An Evolution Roadmap for Community Cyber Security Information Sharing Maturity Model

Cyber security has become one of the most important challenges, which is especially true for communities. A community generally consists of all of the entities within a geographical region, including both public and private infrastructures. Cyber attacks and other cyber threats can result in disruption and destruction of critical services and cause potentially devastating impacts in a community. \ \ An effective information collection, sharing and incident collaboration and coordination process is needed in communities to detect potential risks, prevent cyber attacks at an early stage, and facilitate incident response and preparedness activities. In this paper, an expanded collaborative information sharing framework that aims to improve community cyber security is presented. An Information Sharing Maturity Model is developed as a roadmap with evolutionary procedures and incremental steps for community organizations to advance in information sharing maturity

Risks of Sharing Cyber Incident Information

Incident information sharing is being encouraged and mandated as a way of improving overall cyber intelligence and defense, but its take up is slow. Organisations may well be justified in perceiving risks in sharing and disclosing cyber incident information, but they tend to express such worries in broad and vague terms. This paper presents a specific and granular analysis of the risks in cyber incident information sharing, looking in detail at what information may be contained in incident reports and which specific risks are associated with its disclosure. We use the STIX incident model as indicative of the types of information that might be reported. For each data field included, we identify and evaluate the threats associated with its disclosure, including the extent to which it identifies organisations and individuals. The main outcome of this analysis is a detailed understanding of which information in cyber incident reports requires protection, against specific threats with assessed severity. A secondary outcome of the analysis is a set of guidelines for disciplined use of the STIX incident model in order to reduce information security risk

Interoperability Challenges in the Cybersecurity Information Sharing Ecosystem

Threat intelligence helps businesses and organisations make the right decisions in their fight against cyber threats, and strategically design their digital defences for an optimised and up-to-date security situation. Combined with advanced security analysis, threat intelligence helps reduce the time between the detection of an attack and its containment. This is achieved by continuously providing information, accompanied by data, on existing and emerging cyber threats and vulnerabilities affecting corporate networks. This paper addresses challenges that organisations are bound to face when they decide to invest in effective and interoperable cybersecurity information sharing and categorises them in a layered model. Based on this, it provides an evaluation of existing sources that share cybersecurity information. The aim of this research is to help organisations improve their cyber threat information exchange capabilities, to enhance their security posture and be more prepared against emerging threats

Barriers to cyber information sharing

As our reliance on the Internet grows, our interconnected networks become more vulnerable to cyberattacks. Cyberattacks and other cyber threats can cause disastrous results, especially if a coordinated targeted attack hits multiple networks at the same time. For this reason, cyber information-sharing among public and private organizations becomes necessary and important to defend our networks. Many cyber threats are difficult to detect and identify by a single organization. Information sharing can help detect these potential risks, prevent cyberattacks, and facilitate incident response to better defend networks. Although the public and private sectors have begun to share cybersecurity information, there are still many barriers that stop agencies from sharing more. This research identifies and reviews what the barriers are to sharing cyber information and possible ways that the barriers can be overcome.http://archive.org/details/barrierstocyberi1094544574Information Technology Specialist, U.S. Department of Homeland SecurityApproved for public release; distribution is unlimited

Duopoly insurers' incentives for data quality under a mandatory cyber data sharing regime

We study the impact of data sharing policies on cyber insurance markets. These policies have been proposed to address the scarcity of data about cyber threats, which is essential to manage cyber risks. We propose a Cournot duopoly competition model in which two insurers choose the number of policies they offer (i.e., their production level) and also the resources they invest to ensure the quality of data regarding the cost of claims (i.e., the data quality of their production cost). We find that enacting mandatory data sharing sometimes creates situations in which at most one of the two insurers invests in data quality, whereas both insurers would invest when information sharing is not mandatory. This raises concerns about the merits of making data sharing mandatory.Comment: 46 pages, 8 figures, to be published at Computers & Securit

Cybersecurity: Selected Legal Issues

This report discusses selected legal issues that frequently arise in the context of legislation to address vulnerabilities of private critical infrastructure to cyber threats, efforts to protect government networks from cyber threats, and proposals to facilitate and encourage sharing of cyber threat information amongst private sector and government entities. This report also provides an overview of the ways in which federal laws of these types may preempt or affect the applicability of state law

Cyber Threat Intelligence for Improving Cybersecurity and Risk Management in Critical Infrastructure

