Information Sharing SIG

Mission

In recent years it has become clear that in order to better protect both enterprises, governments and academia, there is a need for the fast, machine-to-machine exchange of threat related information. Using such mechanisms, there only needs to be a first victim, and all others can immediately protect themselves against the new known malicious activity.

While FIRST has for some time not had a operational incident response component, the organization maintains mailing lists and IRC channels which are still frequently used for the exchange of threat related information. We believe the organization would benefit from allowing such exchange to take place using an automated channel. This way, threat information could be exchanged in the most effective way possible, while security responders can use the mailing lists and other non-structured information for the exchange of higher level analysis. "The computers can do the hard work, while the engineers can do the smart work."

We are proposing the development of a SIG within FIRST which focuses on the development and management of standards for information sharing and threat intelligence amongst the membership. This will include the development of a small information exchange platform for the FIRST membership to validate these concepts and enable our members to use them. However, the group will focus less on tooling and more on how to make the information usable to the membership. It will produce sample code, guidelines on how to encode information, and where necessary identify methods to connect various information exchanges together.

While the platform will be open to all FIRST members, and not just members of the SIG, the SIG will coordinate the direction and development of the platform as a formal FIRST service.

The core mission is to support existing and new FIRST members to practice information sharing and acquire feedback from the members to improve the information sharing practices.

Goals & Deliverables

During the first year, we aim to develop:

• Deploy an information sharing platform for FIRST mainly used for educational purposes;
• Develop initial ties to other platforms to ensure access to valuable initial data sets for FIRST members;
• Develop guidelines for FIRST members on how to encode their own threat information for use with the Information Sharing platform;
• Identify core other platforms to target for interoperability in year 2, including on-premise MISP, other systems such as CRITS and new developments within the community.

Over time, we plan to work towards the following goals:

• Contribute to the development of standards for threat intelligence;
• Contributing to develop to sample import and export scripts from our platform to common tools within the CSIRT community or to a core information exchange protocol (e.g. STIX);
• Participate or contribute from the FIRST community to external working groups and standards organizations on information sharing;
• Either extend existing taxonomies, or propose new ones where needed.

Chairs

• Jeff Boerio, Intel, co-chair
• Alexandre Dulaunoy, CIRCL, co-chair

Initial Members

• Thomas Schreck, Siemens
• Aaron Kaplan, CERT.at
• Maarten Van Horenbeeck, Amazon

Request to Join

• Information Sharing SIG
  • Malware Information Sharing Platform