Category: Cybersecurity Solutions

The Threat Intelligence Sharing Project

April 11, 2025 / CyberSec_Cafe / 0 Comments

When information sharing can concretely help our companies to anticipate cyber attacks.

It’s always a pleasure to feature insightful guest contributions here on CyberSec Café. Today, I bring you an article that dives into the transformative power of collaboration in cybersecurity.

This piece explores the Threat Intelligence Sharing Project, an initiative that exemplifies how collective efforts and innovative platforms— like Malware Information Sharing Platform (MISP) —can redefine the way we tackle cyber threats. I’m thrilled to share this with our readers, as it highlights practical approaches to making our digital world safer.

Threat Intelligence Sharing Project leveraging MISP for cybersecurity

Introduction to the Threat Intelligence Sharing Project

In today’s digital age, cybersecurity is a top priority for all businesses, large and small. Increasing cyberattack attempts require sophisticated tools and collaborative strategies to ensure the protection of sensitive data and corporate infrastructure. In this context, in 2024 several CISOs decided to join forces and develop a project called “Threat Intelligence Sharing”; an initiative to optimize the rapid and efficient sharing of Indicators of Compromise (IoCs), to materialize a common vision of collaboration.

Objectives of the Threat Intelligence Sharing project

The main objective of the Threat Intelligence Sharing project is to share, in the shortest possible time, the Impairment Indices defined as Gold. These IOCs, identified as particularly relevant and critical, are collected by the various companies participating in the project, through their security systems. Timely implementation of these IOCs in a preventative mode can help all companies involved stop attack attempts before they can cause damage.

What Are Gold IOCs?

Gold IOCs are compromise identifiers that have passed a rigorous validation process and have been classified as highly reliable.

Transforming a Compromise Indicator (IoC) into a Golden IoC requires several key steps:

IoC identification
Collection of all available data
In-depth analysis
Assessment of severity and assignment of Golden IoC status.

These steps ensure the accuracy, reliability, and relevance of the indicator for sharing.

These indexes include information about malicious IP addresses, malicious file hashes, phishing URLs, and other characteristics that can be used to detect and prevent cyber threats. Sharing these Gold IOCs allows companies to obtain a high level of protection, based on verified and up-to-date data.

How MISP Powers Collaboration

The strength of the Threat Intelligence Sharing project lies in the collaboration between the participating companies. Each company contributes its own observations and analysis of security systems, creating a shared database of IOC Gold. This database is accessible to all the entities involved in the project, which can use it to improve their defenses. Collaboration allows you to have a more complete and up-to-date view of threats, facilitating the prevention and response to attacks.

Implementation and benefits

How to share

Gold IOCs are shared through the Malware Information Sharing Platform (MISP), an open-source platform that facilitates the exchange of threat information between different entities. MISP allows you to automate the sharing process, ensuring that IOCs are deployed quickly and securely. Companies can configure MISPs to receive real-time updates, immediately integrating them into their defense systems.

Benefits of implementation

Implementing Gold IOCs in preemptive mode offers several benefits:

Proactive protection: The ability to block attack attempts before they can compromise business systems.
Constant updates: Gold IOCs are continuously updated, ensuring that defenses are always based on current information.
Reduce risk: Sharing information allows you to identify and mitigate emerging threats in a timely manner.
Resource efficiency: Using validated IOCs reduces the time and resources required for investigation and incident response.

The crucial advantage of having validated Threat Intelligence information through the Threat Intelligence Sharing project is its ability to enhance risk mitigation against targeted cyber threats across industries and regions. Unlike using IOCs from open or paid intelligence sources, which can provide millions of indicators of compromise, but often not relevant to the business context, the information shared in the Threat Intelligence Sharing project is highly selective and relevant. These Gold IOCs are validated and contextualized, ensuring that companies receive accurate and relevant data to the real threats they face. This targeted approach reduces noise and false positives, allowing companies to focus their resources on preventing and responding to attacks that have a high impact in their specific context, thus improving the efficiency and effectiveness of their cyber defenses.

Conclusions

The “Threat Intelligence Sharing” project represents a fundamental step in the collaborative protection of corporate infrastructures. Sharing Gold Impairment Ratios allows you to achieve a proactive and efficient defense, based on verified and up-to-date data. The collaboration between the participating companies, facilitated by the MISP platform, guarantees a rapid and coordinated response to cyber threats, improving the overall security of all the entities involved. In an increasingly interconnected and vulnerable world, initiatives such as Threat Intelligence Sharing are essential for protecting corporate data and infrastructure, ensuring a more secure digital future.

Deciphering the XDR Puzzle

July 25, 2023 / CyberSec_Cafe / 0 Comments

What’s in a name: Next-Gen SIEM or Improved EDR?

Introduction

While I’ve been busy in the world of Large Language Models (LLMs) lately, a topic I have had on my mind for some time is the “semantics” of Extended Detection and Response (XDR). Just a year ago, the cybersecurity community was abuzz with discussions about XDR’s role in the industry.

