Privacy-preserving and Trusted Threat Intelligence Sharing using Distributed Ledgers

Threat information sharing is considered as one of the proactive defensive approaches for enhancing the over-all security of trusted partners. Trusted partner organizations can provide access to past and current cybersecurity threats for reducing the risk of a potential cyberattack—the requirements for threat information sharing range from simplistic sharing of documents to threat intelligence sharing. Therefore, the storage and sharing of highly sensitive threat information raises considerable concerns regarding constructing a secure, trusted threat information exchange infrastructure. Establishing a trusted ecosystem for threat sharing will promote the validity, security, anonymity, scalability, latency efficiency, and traceability of the stored information that protects it from unauthorized disclosure. This paper proposes a system that ensures the security principles mentioned above by utilizing a distributed ledger technology that provides secure decentralized operations through smart contracts and provides a privacy-preserving ecosystem for threat information storage and sharing regarding the MITRE ATT&CK framework.

I. Introduction

Organisations can not afford to defend themselves isolated from the threat landscape due to the emergence of new cyber threats and hence, threat information sharing is considered an indispensable cybersecurity domain. An organisation that has faced a specific range of cyberattacks can help other organizations against adversary attacks of the same type. Threat information sharing is an essential aspect of the cybersecurity domain regarding the protection of organizations or individuals against adversary attacks. Threat information sharing involves the processes of the collection, analysis and sharing of cyber threat information among multiple organizations [1]. It ranges from public to private sharing, such as threat intelligence sharing, regionally or globally. Therefore, finding a secure and trusted way to share threat information is crucial to ensure the privacy and reliability of the participant parties. Regardless of the data type, purpose and role, whether public or private, it should traverse through a secure and trusted infrastructure, which could be challenging and costly [2]. Thus, providing a privacy-preserving method to avoid risk is crucial to maintaining confidentiality, availability, and integrity, such as preventing data loss or damage, unauthorized disclosure, data unavailability, or unauthorized alteration.