Cybersecurity is a team sport. The bad guys share information, expertise, code, and help one another. The good guys must do the same to keep pace. Sharing Threat Intelligence is a key aspect where knowledge gained by owners of sensor networks can share data in a collective way to the security analysis community. This give the necessary breadth of data to understand trends, new infections, how botnets are communicating, if directed targeting is occurring, and even if different attackers are collaborating.
Sadly, this is not the norm. Many security companies look at this data as a competitive advantage to sell their products and services. They keep it to themselves in hopes they can find a nugget and market it in a way to win over new customers. But the cost is losing the bigger picture of overall effectiveness.
Things are slowly changing. Some security firms are stepping up and sharing more and more data. This is redacted of personal information and only contains attack characteristics. The combined aspects are like pieces to a massive puzzle for analysts looking for trends. It is hugely important to everyone.
I am glad to see major security vendors and researchers beginning to share insights and data. Consortiums like the Cyber Threat Alliance and sites like VirusTotal are leading the way. The Information Sharing and Analysis Organization (ISAO), established as part of a U.S. Presidential order in 2015, is developing voluntary standards for private and public data sharing. But more sharing must happen! Attacks are occurring at a phenomenal rate. Malware alone is out of control, with about forty-four thousand new unique samples being discovered every day. Security organizations must leverage each other’s information in order to better predict, prevent, detect and respond to threats their customers and organizations face.
The battle that should be fought is not between security vendors, but rather between the threats and collective defensive organizations who stand between them and their victims. We must work together to stem the tide of cyberattacks. Public sentiment is very important. If we desire our technology to be safe, we must clearly send a message to our security vendors. Share threat data or we will patronize a different supplier of security products and services. We have a voice and a vote (with our wallets).
Interested in more? Follow me on Twitter (@Matt_Rosenquist) and LinkedIn to hear insights and what is going on in cybersecurity.