Recently, however, XDR appears to have slipped from the limelight (now the trend is CISO-as-a-Service and vCISO), which I find regrettable. XDR, for me, represents a combination of EDR, NDR, IDR, augmented by SOAR.

Robin Long’s LinkedIn poll sparked a debate – “SIEM or XDR?”

This prompted me to delve deeper into what exactly XDR is. In this article, we’ll explore XDR’s potential, its relation to SIEM, and its role as an advanced EDR solution.

The XDR Conundrum

A perspective on XDR is positioning it as an enhanced and integrated EDR solution. In this context, XDR could serve also as a something that “collect and analysises security events”. Well that is dangerously close to SIEM. There are also SIEMless XDRs, leveraging its capabilities for improved detection.

At this point I’ll repropose the answer I gave to the “SIEM or XDR?” question paraphrasing Shakespeare: “What’s in a name? That which we call a SIEM, by any other word would detect as sweet”.

Another view of XDR is the amalgamation of EDR, NDR, and IDR, potentially mixed with SOAR or playbooks. Some vendors have pursued this unified approach, akin to a Unified Threat Management (UTM) solution (Unified Detection & Response would be a cool name too).

Gartner’s Insights

To shed light on the matter, Gartner provides a concise definition of XDR as “a platform that integrates, correlates and contextualizes data and alerts from multiple security prevention, detection and response components. XDR is a cloud-delivered technology comprising multiple point solutions and advanced analytics to correlate alerts from multiple sources into incidents from weaker individual signals to create more accurate detections.”

Unraveling XDR Components

Breaking down Gartner’s definition, we can extract the following key elements:

XDR as a SIEM: With its ability to correlate data and alerts from multiple security components, XDR can be seen as a SIEM with a cooler name
Enhanced/Integrated EDR: XDR’s integration and contextualization of data and alerts from prevention, detection, and response components present an improved and integrated EDR solution, ideally integrating with threat intelligence solutions.
Cloud-Delivered Technology: XDR’s cloud delivery model adds scalability and flexibility to the solution, similar to SIEM-as-a-Service.

Closing Thoughts

Although XDR’s definition doesn’t explicitly mention SOAR, I think it should be considered, especially if we aim to want to go SIEMless.

In conclusion, let’s revisit the XDR equation as EDR + NDR + IDR + SOAR, with a touch of Threat Intelligence.

Despite XDR no longer being perceived as the bleeding-edge solution, two key factors make it worthwhile in my book. First, its potential to simplify deployment, usage, and maintenance by centralizing detection within a single enriched platform. Second, the ability to reduce entropy and enhance incident management through enriched and correlated events, leading to better triage, prioritization, and overall efficiency.

While the discussion may have left SIEM unexplored (given its longstanding presence in the field), we now should have a clearer understanding of XDR and its potential in the evolving cybersecurity landscape.

The secrets to Master Key Management in Cloud Encryption

July 18, 2023 / CyberSec_Cafe / 1 Comment

A Comprehensive Guide in Light of Recent Security Breaches

Introduction

In the world of cybersecurity, a recent event serves as a grim reminder of the crucial role that key management plays in cloud encryption. On July 11, 2023, Microsoft reported a severe breach where China-backed hackers gained unauthorized access to several email inboxes, including those of prominent federal government agencies. The attack was facilitated by Microsoft’s loss of control over its own keys, underscoring the dire consequences of inadequate key management. In light of this incident, this article aims to provide a comprehensive understanding of key management in cloud encryption, underscoring the need for robust strategies to mitigate such cybersecurity threats.

In the realm of cloud services, securing sensitive data remains a critical concern for businesses worldwide. At the heart of this security is encryption, which renders data unintelligible without the appropriate decryption key. Consequently, managing these keys appropriately is of paramount importance. In this piece, we’ll delve into the nuanced world of key management, investigate the varying options provided by cloud service providers, and examine performance considerations, particularly for transaction processing.

The Importance of Key Management in Cloud Encryption

Encryption serves as the bedrock of data security within the cloud, translating readable data into a coded form decipherable only with the correct decryption key. Thus, the proper management of these keys becomes critical in maintaining data security.

Poor key management can lead to unauthorized access to encrypted data or, on the flip side, permanent loss of access to data if keys are lost or corrupted. Therefore, key management is not just an optional add-on but an essential part of an organization’s overall data security strategy.

