Collaborative cyber threat intelligence : detecting and responding to advanced cyber attacks on the national level

"Threat intelligence is a surprisingly complex topic that goes far beyond the obvious technical challenges of collecting, modelling and sharing technical indicators. Most books in this area focus mainly on technical measures to harden a system based on threat intel data and limit their scope to single organizations only. This book provides a unique angle on the topic of national cyber threat intelligence and security information sharing. It also provides a clear view on ongoing works in research laboratories world-wide in ordifer to address current security concerns at national level. It allows practitioners to learn about upcoming trends, researchers to share current results, and decision makers to prepare for future developments."--Provided by publisher MuPDF error: syntax error: invalid key in dict MuPDF error: syntax error: invalid key in dict MuPDF error: syntax error: invalid key in dict MuPDF error: syntax error: invalid key in dict MuPDF error: syntax error: invalid key in dict MuPDF error: syntax error: invalid key in dict MuPDF error: syntax error: invalid key in dict MuPDF error: syntax error: invalid key in dict MuPDF error: syntax error: invalid key in dict Cover 1 Half Title 2 Title Page 4 Copyright Page 5 Contents 6 Foreword 8 Preface 10 Acknowledgment 12 About the Editor 14 Contributors 16 1 Introduction 18 2 A Systematic Study and Comparison of Attack Scenarios and Involved Threat Actors 36 3 From Monitoring, Logging, and Network Analysis to Threat Intelligence Extraction 86 4 The Importance of Information Sharing and Its Numerous Dimensions to Circumvent Incidents and Mitigate Cyber Threats 146 5 Cyber Threat Intelligence Sharing through National and Sector-Oriented Communities 204 6 Situational Awareness for Strategic Decision Making on a National Level 242 7 Legal Implications of Information Sharing 294 8 Implementation Issues and Obstacles from a Legal Perspective 330 9 Real-World Implementation of an Information Sharing Network: Lessons Learned from the Large-Scale European Research Project ECOSSIAN 372 Index 438 Information sharing is a crucial step to acquiring a thorough understanding of large-scale cyber-attack situations, and is therefore seen as one of the key concepts to protect future networks. To this end, nation-states together with standardization bodies, large industry stakeholders, academics and regulatory entities have created a plethora of literature on how cyber security information sharing across organizations and with national stakeholders can be achieved. Shared information, commonly referred to as threat intelligence, should comprise timely early warnings, details on threat actors, recently exploited vulnerabilities, new forms of attack techniques, and courses of action on how to deal with certain situations--just to name a few. Sharing this information, however, is a highly non-trivial task. A wide variety of implications, regarding data privacy, economics, regulatory frameworks, organizational aspects and trust issues need to be considered. Collaborative Cyber Threat Intelligence surveys and presents existing works, and proposes and discusses new approaches and methodologies at the forefront of research and development--back cover This book discusses national cyber threat intelligence and security information sharing. It details ongoing work in research laboratories world-wide to address current national security concerns. It allows practitioners to learn about upcoming trends, researchers to share current results, and decision makers to prepare for future developments.