Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

12/28/2015
10:30 AM
Peter Zavlaris
Peter Zavlaris
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

The Rise Of Community-Based Information Security

The more vendors, service providers, and companies' band together to fight security threats, the more difficult it will become for attacks to succeed.

Security has evolved into a game of detection and response, and the greatest weapon in this new world order is timely threat intelligence sharing. This is true primarily because details about an attack campaign provided by a peer organization can accelerate the response time to threats and limit their damage.

The good news is that there is growing support for threat intelligence sharing. In March of 2015, Andrew H. Tannenbaum, Cybersecurity Counsel for IBM, submitted testimony in support of threat information sharing before the US House of Representatives Permanent Select Committee on Intelligence. He argued that:

  • Cyber threats have become too diverse and too dynamic to completely eliminate cyber risk;
  • Businesses need to identify potential risks in their IT systems, prioritize them, and allocate security resources accordingly;
  • Cybersecurity is now a data analytics challenge.

In his testimony, Tannenbaum explained that the explosion in technology, data, and access “has created a sea of new risks and hidden vulnerabilities for hackers to exploit. The velocity and volume of this threat requires a comprehensive, risk-based approach to cybersecurity,” he said, adding that “in order to stay ahead of the attackers, companies need timely and actionable information about specific threats to their infrastructure.”

“Malicious actors,” he said, “can move through networks at light speed, so information about the attack needs to be available to potential victims in as close to real time as possible.”

 

Other calls to action

The NIST Guide to Cyber Threat Information Sharing also recently pointed to the need for organizations to enhance incident response actions and bolster cyber defenses, by harnessing “the collective wisdom of peer organizations through information sharing and coordinated incident response." Even President Obama espoused the benefits of information sharing at his summit on Cyber Security in Palo Alto. During the summit, Obama announced his executive order directing the creation of new Information Sharing and Analysis Organizations (ISAOs).

According to the 2015 Verizon Data Breach Investigations Report, using shared intelligence for "herd alertness" -- just as animals on the plains share warnings when predators are near -- requires speed to be effective. That is because 75 percent of attacks spread from Victim 0 to Victim 1 in 24 hours while 40 percent hit the second victim organization in less than an hour!

One recent industry initiative designed to accelerate the exchange of threat intelligence is Facebook ThreatExchange. According to Facebook, there are currently more than 170 ThreatExchange members contributing attack information to this community, among them, RiskIQ, and other security vendors, plus cloud and social media companies the likes of Pinterest, Dropbox, Tumblr, and Yahoo.  ThreatExchange allows security researchers to team up with peers they know and trust, to share information and perform threat analysis. The intelligence shared by members of ThreatExchange connects attacks to attack infrastructure and enables organizations to combat threats like malvertising, ransomware, and other criminal-based attacks that routinely penetrate perimeter controls and scale beyond traditional defensive measures.

The more companies share threat information, the easier it becomes to detect and respond to threats. Whether it’s private sharing of attack campaigns, long-form reports on threat actors, or just public lists of indicators -- sharing should occur without friction. The more vendors, service providers, and companies band together to fight security threats, the more difficult it will become for attacks to succeed.

Peter Zavlaris is one of the primary analysts and contributors to the RiskIQ blog, which provides weekly insights on the latest threats and attacks that target companies outside the firewall and put customers at risk. He has held various customer satisfaction positions with ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PZav
100%
0%
PZav,
User Rank: Author
1/4/2016 | 5:19:44 PM
Re: Challenges
I do see that as a signficant challenge, really good question. I think other sharing platforms struggle because of it. The vision for ThreatExchange is to connect peers with previously established relationships. There will be a higher level of trust. Of course what gets shared will be at the discretion of each particpant. We will have to observe as ThreatExchange gains popularity, whether enough data is being shared openly to provide value. 
sashankdvk
100%
0%
sashankdvk,
User Rank: Apprentice
12/28/2015 | 10:43:07 PM
Challenges
Do you see any challenges for enabling participants in threat intel sharing ? like any privacy issues ? or any other things?  because most of the the threat intel (like URL's etc.) might have sensitive PII in it 
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4873
PUBLISHED: 2021-01-19
IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836.
CVE-2020-4881
PUBLISHED: 2021-01-19
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server hostname verification for SSL/TLS communication. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID...
CVE-2021-22498
PUBLISHED: 2021-01-19
XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product. The vulnerability affects versions 12.x, 12.60 Patch 5 and earlier, 15.0.1 Patch 2 and earlier and 15.5. The vulnerability could be exploited to allow an XML Exte...
CVE-2021-25323
PUBLISHED: 2021-01-19
The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password.
CVE-2021-25324
PUBLISHED: 2021-01-19
MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.