Cyber Threat Intelligence Sharing

The NIS directive was meant to regulate how Critical Infrastructure must implement Cybersecurity. Among all of those indication there is also the imposition of the creation of internal process capable of producing and sharing threat intelligence information. The NIS directive delegates the application of those rules to the individual EU nations, but it defines the economic sector:

• Energy distributors
• Water distribution
• Financial sector
• Healtcare

In Italy for example the list of this company is secret, but there are obvious names: large telco providers and energy providers.

The imposition of CIT Sharing gave birth to the birth of different companies that provide this kind of service. The regulation also says to which organization the information has to be shared. A third party is required to ensure that any confidential information of each single actor remains secret.

It is composed by a set of organizations that share data to a central node (a third party), that is responsible of handling data and anonymizing it. This is the most common model. Most of the time the third party is a national istitute or a private organization that is a somewhat trusted by all the other members.

The advantages of adopting a central approach is the fact that the central point is capable to enrich in the better way the available data, correlating them. Of course the central position enables the possibility to perform Macro trend analysis, Rule agreeement enforcement, and represent a low techical cost for organizations that want to be part of the sharing community; for example providing pre-configured software.

The problem is that it requires a wide-scale trust for the central organization: all the participant must trust fully the central actor.

This model is composed by an agreement between two organizations, both parties decide wich kind of informations to shares and the level of details. It is tailored for efficiency and speed and both parties may trust each other, enabling the exchange of detailed information. This sharing model requires to have more sophisticated and matured cyber threat sharing operations, and of course this model is very hard to scale, so it is done with an handful number of organizations.

The Centralized model is preferred any time that there is an information sharing process that derives from the imposition of a regulation; and it’s done between a huge amount of different actors.

The peer to peer sharing model is adopted in large suplly chains, so between companies that collaborate to build a single product. That’s because the supply chain itself may be the target.

Structured Threat Infromation Expression is a language and a serialization format used to exchange cyber threat intelligence. It solve two kind of subproblems: a sintatic problem, and a semantic one. The first is easy to solve, the second is much more difficoult to asses.

In the alst five year beacame a global standard supported by OASIS. STIX has two versions, STIX 2.0 is the one used today.

In STIX the ifnromations are represented in a graph-based model, both vertices and relationships have their own properties. In particular vertices are called STIX domain objects, different objects can be populated with specific properties, and connected via relationships. The good point to have a good graph model can be easily modified to alt the information that it contains.

In STIX is easier to add information to make possible the evolution of the Cyber Threat information cycle and enrichment of the informaiton.

Another good aspect object is that it is completely tool-agnostic, it can be coded in a standard relational database, graph database or an ad-hoc platform; allowing the creation or the adaptation of different platforms.

The STIX define the model and provide information on how to implement the model (JSON) ensuring interoperatibility.

The obvious use case of STIX is to share threat intelligence information. The cyber decision makers are typically managers of the Chief Security Office. The data inside the Cyber Threat Cycle may be represented using STIX.

Other use-cases are threat response activities, and how to set up and incident response process. In principle it’s possible to set up an internal Threat Intelligence process that uses STIX in all of its parts.

In the graph based model there are Domain Objects and Relationships. In particular twelve domain objects are defined:

• Attack Pattern. High level information about TTPs, describing ways threat actors attempt to compromise a system.
• Campaign. It describes how an actor behaves in relation to different targets.
• Course Of Action. It describes the set of actions to be taken to prevent an attack or respond to it.
• Identity. Individuals, organizations or groups.
• Indicator. It describes an idicator of compromise.
• Intrusion Set.
• Malware.
• Tool. It can be a piece of sotware that the attacker may use against an organizations. The difference between tool and malware is that tool is not a malicious software.
• Observed Data. Used to represent raw data collected, that is not necessarly correlated to an IoC.
• Report. Collecitons of other elements used for reporting purposes.
• Threat Actor.
• Vulnerability

STIX also defines high level relationships that can be used to link different objects. The property f the relationship describes its meaning. Another kind of relationship is Sightin, that denotes the belief that an element of CTI was seen.

The Sightin meta relations creates a relation between an actor, a TTP and the indicators of compromises togheter with the observed data.

The idea of the meta model is to provide a guide on how to relate different objects and map the data acquired on the mdoel itself.

STIX also allows to focus analysis on specific elements, for example the instance of a malware:

this kind of focus can also be used to perform a sort of gap analysis highlighting missing information.

After the information are modeled, there’s the need for a way to exchange those informations between organizations. For this reason a portocol is needed, in the end a lot of companies will collaborate so the same method of information sharing is needed.

TAXII is managed by OASIS and was born as part of STIX, it stands for Trusted Automated Exchange of Intelligence Information. It defines a set of containers, that can be used to share different treath information, with different models. The idea is that all the impleentation should be inter-operable given the API and the message syntax. It uses JSON as a standard format messagge content interoperability, and TLS 1.2 or higher.

It defines two kinds of primary services: collections and channles, they represent common information sharing interfaces.

The interface is build on top of a standard RESTful API.

If you think about the Cyber Killchain, an attack pattern may represent in general all the first part of the killchain, once the attacker is inside of the system, all the penetration phase end. There are varius strategies than an attacker can use to take control of a system, so some organizations build a collection of those strategies to help other at identifying what attack is in place or to build secure software.

An attack pattern capture the attacker’s perspective to aid software developers acquires and operators in improving the assurance profile of their systems.

MAEC is a language for describing threat intelligene, and was developed in parallel with STIX. It is a language used for sharing structured information about malware. It includes a schema, enumerations (set of vocabulary), and a bundle. It was not born to share information with third parties, bu to provide support to team of malware analysis, so it is supposed to be more an operative tool. The use cases for it are:

MAEC should be at the center stage insiede a process of malware analysis, and be used to describe the content of a malware repository, and interact with tools to enrich that knowledge base.

MAEC defines some top-levels objects, that are somewhat similar to the domaim object provided by STIX, and they are strictly related to the malware environment, MAEC Types are similar to variable types in PL, between TLOs there are relationships, then there is the package that represent the MAEC standard output format. Common data types are the common data types used in TLOs, differently to MAEC Types are more complex pieces of data used to represent info coming from different standards.

The behaviors are the ways in which the malware interacts with the system, for example a family of malware can share a common behavior. The action is the impact of the malware on the system. THe behavior represent the intentions, the action how really it interacts with it.