes of collecting, analyzing, and sharing threat-related information. However, current TIPs have some limitations that prevent their mass adoption. This article proposes AECCP, a platform that addresses some of the TIPs limitations. AECCP improves quality TI by classifying it accordingly a single unified taxonomy , removing the information with low value, enriching it with valuable information from open-source intelligence sources, and aggregating it for complementing information associated with the same threat. AECCP was validated and evaluated with three datasets of events and compared with two other platforms, showing that it can generate quality TI automatically and help security analysts analyze security incidents in less time.

Threat actors can be persistent, motivated and agile, and leverage a\ndiversified and extensive set of tactics and techniques to attain their goals.\nIn response to that, defenders establish threat intelligence programs to stay\nthreat-informed and lower risk. Actionable threat intelligence is integrated\ninto security information and event management systems (SIEM) or is accessed\nvia more dedicated tools like threat intelligence platforms. A threat\nintelligence platform gives access to contextual threat information by\naggregating, processing, correlating, and analyzing real-time data and\ninformation from multiple sources, and in many cases, it provides centralized\nanalysis and reporting of an organization's security events. Sysmon logs is a\ndata source that has received considerable attention for endpoint visibility.\nApproaches for threat detection using Sysmon have been proposed, mainly\nfocusing on search engine technologies like NoSQL database systems. This paper\ndemonstrates one of the many use cases of Sysmon and cyber threat intelligence.\nIn particular, we present a threat assessment system that relies on a cyber\nthreat intelligence ontology to automatically classify executed software into\ndifferent threat levels by analyzing Sysmon log streams. The presented system\nand approach augments cyber defensive capabilities through situational\nawareness, prediction, and automated courses of action.\n

This thesis focuses in the evaluation of Threat Intelligence Platforms (TIPs). TIPs are security tools that use global
\nsecurity data to help proactively identify, mitigate and remediate security threats. New and continually evolving
\nsophisticated threats are surfacing every day making the processes of detection and mitigation far more complicated
\nthan some years ago. So it’s obvious that the need for more and more intelligent security tools has become
\nimperative. Thus, organizations were encouraged to change their traditional defence models and to use and to
\ndevelop new systems with a proactive approach. Such changes are necessary because the old approaches are not
\neffective anymore to detect advanced attacks. Also, the organizations are encouraged to develop the ability to
\nrespond to incidents in real-time using complex threat intelligence platforms.
\nThis thesis is separated in three big sections. In the beginning we are going to discuss what threat intelligence is and
\nhow it is used by researchers and organisations. Subsequently a concise analysis and description of four open source
\nand widespread TIPs will be presented. The platforms I chose are: MISP (Malware Information Sharing
\nPlatform), OpenCTI (Open Cyber Threat Intelligence Platform), CIF (Collective Intelligence Framework) and
\nCRITs (Collaborative Reasearch Into Threats). Finally, at the last section I will present the evaluation of these
\nplatforms according to specific criteria along with some key findings and limitations that extracted from the analysis.

Cyber attacks are one of the genuine threats that have emerged due to the evolution of a more dynamic and complex global strategic environment. In Indonesia, several cyber attacks target various government infrastructure sectors. The National Cyber and Crypto Agency (BSSN) predicts Indonesia will face approximately 370.02 million cyber attacks in 2022. The majority of cyber attacks target the government administration sector. The National Cyber and Crypto Agency (BSSN) officially formed a Computer Security Incident Response Team (CSIRT) to tackle the rampant cybercrime cases. CSIRT is an organization or team that provides services and support to prevent, handle, and respond to computer security incidents. The current CSIRT does not have a data storage process and forensic preparation. CSIRT will repeat the procedure, and so on. This is a repeating procedure; the attack will occur once, and only a technical problem will arise. Therefore, the research entitled "Analysis of Knowledge Management Strategies for Handling Cyber Attacks with the Computer Security Incident Response Team (CSIRT)" is expected to implement this Knowledge Management Strategy to manage existing knowledge so that it can make it easier for the CSIRT team to handle cyber attacks that occur.

This article proposes a message format for sharing information between Computer Security Incident Response Team (CSIRT) and Intrusion Detection Systems (IDS), aiming the achievement of an automatic update of the response action data base in IDSs, based on restrictive short-term measures suggested in security alerts issued by CSIRTs. This model is based on Web services and Extensible Markup Language (XML) technologies. It is also presented a data format to these security alerts as an extension of the Common Alerting Protocol.. Intrusion Detection Systems (IDS) are systems composed of software or hardware which automate the monitoring process of events that occur in a computing system or network, with the aim of identifying signs of security problems (1). Mechanisms which allow exchanging information between an IDS and a Computer Security Incident Response Team (CSIRT) are necessary. Thus, a better understanding of events surrounding the protected domain allowing the prevention and response measures are taken. In this work, it is proposed a model for sharing information between CSIRT and IDS, aiming to make it possible for an IDS to update automatically its response action data base, based on short-term restrictive measures suggested in security alerts issued by CSIRT, using Web services (10) and XML (9) technologies.

