On Collaboration and Automation in the Context of Threat Detection and Response with Privacy-Preserving Features
Lasse Nitz, Mehdi Akbari Gurabi, Milan Čermák, Martin Žádník, David Karpuk, Arthur Drichel, Sebastian Schäfer, Benedikt Holmes, Avikarsha Mandal · Digital Threats Research and Practice · 2024
Organizations and their security operation centers often struggle to detect and respond effectively to an extensive quantity of ever-evolving cyberattacks. While collaboration, such as threat intelligence sharing between security teams, and response automation are often discussed in the cybersecurity community, issues like data sensitivity and confidence in detection may hinder their adoption. This work investigates the potentials and challenges of collaboration and automation to enhance incident response processes. We propose a reference architecture for data sharing in threat detection and response, aiming to boost collaborative and automated efforts across organizations while also considering privacy-preserving features. To address these challenges and potentials, we discuss how such a framework could enhance current response processes within and between organizations, validated with results in local attack detection, incident response, and data sharing.