Community of interest : CTI
Structuring and implementing a cyber commons for data sharing in connection with Cyber Threat Intelligence
Category: Communities of Interest
Statut : En cours
Logbook
January - February 2024
Decisions Governance and Operations
The WG discussed the different ways of segregating data in OpenCTI. This central question is linked to operational and governance issues: who should have access to which data, and how is the information verified? Proposals put forward by Filigran are currently being studied.
The first layer of the platform will be dedicated to TLP CLEAR and GREEN information, which will be widely accessible. The lower layers of information will be accessible to specific groups of users.
At present, members of the WG are testing the different import modes according to their own uses. The short-term objective is to have a platform that is regularly updated with current information.
Several organisations are already using the TIP internally, and the details will be presented at forthcoming Studio events.
The Campus is due to propose a model governance contract in the near future.
[Events]
On September 21, 2023, the GT CTI presented its productions at an event at the Campus Cyber.
The presented slides are avalaible for download.
On 04.05.23, the WG took the following decisions :
Plan an OpenCTI presentation event, then, following this event : Update the list of active contributors Launch a "call for collaboration Create a "decision-making committee" for the future life of the platform (governance and maintenance), bringing together members, customers, public players and the cyber campus team. Another topic discussed was the creation of a methodological framework for data entry and validation, in line with the doctrine that has been published.
On 11.04.23, the CTI WG worked on :
- use of the future TIP by WG members (information supply and consumption)
He made the following decisions:
- start building the technical stack, even if governance is not yet fully in place
- start a V0 POC with TLP:clear only
- stream governance meeting in the coming weeks.
On 07.03.23, the CTI WG worked on :
Choice of tech stack to define a Campus TIP
He took the following decisions :
- Base the platform on OpenCTI in SaaS mode.
- Keep the architecture simple, no agglomeration of bricks.
The issues of governance (and licenses), financing and potential hosting (if not SaaS mode) can be taken up again with these elements.
On 03/02/23, the GT CTI worked on :
Technology mapping (Sekoia, OpenCTI, MISP, Yeti, Anomali)
Technology mapping (Sekoia, OpenCTI, MISP, Yeti, Anomali)
Compare the doctrine's indicators with the various technologies on offer Consider the possibility of members covering part of the costs.
The topics of shared financing and governance have emerged and will be addressed in the Governance stream.
Events
Working Groups
| Status | Description | |
|---|---|---|
| CTI WG - Threat Intelligence Platform | En cours | Structuring and implementing a cyber commons for data sharing in connection with Cyber Threat Intelligence. |
| WG CTI - Doctrine | Terminé | Describe the principles, rules, guidelines and methods for creating and sharing intelligence of cyber interest |