There are a number of considerations before one can commence with establishing a Computer Security Incident Response Team (CSIRT). This paper presents the results of a structured literature review investigating the business requirements for establishing a CSIRT. That is, the paper identifies those things that must be in place prior to commencing with the actual establishment process. These include characterising the CSIRT environment, funding, constituency, authority and legal considerations. Firstly, we identified authoritative CSIRT literature. Thereafter we identified salient aspects using a concept matrix. The study enumerates five areas of primary business requirements. Finally, a holistic view of the business requirements is provided by summarising the decisions required in each area.

This paper presents a comprehensive survey of the applications, challenges, and limitations of Generative AI (GenAI) in enhancing threat intelligence within cybersecurity, supported by real-world case studies. We examine a wide range of data sources in Cyber Threat Intelligence (CTI), including security reports, blogs, social media, network traffic, malware samples, dark web data, and threat intelligence platforms (TIPs). This survey provides a full reference for integrating GenAI into CTI. We discuss various GenAI models such as Large Language Models (LLMs) and Deep Generative Models (DGMs) like Variational Autoencoders (VAEs), Generative Adversarial Networks (GANs), and Diffusion Models, explaining their roles in detecting and addressing complex cyber threats. The survey highlights key applications in areas such as malware detection, network traffic analysis, phishing detection, threat actor attribution, and social engineering defense. We also explore critical challenges in deploying GenAI, including data privacy, security concerns, and the need for interpretable and transparent models. As regulations like the European Commission’s AI Act emerge, ensuring trustworthy AI solutions is becoming more crucial. Real-world case studies, such as the impact of the WannaCry ransomware, the rise of deepfakes, and AI-driven social engineering, demonstrate both the potential and current limitations of GenAI in CTI. Our goal is to provide foundational insights and strategic direction for advancing GenAI’s role in future cybersecurity frameworks, emphasizing the importance of innovation, adaptability, and ongoing learning to enhance resilience against evolving cyber threats. Ultimately, this survey offers critical insights into how GenAI can shape the future of cybersecurity by addressing key challenges and providing actionable guidance for effective implementation.

When a computer security attack on an organization occurs, an intrusion is recognized, or some other kind of computer security incident occurs, it is critical for the organization to have a fast and effective means of responding. One method of addressing this need is to establish a formal incident response capability or a Computer Security Incident Response Team (CSIRT). When an incident occurs, the goal of the CSIRT is to control and minimize any damage, preserve evidence, provide quick and efficient recovery, prevent similar future events, and gain insight into threats against the organization. This handbook describes different organizational models for implementing incident handling capabilities, including each model's advantages and disadvantages and the kinds of incident management services that best fit with it. An earlier SEI publication, the Handbook for Computer Security Incident Response Teams (CSIRTs) (CMU/SEI-2003-HB-002), provided the baselines for establishing incident response capabilities. This new handbook builds on that coverage by enabling organizations to compare and evaluate CSIRT models. Based on this review they can then identify a model for implementation that addresses their needs and requirements.

The article is devoted to the study of the Italian cybersecurity architecture, the strategy and organizational principles of protecting the country’s critical infrastructure, and the logic of technical, legal, and institutional innovations in the field of cyber defense of the Italian Republic. It has been established that Italy took its first regulatory steps on cybersecurity relatively late compared to other European countries – in 2013 (‘Monti Decree’). The second Italian cybersecurity strategy (‘Gentiloni Decree’) aimed to streamline the institutional cybersecurity ecosystem in accordance with the requirements of the European ‘Network and Information Security (NIS) Directive’. An analysis of the evolution of Italian cybersecurity suggests that between the 2013 and 2018 strategies, most of the changes concerned the institutional framework (reduction of the number of actors with overlapping functions; centralization of the structure) rather than the formulation of cybersecurity policy. In accordance with the ‘NIS Directive’, a national team was established to respond to computer incidents (‘Computer Security Incident Response Team’, CSIRT). It was noted that the further development of a consistent and comprehensive legal framework in the field of cybersecurity was facilitated by the creation of the so-called ‘national cybersecurity perimeter’ (‘Perimetro di Sicurezza Nazionale Cibernetica’). Lawmakers have clearly defined ‘critical technologies’: artificial intelligence, robotics, semiconductors, cybersecurity, aerospace, defense, energy storage, quantum, nuclear, nano- and bio-technologies. It was noted that in recent years, Italy has strengthened its cyber defense capabilities by creating the National Cyber Security Agency (ACN), which was tasked with implementing the new (third) National Cyber Security Strategy for 2022–2026. The authors believe that the wide range of measures provided for by Italian legislation largely complies with the cybersecurity requirements developed by EU institutions. It is concluded that flexible national legislation based on government decrees avoids excessive regulatory framework, as it can be amended easily and relatively quickly.