Cyber-attack is one of the significant threats affecting to any organisation specifically to the Critical Infrastructure (CI) organisation. These attacks are nowadays more sophisticated, multi-vectored and less predictable, which make the Cyber Security Risk Management (CSRM) task more challenging. Critical Infrastructure needs a new line of security defence to control these threats and minimise risks. Cyber Threat Intelligence (CTI) provides evidence-based information about the threats aiming to prevent threats. There are existing works and industry practice that emphasise the necessity of CTI and provides methods for threat intelligence and sharing. However, despite these significant efforts, there is a lack of focus on how CTI information can support the CSRM activities so that the organisation can undertake appropriate controls to mitigate the risk proactively. This paper aims to fill this gap by integrating CTI for improving cybersecurity risks management practice specifically focusing on the critical infrastructure. In particular, the proposed approach contributes beyond state of the art practice by incorporating CTI information for the risk management activities. This helps the organisation to provide adequate and appropriate controls from strategic, tactical and operational perspectives. We have integrated concepts relating to CTI and CSRM so that threat actor's profile, attack detailed can support calculating the risk. We consider smart grid system as a Critical Infrastructure to demonstrate the applicability of the work. The result shows that cyber risks in critical infrastructures can be minimised if CTI information is gathered and used as part of CSRM activities. CTI not only supports understanding of threat for accurate risk estimation but also evaluates the effectiveness of existing controls and recommend necessity controls to improve overall cybersecurity. Also, the result shows that our approach provides early warning about issues that need immediate attention

cyberaCTIve: a STIX-based Tool for Cyber Threat Intelligence in Complex Models

Cyber threat intelligence (CTI) is practical real-world information that is collected with the purpose of assessing threats in cyber-physical systems (CPS). A practical notation for sharing CTI is STIX. STIX offers facilities to create, visualise and share models; however, even a moderately simple project can be represented in STIX as a quite complex graph, suggesting to spread CTI across multiple simpler sub-projects. Our tool aims to enhance the STIX-based modelling task in contexts when such simplifications are infeasible. Examples can be the microgrid and, more in general, the smart grid.Comment: 11 pages, 8 figures, technical repor

Controlled and Secure Sharing Threat Intelligence

Cyber threat information sharing platforms have become a useful weapon for dealing with cyberattacks, proactively mitigating them and thus reducing risk exposure. These allow multiple agencies to connect with each other, forming a community, and share that same intrusion information regarding cyberattacks or threats with each other. The Malware Information Sharing Platform (MISP) is particularly developed to promote the open dissemination of information such as intrusion indicators within a community. This exchange of information related to threats or incidents is treated as a data synchronisation procedure between di erent MISP instances, which may belong to one or more communities, companies or organisations. However, this platform presents limitations if its information is considered as classi ed or shared only for a certain period of time. This implies that this information should be treated only in encrypted form. One solution is to use MISP with searchable encryption techniques to impose greater control over information sharing. In this document, it is present a system that guarantees a controlled synchronisation of information between entities through the use of encrypted search techniques to guarantee the con dentiality of the information present in the MISP platform and also the use of synchronisation policies to control the way information is exchanged

Information Pooling Bias in Collaborative Cyber Forensics

abstract: Cyber threats are growing in number and sophistication making it important to continually study and improve all dimensions of cyber defense. Human teamwork in cyber defense analysis has been overlooked even though it has been identified as an important predictor of cyber defense performance. Also, to detect advanced forms of threats effective information sharing and collaboration between the cyber defense analysts becomes imperative. Therefore, through this dissertation work, I took a cognitive engineering approach to investigate and improve cyber defense teamwork. The approach involved investigating a plausible team-level bias called the information pooling bias in cyber defense analyst teams conducting the detection task that is part of forensics analysis through human-in-the-loop experimentation. The approach also involved developing agent-based models based on the experimental results to explore the cognitive underpinnings of this bias in human analysts. A prototype collaborative visualization tool was developed by considering the plausible cognitive limitations contributing to the bias to investigate whether a cognitive engineering-driven visualization tool can help mitigate the bias in comparison to off-the-shelf tools. It was found that participant teams conducting the collaborative detection tasks as part of forensics analysis, experience the information pooling bias affecting their performance. Results indicate that cognitive friendly visualizations can help mitigate the effect of this bias in cyber defense analysts. Agent-based modeling produced insights on internal cognitive processes that might be contributing to this bias which could be leveraged in building future visualizations. This work has multiple implications including the development of new knowledge about the science of cyber defense teamwork, a demonstration of the advantage of developing tools using a cognitive engineering approach, a demonstration of the advantage of using a hybrid cognitive engineering methodology to study teams in general and finally, a demonstration of the effect of effective teamwork on cyber defense performance.Dissertation/ThesisDoctoral Dissertation Applied Psychology 201