Key Management Options in the Cloud

When it comes to managing encryption keys in the cloud, providers typically four main strategies can be used, each with its unique benefits and considerations:

Cloud Provider Managed Keys: The cloud provider generates and manages the keys, a simple approach that offers the least control over the keys. However, it’s the most cost-effective, as there are no additional charges for key management.
Bring Your Own Key (BYOK) – Customer-Managed Keys in Cloud Provider’s Hardware Security Module: Here, the client generate and manage their own own keys but store them in the cloud provider’s Hardware Security Module (HSM). This solution offers more control over the keys and guarantees secure storage and requires the use of the provider’s HSM services.
Customer Supplied and Managed Keys (CYOK) – Customer Managed Keys not exposed in Cloud: In this scenario, the end-user generates their keys, which are never exposed to cloud providers, even if stored and used in the cloud. The end-user controls the full key lifecycle and can instantly revoke keys at any time. These keys can reside in a protected virtual node within the cloud or a hybrid environment in an on-premise data center.
Hold Your Own Key (HYOK) – Customer-Managed Keys in Customer’s HSM: the client generate, manage, and store the keys in their own HSM, offering the highest level of control. This option offers the highest level of control but also requires complete responsibility for the security and resilience of the HSM infrastructure. It can be the most costly due to the overhead of maintaining an HSM infrastructure.

Deep Dive into Performance Considerations

When considering HYOK , a significant factor to take into account is the potential impact on performance, particularly when handling numerous transactions. On-premise HSMs can introduce latency due to the need for encryption/decryption requests to travel to and from the HSM.

If the demand for encryption-related operations is high and frequent, the latency could introduce bottlenecks affecting the performance of transaction processing.

However, if an organization prioritizes control and security over cost and/or performance and has the resources to manage and secure the HSM infrastructure properly, this options can be the most appropriate.

Key Considerations

In selecting your key management strategy, consider the following:

Cost: Control level usually correlates with cost; HYOK offers maximum control but at higher costs.
Performance: Encryption and decryption operations can impact application performance. Depending on the option chosen, you may need to ensure adequate resources to guarantee performance.
Confidentiality: With cloud provider-managed keys, the provider potentially can access your keys. For utmost confidentiality, managing keys in your own HSM is advisable.
Jurisdiction: For regulations like GDPR, it’s crucial to know where your keys are stored and managed. Using your own HSM provides complete control and transparency over key location.
Operational Complexity: Managing your own keys introduces added operational complexity, requiring dedicated expertise in cryptographic key management.

Additionally some cloud providers might not be interested in helping the client keeping encrypted data in their systems

Conclusion

Choosing an appropriate key management strategy involves careful consideration of cost, performance, control, confidentiality, jurisdictional compliance, and operational complexity. Cloud Provider Managed Keys, BYOK, CYOK, and HYOK all offer different degrees of these factors.

The key is finding a balance that meets your organization’s specific needs and resources. With a clear understanding of the available options, you can make an informed decision that not only safeguards your data but also aligns with your operational capabilities and business objectives.

Integrating XDR and Zero Trust

April 17, 2023 / CyberSec_Cafe / 0 Comments

The Power of Effective Cybersecurity

In my article on Zero Trust I promised an in-depth exploration on the integration of Zero Trust and XDR, here it is.

As cyber threats become increasingly sophisticated and complex, traditional security approaches no longer suffice in protecting organizations from data breaches and other security incidents. This is where integrating Zero Trust and XDR technologies comes into play, providing a more effective way to reduce risk and safeguard sensitive data.

Zero Trust is a security approach that assumes all users, devices, and applications are untrusted and continuously verifies access, while XDR (Extended Detection and Response) is an advanced threat detection and response platform that enables security teams to detect and respond to attacks across multiple attack vectors and endpoints.

Integrating these two technologies can help organizations achieve a higher level of security by leveraging the strengths of each. Here are some key benefits of integrating XDR and Zero Trust:

Improved Detection and Response Capabilities

By integrating XDR and Zero Trust, security teams can enhance their detection and response capabilities. XDR can detect potential threats across multiple attack vectors, while Zero Trust can automatically block potentially malicious network destinations, breached identities, and breached devices. This combination enables security teams to respond quickly and effectively to potential threats.

Better Risk Management

The integration of XDR and Zero Trust provides better risk management by combining threat detection and response with access control. With Zero Trust, access is continuously verified and controlled, while XDR can identify potential threats and provide insights to help mitigate risk.

More Efficient Threat Management

XDR and Zero Trust integration can also improve threat management efficiency by automating the response to potential threats. For example, if an EDR system detects a suspicious event, XDR can use a playbook that incorporates Zero Trust to automatically block the event, with subsequent verification and unlocking in case it is a false positive. This approach is more efficient than traditional inspection methods and can help security teams respond to potential threats quickly and effectively.

Simplified Security Operations

Integrating XDR and Zero Trust can simplify security operations by consolidating security tools and technologies. With XDR and Zero Trust working together, security teams can reduce the number of tools and technologies they need to manage, making security operations more efficient and effective.

In conclusion, the integration of XDR and Zero Trust is a powerful combination that can provide organizations with a more effective way to reduce risk and protect sensitive data. By leveraging the strengths of each technology, organizations can enhance their detection and response capabilities, improve risk management, simplify security operations, and achieve compliance with regulatory and industry standards.