Controlled and Secure Sharing of Classified Threat Intelligence between Multiple Entities
Ricardo Fernandes, PEDRO HENRIQUE PEREIRA PINTO, António Pinto · 2021
The Malware Information Sharing Platform (MISP) enables the sharing of cyberthreat information within a community, company or organisation. However, this platform presents limitations if its information is deemed as classified or shared only for a given period of time. This implies that this information should to be handled only in encrypted form. One solution is to use MISP with searchable encryption techniques to impose greater control over the sharing of information. In this paper, we propose a controlled information sharing functionality that features a synchronisation procedure that enables classified data exchange between MISP instances, based on policies and ensuring the required confidentiality and integrity of the shared data. Sequence charts are presented validating the configuration, the data synchronisation, and the data searching between multiple entities.