Cyber Threat Intelligence (CTI) plays a crucial role in cybersecurity risk management, providing valuable insights to organisations for threat identification and mitigation. The continuous and rapid increase of CTI volume, velocity, and variety requires a systematic approach to assessing their quality, operational significance, and actionable contribution. Threat Intelligence Platforms (TIPs) underpin the sharing and analysis of CTI, enabling organisations to collaborate and enhance their defensive measures ensuring the intelligence shared is effective and reliable for mitigating cyber threats. The assessment of CTI demands a detailed and comprehensive consideration of various factors addressing important quality and operational properties, such as their extensive approach, accuracy, timeliness, and standardisation. Drawing upon the MISP data model, this study defines quantifiable quality metrics based on simple mathematical equations. In addition, this study defines 2 approaches for weighting those criteria based on a subjective (fuzzy-Analytic Hierarchy Process) and an objective (Entropy-based) approach. Current CTI evaluation practices either lack standardized, comprehensive and quantifiable quality metrics or fail to balance subjective expert judgment with objective data variability. Moreover, existing models rarely integrate with operational platforms, limiting their practical applicability. This study addresses these gaps by proposing a framework that formally defines quality metrics, applies dual weighting mechanisms, and supports prioritization directly within a TIP context. By integrating quantifiable quality equations based on the MISP data model with diverse weighting approaches, this proposal enables researchers and practitioners to systematically assess and prioritize trustworthy, high-quality CTI. The dual weighting strategy allows organizations to flexibly adapt evaluations either to subjective expert-driven priority settings, or to objective, data-driven ones, depending on operational needs and available contextual knowledge. This approach facilitates informed decision-making, enhancing the organisation’s cybersecurity posture and resilience against evolving threats. This paper illustrates the potential of the proposed approach as well as demonstrates its benefits by implementing a proof of concept technical implementation on real Open Source Intelligence data, showcasing its utility in underpinning cybersecurity measures and facilitating threat response strategies.

Phishing campaigns are becoming more sophisticated, using encrypted communication platforms like telegram to coordinate their activities and store stolen information. This paper introduces a structured and scalable framework that supports cyber threat intelligence (CTI) efforts in monitoring malicious telegram channels linked to phishing activity.The framework is based on a combination of machine learning and human expertise, and it leverages a large dataset of telegram messages and their corresponding labels to train and evaluate the performance of the model. The methodology involves four interconnected stages: extracting hidden artifacts from phishing code, gaining unauthorized access to private telegram groups, analyzing collected data automatically, and implementing counterintelligence measures to prevent detection. Initial findings validate the framework's ability to detect indicators of compromise (IoCs) and visualize the attacker's infrastructure. Additional functionalities like integration with threat intelligence platforms and artificial intelligence-based data enrichment enhance the framework's versatility and usefulness. This method improves proactive communication monitoring, providing a secure and flexible solution for tracking adversarial communication channels.

At present, the Colombian government shares information on threats or vulnerabilities in the area of cybersecurity and cyberdefense, from other government agencies or departments, on an ad-hoc basis but not in real time, with the surveillance entities of the Government of the Republic of Colombia such as the Joint Command of Cybernetic Operations (CCOCI) and the Cybernetic Emergencies Response Team of Colombia (ColCERT). This research presents the MS-CSIRT (Management System Computer Security Incident Response Teams) methodology, that is used to unify the guidelines of a CSIRT towards a joint communication command in cybersecurity for the surveillance of Information Technology (IT), Technological Operations (TO), Internet Connection Sharing (ICS) or Internet of Things (IoT) infrastructures. This methodology evaluates the level of maturity, by means of a roadmap, to establish a CSIRT as a reference framework for government entities and as a guide for the areas of information security, IT and TO to strengthen the growth of the industry 4.0. This allows the organizations to draw a line of cybersecurity policy with scope, objectives, controls, metrics, procedures and use cases for the correct coordination between ColCERT and CCOCI, as support entities in cybersecurity, and the different companies (ICS, IoT, gas and energy, mining, maritime, agro-industrial, among others) or government agencies that use this methodology.

When computer security incidents occur, it's critical that organizations be able to handle them in a timely manner. The speed with which an organization can recognize, analyze, and respond to an incident will affect the damage and lower recovery costs. Organized incident management requires defined, repeatable processes and the ability to learn from incidents that threaten the confidentiality, availability, and integrity of critical systems and data. Some organizations assign responsibility for incident management to a defined group of people or a designated unit, such as a computer security incident response team. This article looks at the development, purpose, and evolution of such specialized teams; the evolving nature of attacks they must deal with; and methods to evaluate the performance of such teams as well as the emergence of information sharing as a core service.